qizxopen

maintainer jose1711 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The source is a prebuilt Java archive (containing compiled .jar files and scripts that will be executed) downloaded from a personal Dropbox link rather than the official vendor host (axyana.com, which is commented out). The official source URL is commented out and replaced with a Dropbox link, meaning the file's provenance cannot be verified against the upstream vendor. While an MD5 checksum is present, MD5 is cryptographically weak and the Dropbox link could be silently replaced or modified by the account owner. The package installs directly from the tarball contents (cp -Rp usr ${pkgdir}) without any build step, meaning whatever binaries/JARs are in the archive go straight into the system. This is a genuine supply-chain concern: executed code (JARs, shell scripts) from an unofficial personal hosting service rather than the vendor's own distribution channel.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("https://www.dropbox.com/s/9l9qzk21l1wmtbu/qizxopen.tgz?dl=0")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The source is a prebuilt Java archive (containing compiled .jar files and scripts that will be executed) downloaded from a personal Dropbox link rather than the official vendor host (axyana.com, which is commented out). The official source URL is commented out and replaced with a Dropbox link, meaning the file's provenance cannot be verified against the upstream vendor. While an MD5 checksum is present, MD5 is cryptographically weak and the Dropbox link could be silently replaced or modified by the account owner. The package installs directly from the tarball contents (cp -Rp usr ${pkgdir}) without any build step, meaning whatever binaries/JARs are in the archive go straight into the system. This is a genuine supply-chain concern: executed code (JARs, shell scripts) from an unofficial personal hosting service rather than the vendor's own distribution channel.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jose Riha <jose1711 gmail com>
    
      2# Contributor: Vojtech Horky <vojta . horky at-symbol seznam . cz>
    
      3pkgname=qizxopen
    
      4pkgver=4.1
    
      5pkgrel=3
    
      6pkgdesc="XML indexing and searching engine, fully supporting XQuery"
    
      7url="http://www.axyana.com/qizxopen/"
    
      8arch=('any')
    
      9license=('MPL')
    
      10depends=('java-runtime' 'apache-ant' 'bash')
    
      11#source=("http://www.axyana.com/${pkgname}/_download/${pkgname}-${pkgver}.zip")
    
      12source=("https://www.dropbox.com/s/9l9qzk21l1wmtbu/qizxopen.tgz?dl=0")
    
      13md5sums=('a48c749e441390f9d1d7ae37d6898c91')
    
      14
    
      15package() {
    
      16	# As the tarfile does not contain any installer, the files
    
      17	# are copied manually
    
      18	cd $srcdir
    
      19	cp -Rp usr ${pkgdir}
    
      20}
    
      21
    
      22

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2