quik
LOW
maintainer CupIvan
2 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads project-related sources and dependencies from official and plausibly official hosts (arqatech.com, ftp.quik.ru, github.com); all are relevant to the software being built, and no untrusted or swappable hosts are used for executable payloads.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The package downloads project-related sources and dependencies from official and plausibly official hosts (arqatech.com, ftp.quik.ru, github.com); all are relevant to the software being built, and no untrusted or swappable hosts are used for executable payloads.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:16
"https://arqatech.com/upload/iblock/ded/quik_${pkgver}_upd.zip" -
PKGBUILD:17
"ftp://ftp.quik.ru/public/updates/10.2/StratVolat_${stratver}_upd.zip"
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: CupIvan <mail@cupivan.ru>
2
pkgname=quik
3
pkgver=13.2.0
4
pkgrel=1
5
stratver=3.0.5
6
#trustver=2.10.0
7
#btradever=1.2.1002
8
pkgdesc="Trading terminal in Wine"
9
url="https://arqatech.com/ru/products/quik/terminals/user-applications/quik-workstation/"
10
arch=('x86_64')
11
12
noextract=('keygen.zip')
13
depends=('wine' 'unixodbc')
14
15
source=(
16
"https://arqatech.com/upload/iblock/ded/quik_${pkgver}_upd.zip"
17
"ftp://ftp.quik.ru/public/updates/10.2/StratVolat_${stratver}_upd.zip"
18
#"ftp://ftp.quik.ru/public/updates/11.2/TrustManager_${trustver}_upd.zip"
19
#"ftp://ftp.quik.ru/public/updates/10.2/BTrading_${btradever}_upd.zip"
20
"keygen.zip::ftp://ftp.quik.ru/public/updates/keygen_1.3.0_upd.zip"
21
"https://github.com/alain-riedinger/luasocket/releases/download/3.0-5.3.5/luasocket-3.0-5.3.5.zip"
22
"https://github.com/alain-riedinger/luasocket/releases/download/3.1-5.4.7/luasocket-3.1-5.4.7.zip"
23
"quik"
24
"quik-keygen"
25
"qrypto.cfg"
26
"ip.cfg"
27
)
28
sha256sums=(
29
'dab9689d1c6c8ef90336126b9e66a9ecb818934866829cc8f2b0c5c3e0036a77' # quik_13.2.0_upd.zip
30
'd32095309cd7359f4078a74179d8ae42e013e3fd3ad75837f0fa3941e7091b75' # StratVolat 3.0.5
31
#'ff4dd52e56fabe8c06730daca770a92312338303bc06b58d417105d44c5a0869' # TrustManager
32
#'0f6724e6666c379cf9a1f53aa627f4b0c56fded2d7e3fbf3704d6526066fa8e3' # BasketTrading
33
'bc66665d2209836abe51ae9258c289c0f682dba4ea5261f9319996a60a6a4ae7' # keygen
34
'b2a3a2e2a895cea35aad5dee97640ef7bcccbb38e61e61b14baff6cecbdd79af' # lua-socket 5.3.5
35
'f45993d0f5d1d84fe0c084433505d3a84babd6f5686fc2c3c7a7119b9727e927' # lua-socket 5.4.7
36
'70f46a29703b822ddff8b502c07697a05e478b7de51b9e55d67c4dc37e1bb80f' # quik
37
'758f427eccd973964ce6fcf8d0dd3064bf694096ee56f6d49e27e165ecab54c4' # quik-keygen
38
'd981ee4cc35d33a3b37c43fb7343bde5c24e15e003dbb67907b602d22f60a469'
39
'49aa53c38ceb5c3029398203a68bbb1b3cc9819d01ecb57a6ce13c31b344fe03' # ip.cfg
40
)
41
42
prepare() {
43
mkdir -p {keygen,socket-5.3,socket-5.4}
44
bsdtar -xzf keygen.zip -C keygen
45
bsdtar -xzf luasocket-3.0-5.3.5.zip -C socket-5.3
46
bsdtar -xzf luasocket-3.1-5.4.7.zip -C socket-5.4
47
48
# bugfix in luasock 5.4 @url https://gist.github.com/ttys3/31dbf88ee7d708294d8ae5b0a4954424
49
# cd ./socket-5.4/x64/socket/
50
# cat http.lua | sed 's/receive()/receive("*l")/' > tmp; mv tmp http.lua
51
# cat tp.lua | sed 's/receive()/receive("*l")/' > tmp; mv tmp tp.lua
52
}
53
54
package() {
55
bindir="${pkgdir}/usr/lib/quik/bin"
56
# quik
57
install -Dm755 quik "${pkgdir}/usr/bin/quik"
58
for fname in ./*.exe; do install -Dm755 $fname "$bindir/$fname"; done
59
for fname in ./*.dll; do install -Dm644 $fname "$bindir/$fname"; done
60
for fname in ./*.chm; do install -Dm644 $fname "$bindir/$fname"; done
61
for fname in ./*.cfg; do install -Dm644 $fname "$bindir/$fname"; done
62
63
# keygen
64
install -Dm755 quik-keygen "${pkgdir}/usr/bin/"
65
for fname in ./keygen/*.exe; do install -Dm755 $fname "$bindir/$fname"; done
66
for fname in ./keygen/*.dll; do install -Dm644 $fname "$bindir/$fname"; done
67
for fname in ./keygen/*.chm; do install -Dm644 $fname "$bindir/$fname"; done
68
69
# libs
70
cd "${srcdir}/socket-5.3/x64/"
71
for fname in {mime/core.dll,socket/core.dll}; do install -Dm644 $fname "$bindir/../lib/lua/5.3/$fname"; done
72
for fname in {*.lua,socket/*.lua}; do install -Dm644 $fname "$bindir/../share/lua/5.3/$fname"; done
73
cd "${srcdir}/socket-5.4/x64/"
74
for fname in {mime/core.dll,socket/core.dll}; do install -Dm644 $fname "$bindir/../lib/lua/5.4/$fname"; done
75
for fname in {*.lua,socket/*.lua}; do install -Dm644 $fname "$bindir/../share/lua/5.4/$fname"; done
76
}
77
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |