r-analyticflow

MEDIUM

maintainer orphaned 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt binary tarball from download.ef-prime.com. Checking the project: RAnalyticFlow is developed by ef-prime, Inc. (ef-prime.com), and their official download page at r.analyticflow.com does redirect to download.ef-prime.com for binaries. So this is actually the official vendor download host, not a random third-party mirror. However, the package installs a prebuilt binary blob (a Java application) directly into /opt without any source build, which is the standard pattern for binary AUR packages. The sha256sum is pinned, providing integrity verification. The concern is real but mild: it's a prebuilt binary from what appears to be the legitimate vendor host, with a pinned checksum. This is a common and accepted AUR pattern for proprietary/binary packages. The cheaper model's concern about 'non-standard host' is a false positive since ef-prime.com is the actual developer's domain. Rating as clean/low rather than medium.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("${pkgname}-${pkgver}.tar.gz::http://download.ef-prime.com/ranalyticflow/${pkgver}/bin/RAnalyticFlow_Linux_${pkgver}.tar.gz")

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary tarball from download.ef-prime.com. Checking the project: RAnalyticFlow is developed by ef-prime, Inc. (ef-prime.com), and their official download page at r.analyticflow.com does redirect to download.ef-prime.com for binaries. So this is actually the official vendor download host, not a random third-party mirror. However, the package installs a prebuilt binary blob (a Java application) directly into /opt without any source build, which is the standard pattern for binary AUR packages. The sha256sum is pinned, providing integrity verification. The concern is real but mild: it's a prebuilt binary from what appears to be the legitimate vendor host, with a pinned checksum. This is a common and accepted AUR pattern for proprietary/binary packages. The cheaper model's concern about 'non-standard host' is a false positive since ef-prime.com is the actual developer's domain. Rating as clean/low rather than medium.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  Dimitris Kiziridis <ragouel at outlook dot com>
    
      2
    
      3pkgname=r-analyticflow
    
      4pkgver=3.1.8
    
      5pkgrel=1
    
      6pkgdesc='A data analysis software that utilizes the R environment for statistical computing'
    
      7arch=('any')
    
      8url="http://r.analyticflow.com"
    
      9license=("custom:${pkgname}")
    
      10install=r-analyticflow.install
    
      11depends=('jdk8-openjdk' 'java8-openjfx' 'r-rjava')
    
      12options=('!strip' '!emptydirs')
    
      13source=("${pkgname}-${pkgver}.tar.gz::http://download.ef-prime.com/ranalyticflow/${pkgver}/bin/RAnalyticFlow_Linux_${pkgver}.tar.gz")
    
      14sha256sums=('fb14e330c2927f0b0de42196bdeb31f3e61222b37ab8ad357cca6096a6b0f395')
    
      15
    
      16package() {
    
      17  install -d "${pkgdir}/opt" 
    
      18  install -Dm644 RAnalyticFlow_3/img/desktop_48.png "${pkgdir}/usr/share/pixmaps/r-analyticflow.png"
    
      19  install -Dm644 RAnalyticFlow_3/license.txt "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      20  install -Dm644 RAnalyticFlow_3/license_ja.txt "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE_JA"
    
      21  install -Dm644 RAnalyticFlow_3/linux/r-analyticflow.desktop -t "${pkgdir}/usr/share/applications/"
    
      22  rm -rf RAnalyticFlow_3/linux RAnalyticFlow_3/license.txt RAnalyticFlow_3/license_ja.txt
    
      23  cp -avR RAnalyticFlow_3 "${pkgdir}/opt/r-analyticflow"
    
      24}
    
      25# vim:set ts=2 sw=2 et:

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2