r-analyticflow

maintainer orphaned · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary tarball from download.ef-prime.com. Checking the project: RAnalyticFlow is developed by ef-prime, Inc. (ef-prime.com), and their official download page at r.analyticflow.com does redirect to download.ef-prime.com for binaries. So this is actually the official vendor download host, not a random third-party mirror. However, the package installs a prebuilt binary blob (a Java application) directly into /opt without any source build, which is the standard pattern for binary AUR packages. The sha256sum is pinned, providing integrity verification. The concern is real but mild: it's a prebuilt binary from what appears to be the legitimate vendor host, with a pinned checksum. This is a common and accepted AUR pattern for proprietary/binary packages. The cheaper model's concern about 'non-standard host' is a false positive since ef-prime.com is the actual developer's domain. Rating as clean/low rather than medium.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("${pkgname}-${pkgver}.tar.gz::http://download.ef-prime.com/ranalyticflow/${pkgver}/bin/RAnalyticFlow_Linux_${pkgver}.tar.gz")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary tarball from download.ef-prime.com. Checking the project: RAnalyticFlow is developed by ef-prime, Inc. (ef-prime.com), and their official download page at r.analyticflow.com does redirect to download.ef-prime.com for binaries. So this is actually the official vendor download host, not a random third-party mirror. However, the package installs a prebuilt binary blob (a Java application) directly into /opt without any source build, which is the standard pattern for binary AUR packages. The sha256sum is pinned, providing integrity verification. The concern is real but mild: it's a prebuilt binary from what appears to be the legitimate vendor host, with a pinned checksum. This is a common and accepted AUR pattern for proprietary/binary packages. The cheaper model's concern about 'non-standard host' is a false positive since ef-prime.com is the actual developer's domain. Rating as clean/low rather than medium.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  Dimitris Kiziridis <ragouel at outlook dot com>
    
      2
    
      3pkgname=r-analyticflow
    
      4pkgver=3.1.8
    
      5pkgrel=1
    
      6pkgdesc='A data analysis software that utilizes the R environment for statistical computing'
    
      7arch=('any')
    
      8url="http://r.analyticflow.com"
    
      9license=("custom:${pkgname}")
    
      10install=r-analyticflow.install
    
      11depends=('jdk8-openjdk' 'java8-openjfx' 'r-rjava')
    
      12options=('!strip' '!emptydirs')
    
      13source=("${pkgname}-${pkgver}.tar.gz::http://download.ef-prime.com/ranalyticflow/${pkgver}/bin/RAnalyticFlow_Linux_${pkgver}.tar.gz")
    
      14sha256sums=('fb14e330c2927f0b0de42196bdeb31f3e61222b37ab8ad357cca6096a6b0f395')
    
      15
    
      16package() {
    
      17  install -d "${pkgdir}/opt" 
    
      18  install -Dm644 RAnalyticFlow_3/img/desktop_48.png "${pkgdir}/usr/share/pixmaps/r-analyticflow.png"
    
      19  install -Dm644 RAnalyticFlow_3/license.txt "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      20  install -Dm644 RAnalyticFlow_3/license_ja.txt "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE_JA"
    
      21  install -Dm644 RAnalyticFlow_3/linux/r-analyticflow.desktop -t "${pkgdir}/usr/share/applications/"
    
      22  rm -rf RAnalyticFlow_3/linux RAnalyticFlow_3/license.txt RAnalyticFlow_3/license_ja.txt
    
      23  cp -avR RAnalyticFlow_3 "${pkgdir}/opt/r-analyticflow"
    
      24}
    
      25# vim:set ts=2 sw=2 et:

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2