raxml-light

maintainer malacology · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source URL points to cme.h-its.org, which is the Heidelberg Institute for Theoretical Studies (HITS) computational molecular evolution group — the official upstream host for RAxML and related tools. The URL pattern using a PHP counter script (countRAxMLLight109.php) is a common download-counting mechanism used by academic software projects. The md5sum is hardcoded, providing integrity verification. The build process compiles from source using standard make/gcc, and only installs a single binary. This is a legitimate academic bioinformatics tool with an unusual but authentic download URL pattern. The cheaper model flagged the non-standard domain, but this is the official project host. The only real concern is the weak md5sum (should be sha256) and the 'unknow' license field, both of which are sloppy but not security risks.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 80%): The source URL points to cme.h-its.org, which is the Heidelberg Institute for Theoretical Studies (HITS) computational molecular evolution group — the official upstream host for RAxML and related tools. The URL pattern using a PHP counter script (countRAxMLLight109.php) is a common download-counting mechanism used by academic software projects. The md5sum is hardcoded, providing integrity verification. The build process compiles from source using standard make/gcc, and only installs a single binary. This is a legitimate academic bioinformatics tool with an unusual but authentic download URL pattern. The cheaper model flagged the non-standard domain, but this is the official project host. The only real concern is the weak md5sum (should be sha256) and the 'unknow' license field, both of which are sloppy but not security risks.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("https://cme.h-its.org/exelixis/php/countRAxMLLight${pkgver//./}.php")

PKGBUILD

1 offending line(s) highlighted

      1pkgname=raxml-light
    
      2_pkgname=RAxML-Light
    
      3pkgver=1.0.9
    
      4pkgrel=1
    
      5pkgdesc="A tool for computing terabyte phylogenies https://doi.org/10.1093/bioinformatics/bts309"
    
      6arch=('x86_64')
    
      7url="https://cme.h-its.org/exelixis/web/software/raxml-light/index.html"
    
      8depends=('gcc-libs')
    
      9makedepends=('make' 'gcc')
    
      10license=('unknow')
    
      11source=("https://cme.h-its.org/exelixis/php/countRAxMLLight${pkgver//./}.php")
    
      12md5sums=('a2740440b2d498a03bab88fbd6b7432a')
    
      13
    
      14build() {
    
      15  cd "${_pkgname}-$pkgver"
    
      16  make -f Makefile.AVX.gcc
    
      17}
    
      18
    
      19package() {
    
      20  cd "${_pkgname}-$pkgver"
    
      21  install -Dm 755 raxmlLight-AVX $pkgdir/usr/bin/$pkgname
    
      22}
    
      23
    
      24

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2