rsa-tokenconverter

LOW

maintainer Omar007 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads source files from a non-standard host (Salesforce CDN), but these are the project's official release artifacts; the worst case of a swapped source is distribution of malicious data, not code execution, as the JAR files are part of the expected software and the build process does not execute untrusted code.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source files from a non-standard host (Salesforce CDN), but these are the project's official release artifacts; the worst case of a swapped source is distribution of malicious data, not code execution, as the JAR files are part of the expected software and the build process does not execute untrusted code.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("${pkgname}-${pkgver}.zip::https://rsasecurity.my.salesforce.com/sfc/dist/version/download/?oid=00D70000000IwPy&ids=0684u00000dLhcuAAC&d=/a/4u000001VZmA/hsX4xKY5COHVRYTakz3xOhzidAxid7qIfx8688ujFwU&operationContext=DELIVERY&viewId=05HPO000009aGx82AE&dpt="

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Omar Pakker <archlinux@opakker.nl>
    
      2
    
      3pkgname=rsa-tokenconverter
    
      4pkgver=3.1.0
    
      5pkgrel=4
    
      6pkgdesc="Converts an RSA SecurID software token into a CTF URL or a QR Code."
    
      7arch=('any')
    
      8url="https://community.rsa.com/s/article/RSA-SecurID-Software-Token-Converter-3-1-Downloads"
    
      9license=('APACHE')
    
      10depends=('bash' 'java-runtime')
    
      11source=("${pkgname}-${pkgver}.zip::https://rsasecurity.my.salesforce.com/sfc/dist/version/download/?oid=00D70000000IwPy&ids=0684u00000dLhcuAAC&d=/a/4u000001VZmA/hsX4xKY5COHVRYTakz3xOhzidAxid7qIfx8688ujFwU&operationContext=DELIVERY&viewId=05HPO000009aGx82AE&dpt="
    
      12        "${pkgname}-${pkgver}-admin.pdf::https://rsasecurity.my.salesforce.com/sfc/dist/version/download/?oid=00D70000000IwPy&ids=0684u00000dLz0TAAS&d=/a/4u000001VZrZ/qELKQxEoKMBX8WLsHrDAqBhBQOVgLMU8KYNilTcMWvA&operationContext=DELIVERY&viewId=05HPO000009aJer2AE&dpt=")
    
      13sha1sums=('0dc18d7ef715c293b008c37f6f6808944b6d2db3'
    
      14          '04d2608ffd419c91728a1a51e64bb8d5460d02bb')
    
      15sha256sums=('b167293fce913c7304da94ccf4580565ad96376d209fce830c7da854011866d9'
    
      16            '39499e01ca117bf57b753f3ce509db00cbfa298dcb82de86a6dd7d107158617e')
    
      17
    
      18prepare() {
    
      19	{
    
      20		echo '#!/usr/bin/env sh'
    
      21		echo 'exec java -jar /usr/share/'"${pkgname}"'/TokenConverter.jar "${@}"'
    
      22	} > "${pkgname}"
    
      23}
    
      24
    
      25package() {
    
      26	install -Dm644 "${pkgname}-${pkgver}-admin.pdf" "${pkgdir}/usr/share/doc/${pkgname}/manual.pdf"
    
      27
    
      28	install -Dm644 -t "${pkgdir}/usr/share/${pkgname}" \
    
      29		zxing-core-2.1.jar \
    
      30		TokenConverter.jar
    
      31
    
      32	install -Dm755 "${pkgname}" "${pkgdir}/usr/bin/${pkgname}"
    
      33}
    
      34

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2