scalastyle-2.12

LOW

maintainer nihilistzsche 0 votes scanned 2026-08-28 05:35:56.894338

View on AUR

Why flagged

The JAR is downloaded from Maven Central (repo1.maven.org), which is the official, trusted Maven repository, and has an md5 checksum; the only minor issue is the noextract uses single quotes so the variable isn't expanded, but this is a packaging quality issue rather than a security concern.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): The JAR is downloaded from Maven Central (repo1.maven.org), which is the official, trusted Maven repository, and has an md5 checksum; the only minor issue is the noextract uses single quotes so the variable isn't expanded, but this is a packaging quality issue rather than a security concern.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source=("https://repo1.maven.org/maven2/com/beautiful-scala/${_pkgbase}_$_scalaver/$pkgver/$_jarname"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Christian Krause ("wookietreiber") <christian.krause@mailbox.org>
    
      2
    
      3_pkgbase=scalastyle
    
      4_scalaver="2.12"
    
      5pkgname="$_pkgbase-$_scalaver"
    
      6pkgver=1.5.1
    
      7pkgrel=1
    
      8pkgdesc="Examines your Scala code and indicates potential problems with it. (For Scala 2.12)"
    
      9arch=(any)
    
      10url="http://scalastyle.beautiful-scala.com/"
    
      11license=('Apache')
    
      12depends=('java-environment' 'bash')
    
      13provides=('scalastyle')
    
      14conflicts=('scalastyle')
    
      15
    
      16_jarname="${_pkgbase}_$_scalaver-$pkgver-assembly.jar"
    
      17
    
      18source=("https://repo1.maven.org/maven2/com/beautiful-scala/${_pkgbase}_$_scalaver/$pkgver/$_jarname"
    
      19  "scalastyle.sh")
    
      20
    
      21noextract=('$_jarname')
    
      22
    
      23md5sums=('1284cc5ff68465fe4c88185bc0c4ff64'
    
      24  '5a81d7de6ef3bf090a2e6f97d2a96c18')
    
      25
    
      26package() {
    
      27  install -Dm644 $srcdir/$_jarname $pkgdir/usr/share/java/scalastyle/$_jarname
    
      28  install -Dm755 $srcdir/scalastyle.sh $pkgdir/usr/bin/scalastyle
    
      29}
    
      30

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-28 05:35:56	Low	3
2026-08-28 05:34:42	Medium	2