scenic-view

LOW

maintainer melonion 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The download host jonathangiles.net is the personal site of Jonathan Giles, who is the actual upstream author of Scenic View (the GitHub URL confirms this: github.com/JonathanGiles/scenic-view). This is effectively the official distribution channel for this tool, not a random third-party mirror. The package installs a JAR file (data/bytecode, not a native binary) and a shell launcher script. The JAR is integrity-checked with a sha256sum. While jonathangiles.net is not a major forge, it is the author's own site, making this analogous to many small open-source projects that self-host releases. The risk is low: no native executed binary from an unofficial host, no obfuscation, and the sha256 pinning mitigates silent substitution. The cheaper model's MEDIUM rating is a false positive based on unfamiliarity with the author's self-hosting pattern.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 82%): The download host jonathangiles.net is the personal site of Jonathan Giles, who is the actual upstream author of Scenic View (the GitHub URL confirms this: github.com/JonathanGiles/scenic-view). This is effectively the official distribution channel for this tool, not a random third-party mirror. The package installs a JAR file (data/bytecode, not a native binary) and a shell launcher script. The JAR is integrity-checked with a sha256sum. While jonathangiles.net is not a major forge, it is the author's own site, making this analogous to many small open-source projects that self-host releases. The risk is low: no native executed binary from an unofficial host, no obfuscation, and the sha256 pinning mitigates silent substitution. The cheaper model's MEDIUM rating is a false positive based on unfamiliarity with the author's self-hosting pattern.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:9 source=('https://download.jonathangiles.net/downloads/scenic-view/scenicview-21-linux.zip'

PKGBUILD

1 offending line(s) highlighted

      1pkgname=scenic-view
    
      2pkgver=11.0.2
    
      3pkgrel=2
    
      4pkgdesc='A tool for analyzing the scenegraph of a JavaFX application'
    
      5arch=('i686' 'x86_64')
    
      6url='https://github.com/JonathanGiles/scenic-view'
    
      7license=(GPL)
    
      8depends=('java21-openjfx')
    
      9source=('https://download.jonathangiles.net/downloads/scenic-view/scenicview-21-linux.zip'
    
      10        'scenic-view'
    
      11        'scenic-view.desktop')
    
      12sha256sums=('368ce807b4dda6d7422dbfb7bd977d4d18dded6a3a36b27e10912ce5536656d5'
    
      13            '69084d16a2aeb71dc08db67ccfc8d467d0508e7f76a2ba0043312ad534f0cd30'
    
      14            '7d1fb4e5a06a081b604e10acef772e809b0aa6a7c56edbfba8bce8af47cabd96')
    
      15
    
      16prepare() {
    
      17  unzip -o scenicview-linux.zip
    
      18}
    
      19
    
      20package() {
    
      21  install -Dm644 "$srcdir/scenicview/lib/scenicview.jar" "$pkgdir/usr/share/java/scenic-view/scenicview.jar"
    
      22
    
      23  install -Dm755 scenic-view "$pkgdir/usr/bin/scenic-view"
    
      24  install -Dm644 scenic-view.desktop "$pkgdir/usr/share/applications/scenic-view.desktop"
    
      25
    
      26  #install -Dm644 org/scenicview/view/images/ui/mglass.png "$pkgdir/usr/share/pixmaps/scenic-view.png"
    
      27}
    
      28

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2