sdm-assist-bin

maintainer dreieck · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt JAR and HTML documentation from a personal domain, but these are not executed remotely and the JAR is likely the legitimate application; the host is non-standard but the content is consistent with a niche tool's distribution, and no code execution or exfiltration is present.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt JAR and HTML documentation from a personal domain, but these are not executed remotely and the JAR is likely the legitimate application; the host is non-standard but the content is consistent with a niche tool's distribution, and no code execution or exfiltration is present.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:38 "assist_${pkgver}.zip::http://zenoshrdlu.com/assist/assist.zip"
PKGBUILD:39 "http://www.zenoshrdlu.com/assist/assist.html"

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: dreieck
    
      2
    
      3_pkgname="sdm-assist"
    
      4pkgname="${_pkgname}-bin"
    
      5pkgver=2.20A_201702
    
      6pkgrel=2
    
      7epoch=0
    
      8pkgdesc="Application designed to make the process of installing SDM Version 2.1 on your Canon camera as simple as possible."
    
      9arch=(
    
      10  any
    
      11)
    
      12url="http://zenoshrdlu.com/assist/assist.html"
    
      13license=(
    
      14  'custom: freeware'
    
      15)
    
      16groups=(
    
      17  'sdm'
    
      18)
    
      19depends=(
    
      20  'bash'
    
      21  'java-runtime'
    
      22)
    
      23makedepends=()
    
      24checkdepends=()
    
      25optdepends=()
    
      26provides=(
    
      27  "${_pkgname}=${pkgver}"
    
      28)
    
      29conflicts=(
    
      30  "${_pkgname}"
    
      31)
    
      32replaces=()
    
      33backup=()
    
      34options=()
    
      35install=
    
      36changelog=
    
      37source=(
    
      38  "assist_${pkgver}.zip::http://zenoshrdlu.com/assist/assist.zip"
    
      39  "http://www.zenoshrdlu.com/assist/assist.html"
    
      40  "http://www.zenoshrdlu.com/assist/assist0.html"
    
      41  "http://www.zenoshrdlu.com/assist/assist1.html"
    
      42  "http://www.zenoshrdlu.com/assist/assist11.html"
    
      43  "http://www.zenoshrdlu.com/assist/assist111.html"
    
      44  "http://www.zenoshrdlu.com/assist/assist2.html"
    
      45  "http://www.zenoshrdlu.com/assist/assist3.html"
    
      46  "http://www.zenoshrdlu.com/assist/assist33.html"
    
      47  "http://www.zenoshrdlu.com/assist/assist4.html"
    
      48  "http://www.zenoshrdlu.com/assist/assist40.html"
    
      49  "http://www.zenoshrdlu.com/assist/assist41.html"
    
      50  "http://www.zenoshrdlu.com/assist/assist5.html"
    
      51  "http://www.zenoshrdlu.com/assist/assist6.html"
    
      52  "http://www.zenoshrdlu.com/assist/assist7.html"
    
      53  "http://www.zenoshrdlu.com/assist/assist8.html"
    
      54  "run-assist.sh"
    
      55  "license-info.txt"
    
      56)
    
      57noextract=()
    
      58sha256sums=(
    
      59  '402cc7b2670075408513391f19433deaa57206f8ab1944602036ac239ea56753'
    
      60  'b1aa85ac7ae86ef697b2674641c45936ed5de70d5c365222f791ca07e420ef47'
    
      61  'baf3b7e722d7bc587db2e1e35cedf03bd8d8ba8d4d1ec4a2b55998ce742b8619'
    
      62  '2e67004a334a528f098117bdb640b7be17444e0ba810761968588d057208a1df'
    
      63  '31b8a98e1393054115438369f55d0f6776ecac503b57d38e748f38dc2378f868'
    
      64  '2e6bafd16d653b62c62ed4f4907f827a8a55889185df38a05dff6cb4a4ab94e5'
    
      65  'e8f6b790f665b6e849b6ca88cf338e17c97d260fe8eb472a4aa906cf59e5090e'
    
      66  '3687a56078829dfae2e2a2a7db6ab981804ab0d3c61585fa9ca262c7e9f5f09d'
    
      67  '23b25ae985f0eeae62606ee951f57be649074dbc3c0664cd2fec02eadc7915fb'
    
      68  '8360c35c26e9205339079ba12e42a91eb057bc61d3555d204c1fc7d1c4fe0bbc'
    
      69  '49e8b710a290609ee7f10424ca4b06e8eddd25639f951cd0b504065700020623'
    
      70  'ca86d753a739aac08a0be496c64639881a1bbce61751c1ec09768ac2816837f6'
    
      71  '5c4deebc350466a3caf92bac5fe729187d55ba0aafa94bb2b00db40be8a4ae5a'
    
      72  '14c8c6fb80778c115e1e5265aa832ce80b02a975e88e1d17b6205f133c0694a9'
    
      73  'bb9f6dc0cd415b4b1f1c460b3f3e251f92dc115fc07e5f1d1286a17ce9c4ca0b'
    
      74  '809148e1f84d74479bfd9ca07b14547ec5c372091f6f9e9ddb2a5027dd339a08'
    
      75  '9487c83d9e12a07dcfd350916704b8e0da714e259839aa694b638805b3c5e4e7'
    
      76  '56cf148cd3c175d2dc20296cd540a2cad589bdcfa657292317954517a17c2ec6'
    
      77)
    
      78validpgpkeys=()
    
      79
    
      80prepare() {
    
      81  printf '%s\n' "${url}" > "${srcdir}/website.url"
    
      82}
    
      83
    
      84package() {
    
      85  install -v -m644 -D "${srcdir}/assist/assist.jar"     "${pkgdir}/usr/lib/assist/assist.jar"
    
      86  install -v -m755 -D "${srcdir}/run-assist.sh"         "${pkgdir}/usr/bin/assist"
    
      87
    
      88  for _htmlfilesuffix in '' 0 1 11 111 2 3 33 4 40 41 5 6 7 8; do
    
      89    install -v -m644 -D "${srcdir}/assist${_htmlfilesuffix}.html"         "${pkgdir}/usr/share/doc/${_pkgname}/assist${_htmlfilesuffix}.html"
    
      90  done
    
      91  install -v -m644 -D "${srcdir}/website.url"           "${pkgdir}/usr/share/doc/${_pkgname}/website.url"
    
      92  install -v -m644 -D "${srcdir}/license-info.txt"      "${pkgdir}/usr/share/licenses/${pkgname}/COPYING-info.txt"
    
      93  cd "${pkgdir}/usr/share/doc/${_pkgname}"
    
      94  ln -sfv "/usr/share/licenses/${pkgname}/COPYING-info.txt"     'COPYING-info.txt'
    
      95}
    
      96

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2