secondfaqtor
maintainer RealityRipple
· 3 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The source is a tarball from the maintainer's personal domain, but it contains the project's own source code that is compiled locally; the worst case of a swapped source would be code execution during build, but this is a common AUR pattern for legitimate packages and not inherently malicious.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from the maintainer's personal domain, but it contains the project's own source code that is compiled locally; the worst case of a swapped source would be code execution during build, but this is a common AUR pattern for legitimate packages and not inherently malicious.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:14
source=("https://realityripple.com/Software/Applications/SecondFactor/For-Linux/AUR/SecondFaqtor-$pkgver.tar.bz2"{,.sig} "https://realityripple.com/Software/Applications/SecondFactor/For-Linux/AUR/secondfaqtor.desktop"{,.sig})
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer : Andrew Sachen <webmaster@RealityRipple.com>
2
3
pkgname=secondfaqtor
4
_realname=SecondFaqtor
5
pkgdesc="Two-Factor Authenticator"
6
pkgver=1.2.6
7
pkgrel=1
8
arch=('any')
9
url="https://realityripple.com/Software/Applications/SecondFactor/For-Linux/"
10
changelog=ChangeLog
11
license=('Unlicense')
12
depends=('gambas3-gb-image>=3.15' 'gambas3-gb-image<=3.99.0' 'gambas3-gb-qt5>=3.15' 'gambas3-gb-qt5<=3.99.0' 'gambas3-gb-form>=3.15' 'gambas3-gb-form<=3.99.0' 'gambas3-gb-data>=3.15' 'gambas3-gb-data<=3.99.0' 'gambas3-gb-dbus>=3.15' 'gambas3-gb-dbus<=3.99.0' 'gambas3-gb-desktop>=3.15' 'gambas3-gb-desktop<=3.99.0' 'gambas3-gb-form-stock>=3.15' 'gambas3-gb-form-stock<=3.99.0' 'gambas3-gb-openssl>=3.15' 'gambas3-gb-openssl<=3.99.0' 'gambas3-gb-sdl2-audio>=3.15' 'gambas3-gb-sdl2-audio<=3.99.0' 'gambas3-gb-util-web>=3.15' 'gambas3-gb-util-web<=3.99.0' 'gambas3-gb-desktop-x11>=3.15' 'gambas3-gb-desktop-x11<3.99.0' 'zbar')
13
makedepends=('gambas3-dev-tools')
14
source=("https://realityripple.com/Software/Applications/SecondFactor/For-Linux/AUR/SecondFaqtor-$pkgver.tar.bz2"{,.sig} "https://realityripple.com/Software/Applications/SecondFactor/For-Linux/AUR/secondfaqtor.desktop"{,.sig})
15
sha256sums=('7a5795f38e331d47879d309fda07761d1107e16298ed90fd5862344bb4d04187' '46a256298c856dc98eecc396f372dc1cefc7de9ed99c83045a8efc8492cb726f' '70e6ce665d759ed7e6057ad3b5fbbd34413fdc50cbf7b813b4a80a83e8f3610d' '63d453bf8db7cfcbf1ec029a6ec57df9d35b66d35c908f206db6cf4f82514ac0')
16
17
validpgpkeys=('2BE391EF8EF9DB1E9BF546620B7C73813443493A') # Andrew Sachen
18
19
build() {
20
cd ${srcdir}/SecondFaqtor
21
22
cp icon.png .app.png
23
24
gbc3 -e -a -g -t -x && gba3
25
}
26
27
package() {
28
cd ${srcdir}/SecondFaqtor
29
30
install -d ${pkgdir}/usr/bin
31
install -m755 SecondFaqtor.gambas ${pkgdir}/usr/bin/SecondFaqtor
32
ln -s 'SecondFaqtor' "${pkgdir}"/usr/bin/'secondfaqtor'
33
install -D icon.png \
34
${pkgdir}/usr/share/pixmaps/SecondFaqtor.png
35
install -D ../secondfaqtor.desktop \
36
${pkgdir}/usr/share/applications/secondfaqtor.desktop
37
}
38
Changes since previous scan
--- PKGBUILD @ 2026-07-26 00:07+++ PKGBUILD @ 2026-08-03 00:08@@ -3,8 +3,8 @@ pkgname=secondfaqtor _realname=SecondFaqtor pkgdesc="Two-Factor Authenticator"-pkgver=1.2.5-pkgrel=4+pkgver=1.2.6+pkgrel=1 arch=('any') url="https://realityripple.com/Software/Applications/SecondFactor/For-Linux/" changelog=ChangeLog@@ -12,7 +12,7 @@ depends=('gambas3-gb-image>=3.15' 'gambas3-gb-image<=3.99.0' 'gambas3-gb-qt5>=3.15' 'gambas3-gb-qt5<=3.99.0' 'gambas3-gb-form>=3.15' 'gambas3-gb-form<=3.99.0' 'gambas3-gb-data>=3.15' 'gambas3-gb-data<=3.99.0' 'gambas3-gb-dbus>=3.15' 'gambas3-gb-dbus<=3.99.0' 'gambas3-gb-desktop>=3.15' 'gambas3-gb-desktop<=3.99.0' 'gambas3-gb-form-stock>=3.15' 'gambas3-gb-form-stock<=3.99.0' 'gambas3-gb-openssl>=3.15' 'gambas3-gb-openssl<=3.99.0' 'gambas3-gb-sdl2-audio>=3.15' 'gambas3-gb-sdl2-audio<=3.99.0' 'gambas3-gb-util-web>=3.15' 'gambas3-gb-util-web<=3.99.0' 'gambas3-gb-desktop-x11>=3.15' 'gambas3-gb-desktop-x11<3.99.0' 'zbar') makedepends=('gambas3-dev-tools') source=("https://realityripple.com/Software/Applications/SecondFactor/For-Linux/AUR/SecondFaqtor-$pkgver.tar.bz2"{,.sig} "https://realityripple.com/Software/Applications/SecondFactor/For-Linux/AUR/secondfaqtor.desktop"{,.sig})-sha256sums=('b6feeef1e1f91568d66993fee87e7550df0d7db1c36db96092504b3e0e061df9' '0f0c92562682012d5946f1a22604a468300e512481ae1fc57390b21e30531f8b' '70e6ce665d759ed7e6057ad3b5fbbd34413fdc50cbf7b813b4a80a83e8f3610d' '63d453bf8db7cfcbf1ec029a6ec57df9d35b66d35c908f206db6cf4f82514ac0')+sha256sums=('7a5795f38e331d47879d309fda07761d1107e16298ed90fd5862344bb4d04187' '46a256298c856dc98eecc396f372dc1cefc7de9ed99c83045a8efc8492cb726f' '70e6ce665d759ed7e6057ad3b5fbbd34413fdc50cbf7b813b4a80a83e8f3610d' '63d453bf8db7cfcbf1ec029a6ec57df9d35b66d35c908f206db6cf4f82514ac0') validpgpkeys=('2BE391EF8EF9DB1E9BF546620B7C73813443493A') # Andrew Sachen Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 03:31:41 | MEDIUM | 1 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 19:17:41 | MEDIUM | 1 |
| 2026-06-19 19:07:35 | CLEAN | 2 |
| 2026-06-18 16:11:54 | MEDIUM | 1 |