secondfaqtor

LOW

maintainer RealityRipple 3 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The source is a tarball from the maintainer's personal domain, but it contains the project's own source code that is compiled locally; the worst case of a swapped source would be code execution during build, but this is a common AUR pattern for legitimate packages and not inherently malicious.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from the maintainer's personal domain, but it contains the project's own source code that is compiled locally; the worst case of a swapped source would be code execution during build, but this is a common AUR pattern for legitimate packages and not inherently malicious.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("https://realityripple.com/Software/Applications/SecondFactor/For-Linux/AUR/SecondFaqtor-$pkgver.tar.bz2"{,.sig} "https://realityripple.com/Software/Applications/SecondFactor/For-Linux/AUR/secondfaqtor.desktop"{,.sig})

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer : Andrew Sachen <webmaster@RealityRipple.com>
    
      2
    
      3pkgname=secondfaqtor
    
      4_realname=SecondFaqtor
    
      5pkgdesc="Two-Factor Authenticator"
    
      6pkgver=1.2.6
    
      7pkgrel=1
    
      8arch=('any')
    
      9url="https://realityripple.com/Software/Applications/SecondFactor/For-Linux/"
    
      10changelog=ChangeLog
    
      11license=('Unlicense')
    
      12depends=('gambas3-gb-image>=3.15' 'gambas3-gb-image<=3.99.0' 'gambas3-gb-qt5>=3.15' 'gambas3-gb-qt5<=3.99.0' 'gambas3-gb-form>=3.15' 'gambas3-gb-form<=3.99.0' 'gambas3-gb-data>=3.15' 'gambas3-gb-data<=3.99.0' 'gambas3-gb-dbus>=3.15' 'gambas3-gb-dbus<=3.99.0' 'gambas3-gb-desktop>=3.15' 'gambas3-gb-desktop<=3.99.0' 'gambas3-gb-form-stock>=3.15' 'gambas3-gb-form-stock<=3.99.0' 'gambas3-gb-openssl>=3.15' 'gambas3-gb-openssl<=3.99.0' 'gambas3-gb-sdl2-audio>=3.15' 'gambas3-gb-sdl2-audio<=3.99.0' 'gambas3-gb-util-web>=3.15' 'gambas3-gb-util-web<=3.99.0' 'gambas3-gb-desktop-x11>=3.15' 'gambas3-gb-desktop-x11<3.99.0' 'zbar')
    
      13makedepends=('gambas3-dev-tools')
    
      14source=("https://realityripple.com/Software/Applications/SecondFactor/For-Linux/AUR/SecondFaqtor-$pkgver.tar.bz2"{,.sig} "https://realityripple.com/Software/Applications/SecondFactor/For-Linux/AUR/secondfaqtor.desktop"{,.sig})
    
      15sha256sums=('7a5795f38e331d47879d309fda07761d1107e16298ed90fd5862344bb4d04187' '46a256298c856dc98eecc396f372dc1cefc7de9ed99c83045a8efc8492cb726f' '70e6ce665d759ed7e6057ad3b5fbbd34413fdc50cbf7b813b4a80a83e8f3610d' '63d453bf8db7cfcbf1ec029a6ec57df9d35b66d35c908f206db6cf4f82514ac0')
    
      16
    
      17validpgpkeys=('2BE391EF8EF9DB1E9BF546620B7C73813443493A') # Andrew Sachen
    
      18
    
      19build() {
    
      20  cd ${srcdir}/SecondFaqtor
    
      21
    
      22  cp icon.png .app.png
    
      23
    
      24  gbc3 -e -a -g -t -x  && gba3
    
      25}
    
      26
    
      27package() {
    
      28  cd ${srcdir}/SecondFaqtor
    
      29
    
      30  install -d ${pkgdir}/usr/bin
    
      31  install -m755 SecondFaqtor.gambas ${pkgdir}/usr/bin/SecondFaqtor
    
      32  ln -s 'SecondFaqtor' "${pkgdir}"/usr/bin/'secondfaqtor'
    
      33  install -D icon.png \
    
      34    ${pkgdir}/usr/share/pixmaps/SecondFaqtor.png
    
      35  install -D ../secondfaqtor.desktop \
    
      36    ${pkgdir}/usr/share/applications/secondfaqtor.desktop
    
      37}
    
      38

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2