seismic-unix

maintainer kelen · 2 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a source tarball from a project-associated Nextcloud instance, which is not on a standard forge but plausibly official; the source is built locally and no remote code execution occurs, limiting risk despite the non-whitelisted host and skipped checksum.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a source tarball from a project-associated Nextcloud instance, which is not on a standard forge but plausibly official; the source is built locally and no remote code execution occurs, limiting risk despite the non-whitelisted host and skipped checksum.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source=("seismic_unix.tgz::https://nextcloud.seismic-unix.org/s/LZpzc8jMzbWG9BZ/download?path=%2F&files=cwp_su_all_44R28.tgz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: anon at sansorgan.es 
    
      2# Past-Maintainer: CUI Hao <cuihao.leo@gmail.com>
    
      3
    
      4pkgname=seismic-unix
    
      5pkgver=44.28
    
      6pkgrel=2
    
      7pkgdesc='A seismic processing and research environment developed
    
      8at the Center for Wave Phenomena, Colorado School of Mines'
    
      9arch=('i686' 'x86_64')
    
      10license=('custom')
    
      11url="https://wiki.seismic-unix.org/start"
    
      12depends=('libtirpc' 'libxaw' 'openmotif')
    
      13optdepends=(
    
      14    'tcsh: some scripts'
    
      15    'gcc-fortran: Fortran support')
    
      16makedepends=('git' 'gcc-fortran' 'libtirpc' 'libxaw' 'openmotif' 'glu' 'freeglut')
    
      17#source=("git+https://github.com/JohnWStockwellJr/SeisUnix.git")
    
      18source=("seismic_unix.tgz::https://nextcloud.seismic-unix.org/s/LZpzc8jMzbWG9BZ/download?path=%2F&files=cwp_su_all_44R28.tgz")
    
      19md5sums=("SKIP")
    
      20install=seismic-unix.install
    
      21
    
      22prepare() {
    
      23    cd ${srcdir}/src/
    
      24    # start fresh
    
      25    rm -rf ../bin/
    
      26    rm -rf ../lib/
    
      27    # removing all *.o files (fixes issues)
    
      28    find . -type f -iname '*.o' -exec rm {} \;
    
      29    
    
      30    # fix mglinstall script
    
      31    echo "MGLCFLAGS += -fcommon" >> configs/Makefile.config_Linux_ARCH
    
      32    cp configs/Makefile.config_Linux_ARCH Makefile.config
    
      33
    
      34    # The following is not needed for new Makefile.config
    
      35    # sed -i 's_/usr/X11[^/]*/_/usr/_' Makefile.config
    
      36    # sed -i 's/BSD_SOURCE/DEFAULT_SOURCE/' Makefile.config
    
      37    # sed -i 's/-O/-O2/' Makefile.config
    
      38    # sed -i '/^OPTC/ s/$/-ltirpc -no-pie/' Makefile.config
    
      39    # sed -i '/^POSTLFLAGS/ s/$/ -no-pie/' Makefile.config
    
      40    # sed -i '/^FOPTS/ s/$/-std=legacy -no-pie/' Makefile.config
    
      41    
    
      42    sed -i 's_read RESP_RESP=y_' chkroot.sh
    
      43    echo -ne '#!/bin/sh\ntrue\n' | tee license.sh mailhome.sh
    
      44}
    
      45
    
      46build() {
    
      47    export CWPROOT="$srcdir"
    
      48    #export CWPROOT="$srcdir/SeisUnix"
    
      49
    
      50    mkdir -p "$CWPROOT"
    
      51    cd "$CWPROOT"
    
      52    # ln -sf "$srcdir/src/SeisUnix/src" src
    
      53    # ln -sf "$srcdir/src/" src
    
      54    # ln -sf "$srcdir/seismic-unix/src" src
    
      55
    
      56    # cd "$srcdir/src/SeisUnix/src"
    
      57    cd ${srcdir}/src/
    
      58    make -j1 install
    
      59    make -j1 xtinstall
    
      60    make -j1 xminstall
    
      61    make -j1 finstall
    
      62    # mgl can not be compiled now.
    
      63    # make -j1 mglinstall
    
      64    make -j1 utils
    
      65}
    
      66
    
      67package() {
    
      68    #export CWPROOT="$srcdir/src/SeisUnix/build"
    
      69    export CWPROOT="$srcdir"
    
      70    cd "$CWPROOT"
    
      71    install -dm755 "$pkgdir/opt/$pkgname"
    
      72    cp -r {,"$pkgdir/opt/$pkgname/"}bin/
    
      73    cp -r {,"$pkgdir/opt/$pkgname/"}include/
    
      74    cp -r {,"$pkgdir/opt/$pkgname/"}lib/
    
      75    cp -r {,"$pkgdir/opt/$pkgname/"}src/
    
      76    chmod -R a+r "$pkgdir/opt/$pkgname"
    
      77    
    
      78    install -dm755 "$pkgdir/usr/share/licenses/$pkgname" 
    
      79    install -m644 "$srcdir/src/LEGAL_STATEMENT" "$pkgdir/usr/share/licenses/$pkgname" 
    
      80    install -m644 "$srcdir/src/ACKNOWLEDGEMENTS" "$pkgdir/usr/share/licenses/$pkgname" 
    
      81    install -dm755 "$pkgdir/etc/profile.d/"
    
      82    cat > "$pkgdir/etc/profile.d/$pkgname.sh" << EOF
    
      83#!/bin/bash
    
      84export CWPROOT="/opt/$pkgname"
    
      85export PATH="\$PATH:\$CWPROOT/bin"
    
      86EOF
    
      87    cat > "$pkgdir/etc/profile.d/$pkgname.csh" << EOF
    
      88setenv CWPROOT /opt/$pkgname
    
      89setenv PATH \${PATH}:\${CWPROOT}/bin
    
      90EOF
    
      91    chmod 755 "$pkgdir/etc/profile.d/$pkgname"{.sh,.csh}
    
      92}
    
      93md5sums=('8dac66e953b3998ee8acbaeacb0bce77')
    
      94

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2