smath

maintainer tomracing · 11 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a source tarball from the project's own domain smath.com, which is plausibly the official release infrastructure; the download uses a non-standard URL pattern requiring a POST request, but this is handled transparently by the DLAGENTS override and does not introduce remote code execution or supply-chain risks beyond typical AUR packages; the installed files are the program's own binaries and resources, with no evidence of malicious behavior.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a source tarball from the project's own domain smath.com, which is plausibly the official release infrastructure; the download uses a non-standard URL pattern requiring a POST request, but this is handled transparently by the DLAGENTS override and does not introduce remote code execution or supply-chain risks beyond typical AUR packages; the installed files are the program's own binaries and resources, with no evidence of malicious behavior.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 source=("https://smath.com/en-US/file/${_pkgcode}/SMathStudioDesktop.${pkgver}.Mono.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Contributor: Anton Bazhenov <anton.bazhenov at gmail>
    
      2# Maintainer: Tom v/d Brink <tomracing at gmail>
    
      3# Maintainer: Stefan Husmann <stefan-husmann@t-online.de>
    
      4# Maintainer: ximeg <ximeg@tomcity.net>
    
      5# Maintainer: desperat <c2h5ohzh2@o2.pl>
    
      6# Maintainer: Mihai Coman <mihai@m1x.ro>
    
      7# Credits to: Jake <> for solving the server download definitions
    
      8# http://smath.info
    
      9
    
      10pkgname=smath
    
      11pkgver=1_5_9678
    
      12pkgrel=1
    
      13pkgdesc="A mathematical program with many features and paper-like interface, similar to Mathcad"
    
      14_pkgcode=NKnL7
    
      15arch=('i686' 'x86_64')
    
      16url="http://smath.com"
    
      17license=('CCPL')
    
      18groups=('math')
    
      19depends=('mono')
    
      20install=smath.install
    
      21backup=(opt/$pkgname/settings.inf)
    
      22source=("https://smath.com/en-US/file/${_pkgcode}/SMathStudioDesktop.${pkgver}.Mono.tar.gz")
    
      23md5sums=('666168f21585a707431ab6c9a4e2451b')
    
      24DLAGENTS=("https::/usr/bin/wget --post-data RefMem=&PostBack=${_pkgcode} %u")
    
      25
    
      26package() {
    
      27  cd "$srcdir"
    
      28  # install program
    
      29  install -m755 -d "$pkgdir"/opt/$pkgname/{book,examples,lang,entries,plugins,snippets}
    
      30  install -m755 -d "$pkgdir"/opt/$pkgname/plugins/{02f1ab51-215b-466e-a74d-5d8b1cf85e8d,06b5df04-393e-4be7-9107-305196fcb861,2814e667-4e12-48b1-8d51-194e480eabc5,485d28c5-349a-48b6-93be-12a35a1c1e39,4974b228-4974-44cf-8274-bf2936b4a766}
    
      31  install -m755 -d "$pkgdir"/opt/$pkgname/plugins/{89ec7a32-2a1f-4345-8f70-9a7fbcfd7812,8ec52daf-bcdb-4e5c-8e07-fade44a14e50,b0c79170-8f25-4115-97ae-f372f409e68c,c451c2b5-798b-4f08-b9ec-b90963d1ddaa,e1a5132a-4f6a-4518-972f-c35a8906be8c}
    
      32  install -m644 -t "$pkgdir"/opt/$pkgname/book book/*
    
      33  install -m644 -t "$pkgdir"/opt/$pkgname/examples examples/*
    
      34  install -m644 -t "$pkgdir"/opt/$pkgname/lang lang/*
    
      35  install -m644 -t "$pkgdir"/opt/$pkgname *.{dll,exe}
    
      36  install -m644 -t "$pkgdir"/opt/$pkgname/entries entries/*
    
      37  # install -m644 -t "$pkgdir"/opt/$pkgname/plugins plugins/*
    
      38  install -m644 -t "$pkgdir"/opt/$pkgname/plugins/02f1ab51-215b-466e-a74d-5d8b1cf85e8d plugins/02f1ab51-215b-466e-a74d-5d8b1cf85e8d/*
    
      39  install -m644 -t "$pkgdir"/opt/$pkgname/plugins/06b5df04-393e-4be7-9107-305196fcb861 plugins/06b5df04-393e-4be7-9107-305196fcb861/*
    
      40  install -m644 -t "$pkgdir"/opt/$pkgname/plugins/2814e667-4e12-48b1-8d51-194e480eabc5 plugins/2814e667-4e12-48b1-8d51-194e480eabc5/*
    
      41  install -m644 -t "$pkgdir"/opt/$pkgname/plugins/485d28c5-349a-48b6-93be-12a35a1c1e39 plugins/485d28c5-349a-48b6-93be-12a35a1c1e39/*
    
      42  install -m644 -t "$pkgdir"/opt/$pkgname/plugins/4974b228-4974-44cf-8274-bf2936b4a766 plugins/4974b228-4974-44cf-8274-bf2936b4a766/*
    
      43  install -m644 -t "$pkgdir"/opt/$pkgname/plugins/89ec7a32-2a1f-4345-8f70-9a7fbcfd7812 plugins/89ec7a32-2a1f-4345-8f70-9a7fbcfd7812/*
    
      44  install -m644 -t "$pkgdir"/opt/$pkgname/plugins/8ec52daf-bcdb-4e5c-8e07-fade44a14e50 plugins/8ec52daf-bcdb-4e5c-8e07-fade44a14e50/*
    
      45  install -m644 -t "$pkgdir"/opt/$pkgname/plugins/b0c79170-8f25-4115-97ae-f372f409e68c plugins/b0c79170-8f25-4115-97ae-f372f409e68c/*
    
      46  install -m644 -t "$pkgdir"/opt/$pkgname/plugins/c451c2b5-798b-4f08-b9ec-b90963d1ddaa plugins/c451c2b5-798b-4f08-b9ec-b90963d1ddaa/*
    
      47  install -m644 -t "$pkgdir"/opt/$pkgname/plugins/e1a5132a-4f6a-4518-972f-c35a8906be8c plugins/e1a5132a-4f6a-4518-972f-c35a8906be8c/*
    
      48
    
      49  install -m644 -t "$pkgdir"/opt/$pkgname/snippets snippets/*
    
      50
    
      51  # create settings file
    
      52  touch "$pkgdir"/opt/$pkgname/settings.inf
    
      53  chmod 664 "$pkgdir"/opt/$pkgname/settings.inf
    
      54
    
      55echo "#!/bin/sh
    
      56cd /opt/smath
    
      57mono SMathStudio_Desktop.exe \"$@\"
    
      58" > ../$pkgname.sh
    
      59
    
      60  # install launcher
    
      61  install -Dm755 ../$pkgname.sh "$pkgdir"/usr/bin/$pkgname
    
      62  install -Dm644 "${startdir}/smath.desktop" "${pkgdir}/usr/share/applications/smath.desktop"
    
      63  install -Dm644 "${startdir}/SMathStudioLogo256.png" "${pkgdir}/usr/share/pixmaps/smath.png"
    
      64
    
      65}
    
      66

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2