stavekontrolden
LOW
maintainer Freso
11 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a prebuilt .oxt file from the project's official domain for installation; while the host is not a standard forge, it is the project's own site, and the file is a standard LibreOffice extension, not an obfuscated payload or remote code.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt .oxt file from the project's official domain for installation; while the host is not a standard forge, it is the project's own site, and the file is a standard LibreOffice extension, not an obfuscated payload or remote code.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:27
source=("https://stavekontrolden.dk/dictionaries/da_DK/da_DK-$pkgver.oxt")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Frederik “Freso” S. Olesen <archlinux@freso.dk>
2
# Contributor: Frederik Nordahl Jul Sabroe <frederikns at gmail dot com>
3
# Contributor: adament <adament@adament.net>
4
# Contributor: Jamie Magee <jamie dot magee at gmail dot com>
5
pkgname=stavekontrolden
6
pkgver=2.9.133
7
pkgrel=1
8
pkgdesc='Danish dictionaries; for use with multiple programs'
9
arch=('any')
10
url='https://stavekontrolden.dk/'
11
license=('GPL-3.0-only AND (GPL-2.0-only AND LGPL-2.1-only AND MPL-1.1)')
12
optdepends=(
13
'hunspell: the spell checking libraries and apps'
14
'hyphen: for use of hyphenation rules'
15
'libmythes: for use of thesaurus dictionary')
16
makedepends=(
17
'libarchive'
18
'coreutils'
19
'findutils')
20
provides=(
21
'libreoffice-extension-da_dk'
22
'openoffice-extension-da_dk'
23
'hunspell-da'
24
'hyphen-da'
25
'mythes-da')
26
conflicts=("${provides[@]}")
27
source=("https://stavekontrolden.dk/dictionaries/da_DK/da_DK-$pkgver.oxt")
28
b2sums=('8bbfb94b70fc8fe1c84de2e76ad5d19e6c0860212fe7e5780c0ba084c7e9a754269672ef491a5b3f4eb97d6b91b99d94cae61b1641c9603561b35f31232349b2')
29
30
package() {
31
# LibreOffice extension
32
_extension_dir="${pkgdir}"/usr/lib/libreoffice/share/extensions/da_DK
33
install -dm755 "${_extension_dir}"
34
bsdtar -xf da_DK-$pkgver.oxt -C "${_extension_dir}"/
35
36
# Symlink for OpenOffice
37
install -dm755 "${pkgdir}"/opt/openoffice4/share/extensions
38
ln -s /usr/lib/libreoffice/share/extensions/da_DK "${pkgdir}"/opt/openoffice4/share/extensions/da_DK
39
40
# set types and make directories
41
_types=('hunspell' 'hyphen' 'mythes')
42
for type in "${_types[@]}"; do
43
install -dm755 "${pkgdir}"/usr/share/"$type"
44
done
45
46
_link_dir=../../lib/libreoffice/share/extensions/da_DK
47
48
# hunspell
49
ln -s $_link_dir/da_DK.dic "${pkgdir}"/usr/share/hunspell/da_DK.dic
50
ln -s $_link_dir/da_DK.aff "${pkgdir}"/usr/share/hunspell/da_DK.aff
51
52
# hyphen
53
ln -s $_link_dir/hyph_da_DK.dic "${pkgdir}"/usr/share/hyphen/hyph_da_DK.dic
54
ln -s $_link_dir/hyph_da_DK.dic "${pkgdir}"/usr/share/hyphen/hyph_da.dic
55
56
# thesaurus (mythes)
57
ln -s $_link_dir/th_da_DK.dat "${pkgdir}"/usr/share/mythes/th_da_DK.dat
58
ln -s $_link_dir/th_da_DK.idx "${pkgdir}"/usr/share/mythes/th_da_DK.idx
59
60
# myspell/dicts symlinks
61
install -dm755 "${pkgdir}"/usr/share/myspell/dicts
62
pushd "$pkgdir"/usr/share/myspell/dicts > /dev/null
63
for type in "${_types[@]}"; do
64
for file in "${pkgdir}"/usr/share/"$type"/*; do
65
ln -Ls ../../"$type"/"$(basename "$file")" .
66
done
67
done
68
popd > /dev/null
69
70
install -dm755 "${pkgdir}"/usr/share/doc/$pkgname
71
ln -s ../$_link_dir/README_da_DK.txt "${pkgdir}"/usr/share/doc/$pkgname/README_da_DK.txt
72
ln -s ../$_link_dir/HYPH_da_DK_README.txt "${pkgdir}"/usr/share/doc/$pkgname/HYPH_da_DK_README.txt
73
install -dm755 "${pkgdir}"/usr/share/licenses/$pkgname
74
ln -s ../$_link_dir/README_da_DK.txt "${pkgdir}"/usr/share/licenses/$pkgname/README_da_DK.txt
75
ln -s ../$_link_dir/HYPH_da_DK_README.txt "${pkgdir}"/usr/share/licenses/$pkgname/HYPH_da_DK_README.txt
76
77
# Remove world writable bits
78
chmod --recursive go-w "${pkgdir}"
79
# Remove executable bits
80
find "${pkgdir}"/ -type f -exec chmod -x {} +
81
}
82
Changes since previous scan
--- PKGBUILD @ 2026-09-16 00:03+++ PKGBUILD @ 2026-09-17 00:27@@ -3,7 +3,7 @@ # Contributor: adament <adament@adament.net> # Contributor: Jamie Magee <jamie dot magee at gmail dot com> pkgname=stavekontrolden-pkgver=2.9.132+pkgver=2.9.133 pkgrel=1 pkgdesc='Danish dictionaries; for use with multiple programs' arch=('any')@@ -25,7 +25,7 @@ 'mythes-da') conflicts=("${provides[@]}") source=("https://stavekontrolden.dk/dictionaries/da_DK/da_DK-$pkgver.oxt")-b2sums=('fe6e4f343cf9931922a2b8ba6c16dcd8cd2fbe7dd2131edd7dcd340a2ce7e02836799df0df9f00f6128f76dc7aa2b766fdda757a2b87271f68c804c3fd36fd0c')+b2sums=('8bbfb94b70fc8fe1c84de2e76ad5d19e6c0860212fe7e5780c0ba084c7e9a754269672ef491a5b3f4eb97d6b91b99d94cae61b1641c9603561b35f31232349b2') package() { # LibreOffice extensionScan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 13:22:46 | Medium | 1 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 15:17:35 | Medium | 1 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 13:14:45 | Medium | 1 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 13:20:36 | Medium | 1 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 17:15:15 | Medium | 1 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 14:00:22 | Medium | 1 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |