syncany

LOW

maintainer aureianimus 17 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The source is a tarball from the project's official domain (syncany.org), used to build and install the application; despite the host not being whitelisted, it is plausibly the project's own, and the package installs only static Java binaries and scripts without executing remote code.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from the project's official domain (syncany.org), used to build and install the application; despite the host not being whitelisted, it is plausibly the project's own, and the package installs only static Java binaries and scripts without executing remote code.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("http://syncany.org/dist/$pkgname-${_realver}.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Pim Otte <otte dot pim at gmail dot com>
    
      2pkgname=syncany
    
      3pkgver=0.4.9_alpha
    
      4_realver=0.4.9-alpha
    
      5pkgrel=1
    
      6pkgdesc="Cloud storage and filesharing application with a focus on security and abstraction of storage."
    
      7arch=(any)
    
      8url="http://www.syncany.org/"
    
      9license=('GPL3')
    
      10depends=('java-environment>=8' 'sh')
    
      11optdepends=('bash-completion: auto completion in bash')
    
      12source=("http://syncany.org/dist/$pkgname-${_realver}.tar.gz"
    
      13        )
    
      14sha256sums=('4632ecc7df58e7bae5f9ac16a49c069ee63fd43418f37c463388650a71cb04c2')
    
      15
    
      16package() {
    
      17    install -Dm644 "$srcdir/$pkgname-${_realver}/bash/syncany.bash-completion" "${pkgdir}/etc/bash_completion.d/syncany"
    
      18
    
      19	cd "$srcdir/$pkgname-${_realver}/man/man"
    
      20    for man in *
    
      21    do
    
      22        install -Dm644 "$man" "${pkgdir}/usr/share/man/man1/$man"
    
      23        install -Dm644 "$man" "${pkgdir}/usr/share/man/man1/${man/sy/syncany}"
    
      24    done
    
      25
    
      26
    
      27    install -Dm755 "$srcdir/$pkgname-${_realver}/bin/syncany" "${pkgdir}/usr/share/java/${pkgname}/bin/syncany"
    
      28    cd "$srcdir/$pkgname-${_realver}/lib"
    
      29
    
      30    for jar in *
    
      31    do
    
      32        install -Dm644 "$jar" "${pkgdir}/usr/share/java/${pkgname}/lib/$jar"
    
      33    done
    
      34
    
      35    mkdir -p "${pkgdir}/usr/bin"
    
      36    ln -s "/usr/share/java/${pkgname}/bin/syncany" "${pkgdir}/usr/bin/syncany"
    
      37
    
      38
    
      39    #Optional: symlink sy
    
      40    #ln -s  "/usr/share/java/${pkgname}/bin/syncany" "${pkgdir}/usr/bin/sy"
    
      41}
    
      42

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2