szs-bin

MEDIUM

maintainer Seeky 0 votes scanned 2026-10-24 13:42:06.374786

View on AUR

Why flagged

Installs prebuilt binaries directly from szs.wiimm.de (the project's own official domain) with a pinned sha256 checksum; while it is a prebuilt executable bundle rather than source-built, it comes from the project's own infrastructure with a verified checksum, making the risk low-to-medium rather than high.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 source=("https://szs.wiimm.de/download/$_archive.tar.gz")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Installs prebuilt binaries directly from szs.wiimm.de (the project's own official domain) with a pinned sha256 checksum; while it is a prebuilt executable bundle rather than source-built, it comes from the project's own infrastructure with a verified checksum, making the risk low-to-medium rather than high.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: SeekyCt <seeky dot mkw at gmail dot com>
    
      2
    
      3pkgname=szs-bin
    
      4pkgver=2.42a
    
      5pkgrel=1
    
      6epoch=
    
      7pkgdesc='Wiimms SZS Tools (wszst)'
    
      8arch=(x86_64)
    
      9url=https://szs.wiimm.de
    
      10license=('GPL-2.0-or-later')
    
      11groups=()
    
      12depends=()
    
      13makedepends=()
    
      14checkdepends=()
    
      15optdepends=()
    
      16provides=(wbmgt wctct wimgt wkclt wkmpt wlect wmdlt wpatt wstrt wszst)
    
      17conflicts=()
    
      18replaces=()
    
      19backup=()
    
      20options=()
    
      21install=
    
      22changelog=
    
      23_archive=szs-v$pkgver-r8989-$arch
    
      24source=("https://szs.wiimm.de/download/$_archive.tar.gz")
    
      25noextract=()
    
      26sha256sums=('45c07b8e78fdc38868ac42dd50c1a2e14fc0f14695421b1b5c43134e17393ccc')
    
      27validpgpkeys=()
    
      28
    
      29package() {
    
      30	cd "$_archive"
    
      31
    
      32	install -Dm755 -t $pkgdir/usr/bin bin/*
    
      33
    
      34  # The original install.sh supports this, but the tarball ships with no share folder
    
      35	# install -Dm644 -t $pkgdir/usr/share/szs share/*
    
      36
    
      37	install -Dm644 -t $pkgdir/usr/share/doc/szs doc/*
    
      38
    
      39  # TODO: 'scripts' and 'support' seem like they should go somewhere?
    
      40  #        But the original install.sh doesn't do anything with them...
    
      41}
    
      42

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-24 13:42:06	Medium	3
2026-10-24 13:40:12	Medium	2