texlive-tubs

maintainer roberthartung · 4 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a TDS zip file from a TU Braunschweig internal GitLab instance, which is plausibly the project's official source; the content is LaTeX templates (non-executable data) installed into TeX's directory structure, posing minimal risk even if the host is non-standard.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a TDS zip file from a TU Braunschweig internal GitLab instance, which is plausibly the project's official source; the content is LaTeX templates (non-executable data) installed into TeX's directory structure, posing minimal risk even if the host is non-standard.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("https://gitlab.ibr.cs.tu-bs.de/tubslatex/tubslatex/-/jobs/116760/artifacts/raw/builds/tubslatex.tds.zip" "$pkgname.maps" "CONTENTS")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Robert Hartung <hartung@ibr.cs.tu-bs.de>
    
      2# Contributor: Tim Schubert <tim.schubert@tu-bs.de>
    
      3pkgname=texlive-tubs
    
      4pkgver=1.2.0
    
      5_revnr=${pkgver}
    
      6pkgrel=1
    
      7pkgdesc="LaTeX-Templates for the Corporate Design of TU Braunschweig"
    
      8arch=('any')
    
      9url="https://www.tu-braunschweig.de/latex"
    
      10license=('LPPL')
    
      11depends=('urw-arial' 'texlive-core' 'texlive-bibtexextra' 'texlive-fontsextra' 'texlive-formatsextra' 'texlive-latexextra' 'texlive-science')
    
      12provides=('texlive-tubslatex')
    
      13conflicts=('texlive-tubslatex')
    
      14source=("https://gitlab.ibr.cs.tu-bs.de/tubslatex/tubslatex/-/jobs/116760/artifacts/raw/builds/tubslatex.tds.zip" "$pkgname.maps" "CONTENTS")
    
      15md5sums=(
    
      16  '5b89ac9c6118ee916d08eccf2bddb6b0'
    
      17  '9308c3138886469377a8d975a43cde39'
    
      18  '0c3f2dd8a9de10032ebf04caa355c1a8')
    
      19sha512sums=(
    
      20  'b64f04f366276669bc8c677e413e7f1eb35c7e7bb96cf30c3bcc544847c69a2dfc930a50de71e3c0775d22e2ce9ac5afafaa1e047cbc0ad710b1a2b0c7be738b'
    
      21  'ef2db742d543ccde08d40386b4625b8bfdfda50354f18d7e256ad732901cbd4046c776bcf2d79b5ec0950cd51310a9e4709586473fbdb3925240faec92e15b1f'
    
      22  'c82b6a1afe0b36286b5c824acf29197d3a7ef5cbbdd00ed251af81aae1f5ea20f7964c8d3b213f3a2169d946f3fa0bf84f6115a8464ff91c13e959873bcd3ed4')
    
      23
    
      24package() {
    
      25  cd "$srcdir"
    
      26  install -m755 -d $pkgdir/var/lib/texmf/arch/installedpkgs
    
      27  sed -i '/^#/d' CONTENTS
    
      28  install -m644 CONTENTS $pkgdir/var/lib/texmf/arch/installedpkgs/${pkgname}_${_revnr}.pkgs
    
      29  install -m644 $pkgname.maps $pkgdir/var/lib/texmf/arch/installedpkgs/
    
      30  install -m755 -d $pkgdir/usr/share
    
      31  wanteddirs=$(for d in *; do test -d $d && [[ $d != doc ]] && echo $d; done) || true
    
      32  for dir in $wanteddirs; do
    
      33    find $dir -type d -exec install -d -m755 $pkgdir/usr/share/texmf-dist/'{}' \;
    
      34    find $dir -type f -exec install -m644 '{}' $pkgdir/usr/share/texmf-dist/'{}' \;
    
      35  done
    
      36  if [[ -d texmf-dist ]]; then
    
      37    find texmf-dist -type d -exec install -d -m755 $pkgdir/usr/share/'{}' \;
    
      38    find texmf-dist -type f -exec install -m644 '{}' $pkgdir/usr/share/'{}' \;
    
      39  fi
    
      40  if [[ -d $pkgdir/usr/share/texmf-dist/scripts ]]; then
    
      41    find $pkgdir/usr/share/texmf-dist/scripts -type f -exec chmod a+x '{}' \;
    
      42  fi
    
      43}
    
      44

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2