tpsrelw

maintainer malacology · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a Windows installer (tpsRelww64.exe) from sbmorphometrics.org, which is the official website of the TPS morphometrics software suite by F. James Rohlf at Stony Brook University — a well-known academic software collection in the field of geometric morphometrics. The binary is extracted with innoextract (not executed natively) and then run under Wine. The host is the legitimate upstream vendor, not a personal or unofficial mirror. There is no native code execution on the Linux system; the .exe is only extracted and later run via Wine by the user. The md5sum provides a basic integrity check. The main concern is that md5 is weak and there is no GPG signature, but this is common for AUR packages wrapping proprietary academic software. This does not rise to medium severity — it is a legitimate upstream binary from the official vendor site, packaged for Wine use.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 82%): The package downloads a Windows installer (tpsRelww64.exe) from sbmorphometrics.org, which is the official website of the TPS morphometrics software suite by F. James Rohlf at Stony Brook University — a well-known academic software collection in the field of geometric morphometrics. The binary is extracted with innoextract (not executed natively) and then run under Wine. The host is the legitimate upstream vendor, not a personal or unofficial mirror. There is no native code execution on the Linux system; the .exe is only extracted and later run via Wine by the user. The md5sum provides a basic integrity check. The main concern is that md5 is weak and there is no GPG signature, but this is common for AUR packages wrapping proprietary academic software. This does not rise to medium severity — it is a legitimate upstream binary from the official vendor site, packaged for Wine use.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source=("https://sbmorphometrics.org/morphmet/tpsRelww64.exe" "tpsRelw.desktop" "tpsRelw.png")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: malacology
    
      2# Contributor: malacology
    
      3
    
      4pkgname=tpsrelw
    
      5pkgver=1.74
    
      6pkgrel=1
    
      7pkgdesc="Relative warps analysis"
    
      8arch=('any')
    
      9url="http://sbmorphometrics.org/soft-tps.html"
    
      10license=('custom')
    
      11makedepends=('innoextract')
    
      12depends=(
    
      13	'wine'
    
      14	'wine_gecko'
    
      15	'wine-mono'
    
      16)
    
      17source=("https://sbmorphometrics.org/morphmet/tpsRelww64.exe" "tpsRelw.desktop" "tpsRelw.png")
    
      18md5sums=('b7c58e513c8e8409ccf59c82eaa40c2d'
    
      19         'd4f32527ad3479eabeb158c915fdb706'
    
      20         '48aa2b40a7d3e8490f0e89b2fb2a31d1')
    
      21build(){
    
      22  innoextract tpsRelww64.exe
    
      23}
    
      24package() {
    
      25  install -dm755 "$pkgdir"/usr/share/{tpsrelw,applications}
    
      26  mv "$srcdir"/app/* "$pkgdir"/usr/share/tpsrelw
    
      27  install -Dm755 ${srcdir}/tpsRelw.png ${pkgdir}/usr/share/tpsrelw/tpsRelw.png
    
      28  install -Dm755 ${srcdir}/tpsRelw.desktop ${pkgdir}/usr/share/applications/tpsRelw.desktop
    
      29}
    
      30

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2