ubl-tools-bin

MEDIUM

maintainer asger.weirsoe 0 votes scanned 2026-10-06 00:19:23.678998

View on AUR

Why flagged

Prebuilt binary downloaded from a personal server (asger.weirsoe.dk) unrelated to any major forge or official vendor infrastructure; while the maintainer claims it was built from their own Gitea repo, the binary is hosted on a personal domain that could be silently swapped, and there is no way to verify provenance beyond the sha256 checksum provided.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 source=("https://asger.weirsoe.dk/tarballz/ubl-tools-0.3.0-d608f44fa566-x86_64.tar.zst")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Prebuilt binary downloaded from a personal server (asger.weirsoe.dk) unrelated to any major forge or official vendor infrastructure; while the maintainer claims it was built from their own Gitea repo, the binary is hosted on a personal domain that could be silently swapped, and there is no way to verify provenance beyond the sha256 checksum provided.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Asger Geel Weirsoe <asger at weircon dot dk>
    
      2#
    
      3# ubl-tools-bin: the same release as ubl-tools, prebuilt.
    
      4#
    
      5# PROVENANCE OF THE BINARY
    
      6#
    
      7# Built by the ubl-tools release workflow from the tagged source, in an
    
      8# archlinux:base-devel container, with `cargo build --release --locked`.
    
      9#
    
      10#   build recipe:  https://gitea.weircon.dk/agw/ubl-tools
    
      11#   download:      https://asger.weirsoe.dk/tarballz/ubl-tools-0.3.0-d608f44fa566-x86_64.tar.zst
    
      12
    
      13pkgname=ubl-tools-bin
    
      14pkgver=0.3.0
    
      15pkgrel=2
    
      16pkgdesc="Read UBL e-invoices (Peppol BIS 3.0, OIOUBL) offline, in the terminal or as a printable page (prebuilt binary)"
    
      17arch=('x86_64')
    
      18url="https://asger.weirsøe.dk/en/projects/ubl-tools"
    
      19license=('MIT OR Apache-2.0')
    
      20depends=('glibc' 'gcc-libs')
    
      21provides=("ubl-tools=$pkgver")
    
      22conflicts=('ubl-tools')
    
      23options=('!strip' '!debug')
    
      24source=("https://asger.weirsoe.dk/tarballz/ubl-tools-0.3.0-d608f44fa566-x86_64.tar.zst")
    
      25sha256sums=('d608f44fa5667cb5243426c217ac74d50473621aaac92f24ee8d88b8529b3b1b')
    
      26
    
      27package() {
    
      28    # The tarball is a staged tree: usr/ at its root.
    
      29    cp -a "$srcdir/usr" "$pkgdir/"
    
      30}
    
      31

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-06 00:19:23	Medium	3
2026-10-06 00:13:36	Low	3
2026-10-05 23:40:58	Medium	2