ucsc-twobit-bin

maintainer imjiaoyuan · 0 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged Downloads prebuilt binaries from UCSC's official genome browser download server (hgdownload.soe.ucsc.edu), which is the project's own infrastructure, with pinned sha256 checksums; the main concern is that these are unversioned upstream binaries that could change silently, but the checksums mitigate swap risk and the source is the official UCSC domain.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 75%): Downloads prebuilt binaries from UCSC's official genome browser download server (hgdownload.soe.ucsc.edu), which is the project's own infrastructure, with pinned sha256 checksums; the main concern is that these are unversioned upstream binaries that could change silently, but the checksums mitigate swap risk and the source is the official UCSC domain.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("https://hgdownload.soe.ucsc.edu/admin/exe/linux.x86_64/faToTwoBit"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: imjiaoyuan <imjiaoyuan@gmail.com>
    
      2
    
      3# Prebuilt UCSC Genome Browser binaries. Upstream files are unversioned, so
    
      4# pkgver is the newest HTTP Last-Modified date (YYYYMMDD) across the group.
    
      5
    
      6pkgname=ucsc-twobit-bin
    
      7pkgver=20260407
    
      8pkgrel=1
    
      9pkgdesc="UCSC twoBit genome format utilities: faToTwoBit, twoBitToFa, twoBitInfo"
    
      10arch=('x86_64')
    
      11url="https://hgdownload.soe.ucsc.edu/admin/exe/linux.x86_64/"
    
      12license=('MIT')
    
      13depends=('glibc')
    
      14options=('!strip' '!debug')
    
      15source=("https://hgdownload.soe.ucsc.edu/admin/exe/linux.x86_64/faToTwoBit"
    
      16        "https://hgdownload.soe.ucsc.edu/admin/exe/linux.x86_64/twoBitToFa"
    
      17        "https://hgdownload.soe.ucsc.edu/admin/exe/linux.x86_64/twoBitInfo"
    
      18        "LICENSE::https://raw.githubusercontent.com/ucscGenomeBrowser/kent/master/LICENSE")
    
      19sha256sums=('78b3db746e0ca2fcf3c10fc0c0c231eaeac848b5fe40285a66ff664ae4596e08'
    
      20            'a591aa8920b316a810b991fc1e23736b20e73f98b3c3ad16dba3418c27524b26'
    
      21            'fca5427e1aedd00be0d32117420010c9162d442562c83305b2d3e3c8e6cebe71'
    
      22            '793d774ec3941d88d5f93611639230030ea3e167282be144b6e5604bc5ad29a4')
    
      23
    
      24package() {
    
      25    install -Dm755 "$srcdir/faToTwoBit" "$pkgdir/usr/bin/faToTwoBit"
    
      26    install -Dm755 "$srcdir/twoBitToFa" "$pkgdir/usr/bin/twoBitToFa"
    
      27    install -Dm755 "$srcdir/twoBitInfo" "$pkgdir/usr/bin/twoBitInfo"
    
      28    install -Dm644 "$srcdir/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      29}
    
      30

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	3
2026-08-17 00:18:29	LOW	3
2026-08-16 17:37:55	LOW	3
2026-08-16 17:33:23	MEDIUM	2