updfparser-git

MEDIUM

maintainer Ketchup901 2 votes scanned 2026-10-26 15:45:54.756943

View on AUR

Why flagged

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

Triggered rules

Medium External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:25 export GIT_CONFIG_VALUE_0="Cookie: $(/usr/bin/curl -s https://forge.soutade.fr/402.html | /usr/bin/sed -nE 's/.*document\.cookie = "([^;"]*).*/\1/p')"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Ketchup901 <ketchup901@riseup.net>
    
      2
    
      3pkgname=updfparser-git
    
      4pkgver=r33.6060d12344
    
      5pkgrel=3
    
      6pkgdesc="Very simple PDF parser"
    
      7arch=('any')
    
      8url="https://forge.soutade.fr/soutade/uPDFParser"
    
      9license=('LGPL-3.0-or-later')
    
      10provides=('updfparser')
    
      11conflicts=('updfparser')
    
      12makedepends=(
    
      13    'curl'
    
      14    'git'
    
      15)
    
      16depends=(
    
      17    'libgcc'
    
      18    'glibc'
    
      19    'libstdc++'    
    
      20)
    
      21source=("git+${url}.git")
    
      22# Variables required for humanity check
    
      23export GIT_CONFIG_COUNT=1
    
      24export GIT_CONFIG_KEY_0="http.extraHeader"
    
      25export GIT_CONFIG_VALUE_0="Cookie: $(/usr/bin/curl -s https://forge.soutade.fr/402.html | /usr/bin/sed -nE 's/.*document\.cookie = "([^;"]*).*/\1/p')"
    
      26sha256sums=('SKIP')
    
      27
    
      28_srcdir="uPDFParser"
    
      29
    
      30pkgver() {
    
      31    cd $_srcdir
    
      32    printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=10 HEAD)"
    
      33}
    
      34
    
      35build() {
    
      36    cd $_srcdir
    
      37    export CXXFLAGS+=" -std=c++17"
    
      38    make BUILD_STATIC=0 BUILD_SHARED=1
    
      39}
    
      40
    
      41package() {
    
      42    install -Dm644 $_srcdir/include/*.h -t "$pkgdir/usr/include/"
    
      43    install -Dm644 $_srcdir/libupdfparser.so -t "$pkgdir/usr/lib/"
    
      44}
    
      45
    
      46

Changes since previous scan

--- PKGBUILD @ 2026-09-19 21:31
+++ PKGBUILD @ 2026-10-26 15:45
@@ -2,7 +2,7 @@
 
 pkgname=updfparser-git
 pkgver=r33.6060d12344
-pkgrel=2
+pkgrel=3
 pkgdesc="Very simple PDF parser"
 arch=('any')
 url="https://forge.soutade.fr/soutade/uPDFParser"
@@ -10,6 +10,7 @@
 provides=('updfparser')
 conflicts=('updfparser')
 makedepends=(
+    'curl'
     'git'
 )
 depends=(
@@ -18,6 +19,10 @@
     'libstdc++'    
 )
 source=("git+${url}.git")
+# Variables required for humanity check
+export GIT_CONFIG_COUNT=1
+export GIT_CONFIG_KEY_0="http.extraHeader"
+export GIT_CONFIG_VALUE_0="Cookie: $(/usr/bin/curl -s https://forge.soutade.fr/402.html | /usr/bin/sed -nE 's/.*document\.cookie = "([^;"]*).*/\1/p')"
 sha256sums=('SKIP')
 
 _srcdir="uPDFParser"

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-26 15:45:54	Medium	1
2026-09-19 21:31:46	Clean	0
2026-09-19 00:25:36	Medium	3
2026-09-18 00:17:11	Medium	3
2026-09-17 00:27:14	Medium	3
2026-09-16 00:03:17	Medium	3
2026-09-15 13:19:52	Medium	3
2026-09-06 00:17:06	Clean	2
2026-09-05 18:00:42	Low	1