uppaal
LOW
maintainer falkecarlsen
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a source archive from the project's official domain and verifies it with a checksum; the only concerns are a non-whitelisted host and a runtime version check via curl, which does not execute remote code or introduce unverifiable binaries.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a source archive from the project's official domain and verifies it with a checksum; the only concerns are a non-whitelisted host and a runtime version check via curl, which does not execute remote code or introduce unverifiable binaries.
2 higher static findings superseded - not the current verdict (shown for transparency)
Medium
External download from an untrusted host, not in source=()
external_download_not_in_source
curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.
-
PKGBUILD:49
latest=$(curl -s https://versioncheck.uppaal.org/version.txt | grep -o '"version": "[^"]*' | grep -o '[^"]*$')
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:17
source=("https://download.uppaal.org/uppaal-5.0/uppaal-${pkgver}/uppaal-${pkgver}-linux64.zip")
PKGBUILD
2 offending line(s) highlighted
1
# Developer: Uppaal Team <uppaal@cs.aau.dk>
2
# Maintainer: Falke Carlsen "falkecarlsen" <falkeboc@cs.aau.dk>
3
4
pkgname=uppaal
5
pkgver=5.0.0
6
pkgrel=3
7
pkgdesc="Verify timed automata models and learn strategies."
8
arch=('any')
9
options=(debug !strip)
10
url="https://uppaal.org/"
11
license=('custom')
12
depends=('jre17-openjdk' 'xdg-utils')
13
makedepends=('unzip')
14
provides=("${pkgname}-${pkgver}")
15
_relname="${pkgname}-${pkgver}-linux64"
16
_zipname="${_relname}.zip"
17
source=("https://download.uppaal.org/uppaal-5.0/uppaal-${pkgver}/uppaal-${pkgver}-linux64.zip")
18
noextract=("${_zipname}")
19
sha512sums=('e7fceddd699ebbe1a0120209bbe59fe7ef61b0c3b671bc453028e46e68310c3e96e3c5be7d9aec8cd5c85d065b3a4c7d6f9c68e7e5578d410efec7a6d9407543')
20
21
build() {
22
# determine x11 or wayland (upstreamed, remove once 5.1.0 is released)
23
if [ "$XDG_SESSION_TYPE" = "wayland" ]; then
24
# add env vars for wayland fixes
25
prefix="env _JAVA_AWT_WM_NONREPARENTING=1 "
26
else
27
prefix=""
28
fi
29
30
cat << EOD > "${pkgname}.desktop"
31
[Desktop Entry]
32
Encoding=UTF-8
33
Version=1.0
34
Type=Application
35
GenericName=Model Checker ${pkgver}
36
Name=UPPAAL ${pkgver}
37
Comment=Verify timed automata models and learn strategies
38
Exec=${prefix}/usr/bin/${pkgname} %u
39
Icon=uppaal-icon
40
Categories=Application;Science;Math;Education;Development;IDE
41
Terminal=false
42
StartupNotify=true
43
MimeType=application/uppaal-xml;application/uppaal-xta;application/vnd.uppaal-xml;application/vnd.uppaal-xta;application/x-uppaal-xml;application/x-uppaal-xta
44
EOD
45
}
46
47
package() {
48
# get newest available stable semver
49
latest=$(curl -s https://versioncheck.uppaal.org/version.txt | grep -o '"version": "[^"]*' | grep -o '[^"]*$')
50
51
# check if latest is newer than $pkgver
52
if [[ "$(echo -e "$latest\n$pkgver" | sort -V | tail -n 1)" == "$latest" ]]; then
53
echo "Packaging newest stable release: uppaal-$latest"
54
else
55
echo "Newer release available but not yet packaged ($latest > $pkgver). Visit uppaal.org for manual installation instructions if urgent."
56
fi
57
58
install -dm755 "${pkgdir}"/opt/
59
install -dm755 "${pkgdir}"/usr/bin/
60
install -dm755 "${pkgdir}"/usr/share/icons/hicolor/
61
62
pkgloc="${pkgdir}/opt/${pkgname}"
63
64
# unpack and move out of release top-level dir (_relname)
65
unzip -qd "${pkgdir}/opt/" "${srcdir}/${_zipname}"
66
mv "${pkgdir}/opt/${_relname}" "${pkgloc}"
67
68
# install built desktop entry
69
launcher_path="${pkgdir}/usr/share/applications/${pkgname}.desktop"
70
install -Dm644 "${pkgname}.desktop" ${launcher_path}
71
72
# install icons
73
for s in 16 24 32 48 64 96 128 ; do
74
install -dm755 "${pkgdir}/usr/share/icons/hicolor/"$s"x"$s""
75
install -Dm644 "${pkgloc}/res/icon-"$s"x"$s".png" "${pkgdir}/usr/share/icons/hicolor/"$s"x"$s"/apps/uppaal-icon.png"
76
done
77
78
# install mime type definitions
79
mimetype_dir="${pkgdir}"/usr/share/mime/packages
80
install -dm755 $mimetype_dir
81
for xml_mimetype_file in "${pkgloc}"/res/*-mimetype.xml; do
82
if [ -f "$xml_mimetype_file" ]; then
83
install -Dm644 "$xml_mimetype_file" "$mimetype_dir/$(basename "$xml_mimetype_file")"
84
fi
85
done
86
87
# symlink startup script to bin
88
ln -s "/opt/${pkgname}/${pkgname}" "${pkgdir}/usr/bin/${pkgname}"
89
}
90
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 3 |
| 2026-09-16 00:03:17 | Low | 3 |
| 2026-09-15 00:25:31 | Low | 3 |
| 2026-09-14 00:27:57 | Low | 3 |
| 2026-09-13 00:19:54 | Low | 3 |
| 2026-09-12 00:25:17 | Low | 3 |
| 2026-09-11 00:19:22 | Low | 3 |
| 2026-09-10 00:22:44 | Low | 3 |
| 2026-09-09 00:04:09 | Low | 3 |
| 2026-09-08 00:18:08 | Low | 3 |
| 2026-09-07 00:30:15 | Low | 3 |
| 2026-09-06 00:17:06 | Low | 3 |
| 2026-09-05 00:16:27 | Low | 3 |
| 2026-09-04 00:03:13 | Low | 3 |
| 2026-09-03 00:15:47 | Low | 3 |
| 2026-09-02 00:02:31 | Low | 3 |
| 2026-09-01 00:11:19 | Low | 3 |
| 2026-08-31 00:19:57 | Low | 3 |
| 2026-08-30 00:04:14 | Low | 3 |
| 2026-08-29 00:29:17 | Low | 3 |