uppaal-beta

maintainer falkecarlsen · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source ZIP is downloaded from download.uppaal.org (the official UPPAAL distribution host) with a sha512sum checksum, which is the standard pattern for proprietary software distributed via AUR. The curl call to versioncheck.uppaal.org in the package() function is purely informational (it only prints a message comparing versions) and does not download, execute, or install anything — its output is never used in any code path that affects the installed files. The installed binary comes entirely from the verified ZIP. The host download.uppaal.org is the official vendor distribution server for UPPAAL (developed at Aalborg University/Uppsala University), not a personal or unofficial host. The sha512sum is present and non-trivially long. The only real concern is the curl call during package() which is non-reproducible and slightly sloppy, but poses no security risk since its result is discarded after a version comparison print. Overall this is a clean proprietary-software AUR package with minor style issues.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 80%): The source ZIP is downloaded from download.uppaal.org (the official UPPAAL distribution host) with a sha512sum checksum, which is the standard pattern for proprietary software distributed via AUR. The curl call to versioncheck.uppaal.org in the package() function is purely informational (it only prints a message comparing versions) and does not download, execute, or install anything — its output is never used in any code path that affects the installed files. The installed binary comes entirely from the verified ZIP. The host download.uppaal.org is the official vendor distribution server for UPPAAL (developed at Aalborg University/Uppsala University), not a personal or unofficial host. The sha512sum is present and non-trivially long. The only real concern is the curl call during package() which is non-reproducible and slightly sloppy, but poses no security risk since its result is discarded after a version comparison print. Overall this is a clean proprietary-software AUR package with minor style issues.

2 higher static findings superseded - not the current verdict (shown for transparency)

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:51 latest=$(curl -s https://versioncheck.uppaal.org/version-beta.txt | grep -o '"version": "[^"]*' | grep -o '[^"]*$')

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 source=("https://download.uppaal.org/uppaal-5.1/uppaal-${_pkgver_base}/uppaal-${_pkgver_dash}-linux64.zip")

PKGBUILD

2 offending line(s) highlighted

      1# Developer: Uppaal Team <uppaal@cs.aau.dk>
    
      2# Maintainer: Falke Carlsen "falkecarlsen" <falkeboc@cs.aau.dk>
    
      3
    
      4pkgname=uppaal-beta
    
      5pkgver=5.1.0_beta5
    
      6_pkgver_base=$(echo ${pkgver} | cut -d'_' -f1)
    
      7_pkgver_dash=$(echo ${pkgver} | sed 's/_/-/g')
    
      8pkgrel=2
    
      9pkgdesc="Verify timed automata models and learn strategies. Beta release channel."
    
      10arch=('any')
    
      11options=(debug !strip)
    
      12url="https://uppaal.org/"
    
      13license=('custom')
    
      14depends=('jre17-openjdk' 'xdg-utils')
    
      15makedepends=('unzip')
    
      16provides=("${pkgname}-${pkgver_dash}")
    
      17_relname="uppaal-${_pkgver_dash}-linux64"
    
      18_zipname="${_relname}.zip"
    
      19source=("https://download.uppaal.org/uppaal-5.1/uppaal-${_pkgver_base}/uppaal-${_pkgver_dash}-linux64.zip")
    
      20noextract=("${_zipname}")
    
      21sha512sums=('7699aedaf05829649cbf90ae690e71d4fc0b727a97babcaa2b1b3e29d641d62ae16b91fce33b82a46ee21a0514d824151b5c367b6c31151de27ad5d8e428ec03')
    
      22
    
      23build() {
    
      24  # determine x11 or wayland (upstreamed, remove once next beta is released)
    
      25  if [ "$XDG_SESSION_TYPE" = "wayland" ]; then
    
      26    # add env vars for wayland fixes
    
      27    prefix="env _JAVA_AWT_WM_NONREPARENTING=1 "
    
      28  else
    
      29    prefix=""
    
      30  fi
    
      31
    
      32  cat << EOD > "${pkgname}.desktop"
    
      33[Desktop Entry]
    
      34Encoding=UTF-8
    
      35Version=1.0
    
      36Type=Application
    
      37GenericName=Model Checker ${_pkgver_dash}
    
      38Name=UPPAAL ${_pkgver_dash}
    
      39Comment=Verify timed automata models and learn strategies. Beta release channel.
    
      40Exec=${prefix}/usr/bin/${pkgname} %u
    
      41Icon=${pkgname}-icon
    
      42Categories=Application;Science;Math;Education;Development;IDE
    
      43Terminal=false
    
      44StartupNotify=true
    
      45MimeType=application/uppaal-xml;application/uppaal-xta;application/vnd.uppaal-xml;application/vnd.uppaal-xta;application/x-uppaal-xml;application/x-uppaal-xta
    
      46EOD
    
      47}
    
      48
    
      49package() {
    
      50  # get newest available stable semver 
    
      51  latest=$(curl -s https://versioncheck.uppaal.org/version-beta.txt | grep -o '"version": "[^"]*' | grep -o '[^"]*$')
    
      52
    
      53  # check if latest is newer than $pkgver
    
      54  if [[ "$(echo -e "$latest\n$_pkgver_dash" | sort -V | tail -n 1)" == "$latest" ]]; then
    
      55    echo "Packaging newest beta release: uppaal-$latest"
    
      56  else
    
      57    echo "Newer beta release available but not yet packaged ($latest > $pkgver). Visit uppaal.org for manual installation instructions if urgent."
    
      58  fi
    
      59
    
      60  install -dm755 "${pkgdir}"/opt/
    
      61  install -dm755 "${pkgdir}"/usr/bin/
    
      62  install -dm755 "${pkgdir}"/usr/share/icons/hicolor/
    
      63
    
      64  pkgloc="${pkgdir}/opt/${pkgname}"
    
      65
    
      66  # unpack and move out of release top-level dir (_relname)
    
      67  unzip -qd "${pkgdir}/opt/" "${srcdir}/${_zipname}"
    
      68  mv "${pkgdir}/opt/${_relname}" "${pkgloc}"
    
      69 
    
      70  # install built desktop entry
    
      71  launcher_path="${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      72  install -Dm644 "${pkgname}.desktop" ${launcher_path}
    
      73  
    
      74  # install icons
    
      75  for s in 16 24 32 48 64 96 128 ; do
    
      76    install -dm755 "${pkgdir}/usr/share/icons/hicolor/"$s"x"$s""
    
      77    install -Dm644 "${pkgloc}/res/icon-"$s"x"$s".png" "${pkgdir}/usr/share/icons/hicolor/"$s"x"$s"/apps/${pkgname}-icon.png" 
    
      78  done
    
      79
    
      80  # install mime type definitions
    
      81  mimetype_dir="${pkgdir}"/usr/share/mime/packages
    
      82  install -dm755 $mimetype_dir
    
      83  for xml_mimetype_file in "${pkgloc}"/res/*-mimetype.xml; do
    
      84    if [ -f "$xml_mimetype_file" ]; then
    
      85       install -Dm644 "$xml_mimetype_file" "$mimetype_dir/$(basename "$xml_mimetype_file" | sed "s/uppaal/${pkgname}/")"
    
      86    fi
    
      87  done
    
      88
    
      89  # symlink startup script to bin 
    
      90  ln -s "/opt/${pkgname}/uppaal" "${pkgdir}/usr/bin/${pkgname}"
    
      91}
    
      92

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 00:17:08	LOW	3
2026-07-18 00:14:48	LOW	3
2026-07-17 00:06:16	LOW	3
2026-07-16 00:05:41	LOW	3
2026-07-15 00:09:25	LOW	3