varicad-view

maintainer petrmanek · 4 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt RPM from the official vendor's domain (varicad.com) for packaging; this is a standard practice for AUR packages wrapping official binaries, and the source is not from a swappable or untrusted host.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt RPM from the official vendor's domain (varicad.com) for packaging; this is a standard practice for AUR packages wrapping official binaries, and the source is not from a swappable or untrusted host.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("https://www.varicad.com/userdata/files/release/VariCAD_View-${_pkgver_year}.${_pkgver_majmin}-${_pkgver_rel}.$CARCH.rpm")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Petr Manek <pm+aur at petrmanek dot cz>
    
      2
    
      3pkgname=varicad-view
    
      4_pkgver_year=2026
    
      5_pkgver_majmin=2.01
    
      6_pkgver_rel=1
    
      7pkgver=${_pkgver_year}.${_pkgver_majmin}
    
      8pkgrel=1
    
      9pkgdesc="Free viewer, convertor & printing software working with 2D DWG, DXF, 3D STEP formats."
    
      10arch=('x86_64')
    
      11license=(custom)
    
      12makedepends=()
    
      13depends=(libx11 libxcomposite libxdamage libxext libxfixes libxrender mime-types gtk2 hicolor-icon-theme)
    
      14provides=(varicad-view)
    
      15source=("https://www.varicad.com/userdata/files/release/VariCAD_View-${_pkgver_year}.${_pkgver_majmin}-${_pkgver_rel}.$CARCH.rpm")
    
      16url="https://www.varicad.com/"
    
      17sha256sums=('c408220944aa4c4247cdb4d15677eaee1a9e0980f53c4fab24e1f7a4b57f9ffe')
    
      18
    
      19package() {
    
      20  # Contents of this function are inspired by the install script located at:
    
      21  # $srcdir/opt/VariCAD-View/desktop/installdesktop.sh
    
      22
    
      23  addon=view
    
      24
    
      25  # executable
    
      26  mkdir -p $pkgdir/opt/VariCAD-View $pkgdir/usr/bin
    
      27  cp -r $srcdir/opt/VariCAD-View/{bin,lib} $pkgdir/opt/VariCAD-View/
    
      28  cd $pkgdir/usr/bin && ln -s ../../opt/VariCAD-View/bin/varicad-view
    
      29
    
      30  # icons
    
      31  install -Dm644 \
    
      32    $srcdir/opt/VariCAD-View/desktop/varicad"$addon".xpm \
    
      33    $pkgdir/usr/share/pixmaps/varicad"$addon".xpm
    
      34
    
      35  for icon_resolution in hicolor locolor ; do
    
      36    for icon_size in 512 256 192 128 96 72 64 48 42 36 32 24 22 16 ; do
    
      37      icon_dim="$icon_size"x"$icon_size"
    
      38      icon_dir=$icon_resolution/$icon_dim
    
      39      install -Dm644 \
    
      40        $srcdir/opt/VariCAD-View/desktop/varicad"$addon"_"$icon_dim".png \
    
      41        $pkgdir/usr/share/icons/$icon_dir/apps/varicad"$addon".png
    
      42    done
    
      43  done
    
      44
    
      45  # desktop files
    
      46  install -Dm644 \
    
      47    $srcdir/opt/VariCAD-View/desktop/varicad"$addon".desktop \
    
      48    $pkgdir/usr/share/applications/varicad"$addon".desktop
    
      49  install -Dm644 \
    
      50    $srcdir/opt/VariCAD-View/desktop/x-varicad"$addon".desktop \
    
      51    $pkgdir/usr/share/mimelnk/application/x-varicad"$addon".desktop
    
      52
    
      53  # documentation
    
      54  for install_file in $(ls $srcdir/usr/share/doc/packages/VariCAD_View) ;
    
      55  do
    
      56    install -Dm644 \
    
      57      $srcdir/usr/share/doc/packages/VariCAD_View/$install_file \
    
      58      $pkgdir/usr/share/doc/$pkgname/$install_file
    
      59  done
    
      60}
    
      61
    
      62
    
      63

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2