velocity

LOW

maintainer orphaned 0 votes scanned 2026-10-26 13:48:15.774085

View on AUR

Why flagged

Downloads prebuilt JARs from an Apache mirror (23media.de is a known Apache mirror) with SHA256 checksums provided; the JARs are installed as data/library files under /usr/share/java and never executed at build/install time, making the risk minimal even though the host is not the canonical apache.org domain.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Downloads prebuilt JARs from an Apache mirror (23media.de is a known Apache mirror) with SHA256 checksums provided; the JARs are installed as data/library files under /usr/share/java and never executed at build/install time, making the risk minimal even though the host is not the canonical apache.org domain.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 source=("http://mirror.23media.de/apache/$pkgname/engine/$pkgver/$pkgname-engine-core-$pkgver.jar"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Xiao-Long Chen <chenxiaolong@cxl.epac.to>
    
      2
    
      3# Based on Fedora 18's packaging
    
      4
    
      5pkgname=velocity
    
      6pkgver=2.1
    
      7pkgrel=2
    
      8pkgdesc="Free open-source templating engine"
    
      9arch=(any)
    
      10url="http://velocity.apache.org/"
    
      11license=(Apache)
    
      12depends=('jakarta-oro'
    
      13         'java-bcel'
    
      14         'java-commons-collections'
    
      15         'java-commons-logging'
    
      16         'java-commons-lang'
    
      17         'java-jdom'
    
      18         'junit'
    
      19         'log4j')
    
      20makedepends=('antlr2'
    
      21	    'apache-ant')
    
      22source=("http://mirror.23media.de/apache/$pkgname/engine/$pkgver/$pkgname-engine-core-$pkgver.jar"
    
      23	"http://mirror.23media.de/apache/$pkgname/engine/$pkgver/$pkgname-engine-scripting-$pkgver.jar"
    
      24	"http://mirror.23media.de/apache/$pkgname/engine/$pkgver/$pkgname-engine-examples-$pkgver.jar")
    
      25sha256sums=('a921aa299420462f7c39ebe05cdf22ae5b188b67518a2aae06844732fdcc9d7a'
    
      26            '18a66042f885c3ca9174b0d6f60e3c7c25b05e5e90b78576b63f0381b8dbdc11'
    
      27            'd48d880e456bdd5d6952ef2db8a80164a1d7ab6a03a66c4b1b3a5102ad91ebb5')
    
      28
    
      29package() {
    
      30  install -dm755 "${pkgdir}/usr/share/java/"
    
      31  for i in  engine-core engine-scripting engine-examples
    
      32  do
    
      33    install -m644 ${pkgname}-$i-${pkgver}.jar -t "${pkgdir}/usr/share/java/"
    
      34  done
    
      35}
    
      36

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-26 13:48:15	Low	3
2026-10-26 13:45:05	Medium	2