wallxplanet

LOW

maintainer Chipsterjulien 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads static image files from non-whitelisted but reputable hosts (Wikimedia, NASA) for use as wallpaper data; these are non-executable assets with no code execution, resulting in low risk even if the sources are not on a standard whitelist.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads static image files from non-whitelisted but reputable hosts (Wikimedia, NASA) for use as wallpaper data; these are non-executable assets with no code execution, resulting in low risk even if the sources are not on a standard whitelist.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("$pkgname-$pkgver.tar.gz" "https://upload.wikimedia.org/wikipedia/commons/c/cd/Land_ocean_ice_2048.jpg" "http://eoimages.gsfc.nasa.gov/images/imagerecords/55000/55167/earth_lights_lrg.jpg" "https://upload.wikimedia.org/wikipedia/commons/a/ac/Earthmap1000x500.jpg")
PKGBUILD:12 source=("$pkgname-$pkgver.tar.gz" "https://upload.wikimedia.org/wikipedia/commons/c/cd/Land_ocean_ice_2048.jpg" "http://eoimages.gsfc.nasa.gov/images/imagerecords/55000/55167/earth_lights_lrg.jpg" "https://upload.wikimedia.org/wikipedia/commons/a/ac/Earthmap1000x500.jpg")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Chipster Julien <julien dot chipster @ archlinux dot fr>
    
      2
    
      3pkgname=wallxplanet
    
      4pkgver=0.0.1
    
      5pkgrel=3
    
      6pkgdesc="Generate earth wall with cloud"
    
      7arch=('any')
    
      8url="www.google.fr"
    
      9license=('WTFPL')
    
      10depends=('xplanet' 'curl')
    
      11backup=('etc/wallxplanet/xplanet.conf')
    
      12source=("$pkgname-$pkgver.tar.gz" "https://upload.wikimedia.org/wikipedia/commons/c/cd/Land_ocean_ice_2048.jpg" "http://eoimages.gsfc.nasa.gov/images/imagerecords/55000/55167/earth_lights_lrg.jpg" "https://upload.wikimedia.org/wikipedia/commons/a/ac/Earthmap1000x500.jpg")
    
      13install=wallxplanet.install
    
      14
    
      15_builddir="$pkgname-$pkgver"
    
      16
    
      17package() {
    
      18    cd "$_builddir"
    
      19
    
      20    # wallxplanet.conf
    
      21    install -Dm644 cfg/"$pkgname"_sample.conf \
    
      22        "$pkgdir"/etc/$pkgname/"$pkgname"_sample.conf || return 1
    
      23
    
      24    # wallxplanet.service
    
      25    install -Dm644 systemd/"$pkgname".service \
    
      26        "$pkgdir"/usr/lib/systemd/system/"$pkgname".service || return 1
    
      27
    
      28    # downloadcloudsmap.service
    
      29    install -Dm644 systemd/downloadcloudsmap.service \
    
      30        "$pkgdir"/usr/lib/systemd/system/downloadcloudsmap.service || return 1
    
      31
    
      32    # downloadcloudsmap.timer
    
      33    install -Dm644 systemd/downloadcloudsmap.timer \
    
      34        "$pkgdir"/usr/lib/systemd/system/downloadcloudsmap.timer || return 1
    
      35
    
      36    # pictures
    
      37    mkdir "$pkgdir"/etc/$pkgname/img
    
      38    install -Dm644 "$srcdir"/*.jpg \
    
      39        "$pkgdir"/etc/$pkgname/img/ || return 1
    
      40
    
      41    # downloadcloudsmap.sh
    
      42    install -m755 -o root -g root -D "$srcdir"/$pkgname-$pkgver/downloadcloudsmap.sh \
    
      43        "$pkgdir"/usr/bin/downloadcloudsmap.sh || return 1
    
      44
    
      45    # wallxplanet.sh
    
      46    install -m755 -o root -g root -D "$srcdir"/$pkgname-$pkgver/wallxplanet.sh \
    
      47        "$pkgdir"/usr/bin/wallxplanet.sh || return 1
    
      48}
    
      49
    
      50sha512sums=('d97f327604c2185ed0fdff430dd4f0091e56032326d0a47095c328738bd2d86d68ac858328fd9dcbcd2a22c362eca0e5c0f1a32d5f1201b1cd6e7d815f6d2d90'
    
      51            'f83c0157272ee41389d7af50f1988c3470977d5dc80c4bc8b982b8cafa273775996e9e06893da970c04e7ab87ba8463f35405319dbe4ae73b0e3d68a146472d3'
    
      52            '4b3574dce95148a2f6bc9f627524ea7f9b6806552016dd696e9cbf3edf56b8d8fa99f48f95616e276d67801ade65e32fe971a7dbd1bb5afadf7b49540fbd340c'
    
      53            '900a7c3c8822a2be6f46e672ad5b4bfde47863e4d9af401805df9011a7010b279e1ac3c8afe08d88f88cb7db0b662321f74a06219790868f85109c41c2ffc99e')

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2