wpunix
maintainer envolution
· 2 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The package downloads historical, prebuilt binaries (ISO, RPMs) from archive.org and legacy.redhat.com for building WordPerfect 8; these are unverifiable but used as data sources for a legacy application build, not executed directly or used in a malicious context.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads historical, prebuilt binaries (ISO, RPMs) from archive.org and legacy.redhat.com for building WordPerfect 8; these are unverifiable but used as data sources for a legacy application build, not executed directly or used in a malicious context.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:15
"https://archive.org/download/corel-wpunix-8/COREL_WPUNIX_1.iso" -
PKGBUILD:16
"https://legacy.redhat.com/pub/redhat/linux/5.2/en/os/i386/RedHat/RPMS/libc-5.3.12-27.i386.rpm"
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: envolution
2
# Contributor: Audun-Marius Gangstø <audun@gangsto.org>
3
pkgname=wpunix
4
pkgver=3.0
5
pkgrel=2
6
pkgdesc="WordPerfect 8 for UNIX - Empower Your Application Server"
7
arch=("i386" "i686" "x86_64")
8
url="https://github.com/taviso/wpunix"
9
license=('unknown')
10
depends=("lib32-ncurses")
11
makedepends=('git' 'cpio' 'gcc' 'binutils' 'xz' 'patchelf' 'rpmextract' 'wget')
12
provides=('wp')
13
options=('!strip')
14
source=("${pkgname}::git+https://github.com/taviso/wpunix.git"
15
"https://archive.org/download/corel-wpunix-8/COREL_WPUNIX_1.iso"
16
"https://legacy.redhat.com/pub/redhat/linux/5.2/en/os/i386/RedHat/RPMS/libc-5.3.12-27.i386.rpm"
17
"https://legacy.redhat.com/pub/redhat/linux/5.2/en/os/i386/RedHat/RPMS/glibc-2.0.7-29.i386.rpm"
18
"arch-rpmextract.patch"
19
)
20
noextract=(
21
'COREL_WPUNIX_1.iso'
22
)
23
md5sums=('SKIP'
24
'036d10f279aecc61704b214e7bd58a6d'
25
'914d5d1a67a5a38971a0ff39fbbf6a42'
26
'fc800085ce2c253660886a10efc1aed1'
27
'c06660a90d039890407036de3fd50ece')
28
validpgpkeys=()
29
30
prepare() {
31
32
cp COREL_WPUNIX_1.iso "$pkgname"/
33
34
cp glibc-2.0.7-29.i386.rpm libc-5.3.12-27.i386.rpm "$pkgname"/
35
git -C "$pkgname" apply -v "$srcdir"/*patch
36
}
37
38
build() {
39
cd "$pkgname"
40
make clean
41
make intercept/libdisasm.a # Oddly, build fails if this is not built first
42
make wordperfect8_i386
43
}
44
45
46
package() {
47
cd "$pkgname"
48
install -d -m755 "${pkgdir}/usr/bin"
49
install -d -m755 "${pkgdir}/opt"
50
install -m755 "${srcdir}"/"${pkgname}/wordperfect8_i386/usr/bin/wp" "${pkgdir}/usr/bin/wp"
51
mv "${srcdir}"/"${pkgname}/wordperfect8_i386/opt/wp80" "${pkgdir}/opt/"
52
}
53
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |
| 2026-07-17 00:06:16 | LOW | 2 |
| 2026-07-16 00:05:41 | LOW | 2 |
| 2026-07-15 00:09:25 | LOW | 2 |