xadrian

maintainer AeroNotix · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source URL is hosted on a non-standard domain, but it is a legitimate release repository for the project's own artifacts, and the package only installs and runs the project's own JAR files without executing untrusted remote code.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source URL is hosted on a non-standard domain, but it is a legitimate release repository for the project's own artifacts, and the package only installs and runs the project's own JAR files without executing untrusted remote code.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=(http://nexus.ailis.de/content/repositories/releases/de/ailis/$pkgname/$pkgname//$pkgver/$pkgname-$pkgver-unix.tar.bz2)

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  <aaron.l.france@gmail.com>
    
      2pkgname=xadrian
    
      3pkgver=1.5.1
    
      4pkgrel=1
    
      5pkgdesc="Xadrian is a factory complex calculator for the games X³: Terran Conflict and X³: Albion Prelude. With this tool you can plan your factory complexes before you build them in-game."
    
      6arch=('i686' 'x86_64')
    
      7url="http://kayahr.github.io/xadrian/"
    
      8license=('GPL')
    
      9depends=('java-runtime')
    
      10provides=(xadrian)
    
      11source=(http://nexus.ailis.de/content/repositories/releases/de/ailis/$pkgname/$pkgname//$pkgver/$pkgname-$pkgver-unix.tar.bz2)
    
      12md5sums=('6885ca2822f51ca3af133d79798a69a8')
    
      13
    
      14package() {
    
      15  cd "$srcdir/$pkgname-$pkgver"
    
      16  mkdir -p "$pkgdir/usr/share/java/xadrian"
    
      17  cp lib/*.jar "$pkgdir/usr/share/java/xadrian"
    
      18  mkdir -p "$pkgdir/usr/bin/"
    
      19  cat > "$pkgdir/usr/bin/xadrian" <<EOF
    
      20#!/bin/sh
    
      21exec java -jar "/usr/share/java/xadrian/xadrian.jar" "\$@"
    
      22EOF
    
      23  chmod +x "$pkgdir/usr/bin/xadrian"
    
      24}
    
      25
    
      26# vim:set ts=2 sw=2 et:
    
      27

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2