xmind8

maintainer orphaned · 3 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The download is from the official xmind.net domain, which is the project's legitimate source, and the package installs only static application files without executing remote code.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The download is from the official xmind.net domain, which is the project's legitimate source, and the package installs only static application files without executing remote code.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:29 "https://www.xmind.net/xmind/downloads/xmind-${pkgver/./-}-linux.zip"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer : Ivo(sh) Musil <ivoshm@gmail.com>
    
      2# Contributor: archplayer
    
      3# Contributor: RemiliaForever <remilia AT koumakan DOT cc>
    
      4# Contributor: Felix Yan <felixonmars@gmail.com>
    
      5# Contributor: Christoph Drexler <chrdr at gmx dot at>
    
      6# Contributor: Jelle van der Waa <jellevdwaa@gmail.com>
    
      7# Contributor: KokaKiwi <kokakiwi+aur [at] kokakiwi [dot] net>
    
      8
    
      9GTK_VERSION=3
    
      10JAVA_PATH='/usr/lib/jvm/java-8-openjdk/bin/java'
    
      11
    
      12pkgname=xmind8
    
      13pkgver=8.update9
    
      14pkgrel=2
    
      15pkgdesc="Brainstorming and Mind Mapping Software (legacy version based on Eclipse)"
    
      16arch=('x86_64')
    
      17url="https://www.xmind.net/xmind8-pro/"
    
      18license=('EPL' 'LGPL')
    
      19depends=('java-runtime>=8')
    
      20optdepends=(
    
      21    'gtk2: gtk2 or gtk3 must be installed'
    
      22    'gtk3: gtk2 or gtk3 must be installed'
    
      23    'lame: needed for audio notes'
    
      24)
    
      25provides=('xmind')
    
      26conflicts=('xmind')
    
      27install=xmind8.install
    
      28source=(
    
      29    "https://www.xmind.net/xmind/downloads/xmind-${pkgver/./-}-linux.zip"
    
      30    'XMind'
    
      31    'xmind.desktop'
    
      32    'xmind.xml'
    
      33    'xmind.png'
    
      34    'xmind_file.png'
    
      35)
    
      36sha256sums=('835f7eaa93e2b7d52f44f02324089363ed65a61e0713e01652871143becb070e'
    
      37            '0ec1dac54d0bd8e01e7a2219da52cbbf261dfdd3cbdc1cb50650a0803f6ff6de'
    
      38            '7d6cfdee51d72626c5d945debb4371ef8d758c8a0c4e5c2b547cbd7e552ac00a'
    
      39            'cc8dccb4710d924d0f3198770705272bfa222dc6926826c975c881e87f081419'
    
      40            'ae20c41ebe708603cc303c3241a816a229bcbcc3a2435381a7092783a313b84b'
    
      41            '7015cda79ee9844f370687b9532b892ebe607969170e6f3fd414e259b181e5ba')
    
      42
    
      43package() {
    
      44    mkdir -p $pkgdir/usr/share/xmind
    
      45    cp -r $srcdir/XMind_amd64   $pkgdir/usr/share/xmind/XMind
    
      46    cp -r $srcdir/configuration $pkgdir/usr/share/xmind/
    
      47    cp -r $srcdir/features      $pkgdir/usr/share/xmind/
    
      48    cp -r $srcdir/plugins       $pkgdir/usr/share/xmind/
    
      49    cp $srcdir/*.xml            $pkgdir/usr/share/xmind/
    
      50
    
      51    mkdir -p $pkgdir/usr/share/licenses/$pkgname
    
      52    cp $srcdir/{epl-v10,lgpl-3.0}.html $pkgdir/usr/share/licenses/$pkgname/
    
      53    cp $srcdir/xpla.txt                $pkgdir/usr/share/licenses/$pkgname/
    
      54
    
      55    mkdir -p $pkgdir/usr/share/fonts/xmind
    
      56    cp -r $srcdir/fonts $pkgdir/usr/share/fonts/xmind/
    
      57
    
      58    mkdir -p $pkgdir/usr/share/applications
    
      59    cp $srcdir/xmind.desktop $pkgdir/usr/share/applications/
    
      60
    
      61    mkdir -p $pkgdir/usr/share/mime/packages
    
      62    cp $srcdir/xmind.xml $pkgdir/usr/share/mime/packages/
    
      63
    
      64    mkdir -p $pkgdir/usr/share/pixmaps
    
      65    cp $srcdir/*.png $pkgdir/usr/share/pixmaps/
    
      66
    
      67    mkdir -p $pkgdir/usr/bin
    
      68    cp $srcdir/XMind $pkgdir/usr/bin/
    
      69
    
      70    sed -i "s|^./configuration$|@user.home/.xmind/configuration|" $pkgdir/usr/share/xmind/XMind/XMind.ini
    
      71    sed -i "s|^../workspace$|@user.home/.xmind/workspace|" $pkgdir/usr/share/xmind/XMind/XMind.ini
    
      72    sed -i "s|^2$|$GTK_VERSION|" $pkgdir/usr/share/xmind/XMind/XMind.ini
    
      73    sed -i "s|^-vmargs$|-vm\n$JAVA_PATH\n-vmargs|" $pkgdir/usr/share/xmind/XMind/XMind.ini
    
      74}
    
      75

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2