xodopdfreader
LOW
maintainer bbx0
0 votes
scanned 2026-09-14 19:19:39.760991
Why flagged
Downloads a prebuilt .deb from getpdfstudio.xodo.com, which is plausibly the vendor's (Apryse/Xodo) own official distribution host, with a pinned b2sum checksum; the package installs a proprietary PDF reader binary but does not fetch from an unrelated third-party swappable host, and no obfuscated payloads or exfiltration are present.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 75%): Downloads a prebuilt .deb from getpdfstudio.xodo.com, which is plausibly the vendor's (Apryse/Xodo) own official distribution host, with a pinned b2sum checksum; the package installs a proprietary PDF reader binary but does not fetch from an unrelated third-party swappable host, and no obfuscated payloads or exfiltration are present.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:20
source=("${_deb}::https://getpdfstudio.xodo.com/${pkgname}/XodoPDFReader_linux64.deb")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Philipp Micheel <bbx0+aur at bitdevs dot de>
2
# Contributor: Apryse Software Inc. <support at apryse dot com>
3
4
# shellcheck shell=bash disable=SC2034,SC2154,SC2164
5
6
pkgname=xodopdfreader
7
pkgver=2026.2.0
8
pkgrel=1
9
pkgdesc='Open, view, annotate, fill out forms, and sign PDF documents'
10
arch=('x86_64' 'aarch64')
11
url='https://xodo.com/pdf-studio/free-pdf-reader'
12
license=('LicenseRef-Apryse')
13
makedepends=('dpkg' 'desktop-file-utils' 'gendesk' 'libarchive')
14
# Xodo PDF Reader is the successor of PDF Studio Viewer (Qoppa -> Apryse).
15
#provides=('pdfstudioviewer')
16
#conflicts=('pdfstudioviewer')
17
#replaces=('pdfstudioviewer')
18
_deb="${pkgname}-${pkgver}_linux64.deb"
19
noextract=("${_deb}")
20
source=("${_deb}::https://getpdfstudio.xodo.com/${pkgname}/XodoPDFReader_linux64.deb")
21
b2sums=('34dc07644c774d40ddfda8d3d631a682b086d791dece39f9b7080bb264be5e86f6ba8515234345bf22bab175428299780c05e0127b6fee8be19261d052ee1410')
22
23
# Pin the Java version to 25 (OpenJDK). (Java versions >= 26 are not compatible.)
24
_jre_version=25
25
26
# Desktop File parameters; validate via `gendesk -n PKGBUILD`
27
_name='Xodo PDF Reader'
28
_genericname='PDF Viewer'
29
_mimetypes='application/pdf'
30
_categories='Office;Viewer'
31
# `xprop WM_CLASS` shows that the product name is used as WM_CLASS
32
_custom='StartupWMClass=Xodo PDF Reader'
33
_exec="${pkgname} %U"
34
35
pkgver() {
36
# shellcheck disable=SC2016
37
dpkg-deb --show --showformat='${Version}' "${_deb}" | tr - .
38
}
39
40
prepare() {
41
# Extract Debian Archive
42
dpkg-deb --raw-extract "${_deb}" "${pkgname}-${pkgver}"
43
cd "${pkgname}-${pkgver}"
44
45
# Extract the license (EULA)
46
bsdtar xf "opt/${pkgname}/lib/xodopdfstudio.jar" resources/license_viewer.html
47
48
# Arch Linux customization
49
# shellcheck disable=SC1003,SC2016
50
{
51
# Use the newest verified compatible JRE and disable caching of tested JRE versions.
52
sed -i \
53
-e '/# INSTALL4J_JAVA_HOME_OVERRIDE=/a\' \
54
-e ': "${INSTALL4J_JAVA_HOME_OVERRIDE:=/usr/lib/jvm/java-'${_jre_version}'-openjdk}"\' \
55
-e ': "${INSTALL4J_NO_DB:=true}"' \
56
"opt/${pkgname}/${pkgname}"
57
58
# Permit the verified Java release while rejecting newer versions.
59
sed -i 's/"$ver_major" -gt "[0-9]*"/"$ver_major" -gt "'${_jre_version}'"/' "opt/${pkgname}/${pkgname}"
60
61
# Remove obsolete Java export that causes a startup warning on Java >=24.
62
sed -i 's| --add-exports java.base/sun.security.action=ALL-UNNAMED||g' "opt/${pkgname}/${pkgname}"
63
64
# Remove bundled JRE
65
rm -rf "opt/${pkgname}/jre"
66
67
# Remove standalone updater
68
rm "opt/${pkgname}/update"
69
rm "opt/${pkgname}/updatesh"
70
}
71
72
# Generate the ${pkgname}.desktop file
73
gendesk -n \
74
--pkgname "${pkgname}" \
75
--pkgdesc "${pkgdesc}" \
76
--name "${_name}" \
77
--genericname "${_genericname}" \
78
--mimetypes "${_mimetypes}" \
79
--categories "${_categories}" \
80
--custom "${_custom}" \
81
--exec "${_exec}"
82
}
83
84
package() {
85
cd "${pkgname}-${pkgver}"
86
87
# Runtime dependencies
88
depends=("java-runtime-openjdk=${_jre_version}" 'sane')
89
90
# Application /opt/${pkgname}
91
install -d "${pkgdir}/opt/${pkgname}"
92
cp -a "opt/${pkgname}/." "${pkgdir}/opt/${pkgname}/"
93
94
# Link /usr/bin/${pkgname}
95
install -d "${pkgdir}/usr/bin"
96
ln -s "/opt/${pkgname}/${pkgname}" "${pkgdir}/usr/bin/${pkgname}"
97
98
# Desktop Entry and Icon
99
desktop-file-install -m 644 --dir "${pkgdir}/usr/share/applications/" "${pkgname}.desktop"
100
install -Dm644 "opt/${pkgname}/.install4j/${pkgname}.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
101
102
# Xodo PDF Reader EULA
103
install -Dm644 resources/license_viewer.html -t "${pkgdir}/usr/share/licenses/${pkgname}"
104
}
105
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-14 19:19:39 | Low | 3 |
| 2026-09-14 19:17:46 | Medium | 3 |