zotero-bin

maintainer juanmah · 460 votes · scanned 2026-08-18 07:39:23.787586

LOW

Why flagged The package downloads prebuilt Zotero binaries from the official zotero.org domain, which is the project's legitimate release infrastructure; despite the non-whitelisted URL pattern, the source is trustworthy and the worst case of a swap would be replacing the official binary, which is a standard supply-chain risk for AUR packages but not inherently malicious.

Triggered rules

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads prebuilt Zotero binaries from the official zotero.org domain, which is the project's legitimate release infrastructure; despite the non-whitelisted URL pattern, the source is trustworthy and the worst case of a swap would be replacing the official binary, which is a standard supply-chain risk for AUR packages but not inherently malicious.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:21 source_x86_64=("Zotero-${pkgver}_linux_x86_64.tar.bz2::https://www.zotero.org/download/client/dl?channel=release&platform=linux-x86_64&version=${pkgver}")

PKGBUILD

1 offending line(s) highlighted

      1
    
      2# Maintainer: Juanma Hernandez <juanmah@gmail.com>
    
      3# Contributor: Matthias Kurz <m.kurz@irregular.at>
    
      4
    
      5pkgname=zotero-bin
    
      6pkgver=9.0.6
    
      7pkgrel=1
    
      8pkgdesc="Zotero Standalone. Is a free, easy-to-use tool to help you collect, organize, cite, and share your research sources."
    
      9arch=('x86_64' 'i686' 'aarch64')
    
      10url="https://www.zotero.org/download"
    
      11license=('AGPL-3.0-or-later')
    
      12depends=('alsa-lib' 'gtk3' 'nss')
    
      13provides=('zotero')
    
      14conflicts=('zotero')
    
      15
    
      16sha256sums=('f727308716741cf9746b92047b890c3f76c4b8b010bc5ed21b5cdb1be85e21e9')
    
      17sha256sums_x86_64=('0db6e8f94bd0d84e862e6ef5c3e217030e173c0cd3c6dfbc836252c650fea3dd')
    
      18sha256sums_i686=('2cea60eaabac6df2b02bf84a3c7d0b11c98be3ef7b7793f0585e98d717c26762')
    
      19sha256sums_aarch64=('5784ebc634387ae6dee1d4abc05ee0f73886c3ce444e2ea0956dd9f2972b4ec6')
    
      20source=("zotero.desktop")
    
      21source_x86_64=("Zotero-${pkgver}_linux_x86_64.tar.bz2::https://www.zotero.org/download/client/dl?channel=release&platform=linux-x86_64&version=${pkgver}")
    
      22source_i686=("Zotero-${pkgver}_linux_i686.tar.bz2::https://www.zotero.org/download/client/dl?channel=release&platform=linux-i686&version=${pkgver}")
    
      23source_aarch64=("Zotero-${pkgver}_linux_arm64.tar.bz2::https://www.zotero.org/download/client/dl?channel=release&platform=linux-arm64&version=${pkgver}")
    
      24
    
      25prepare() {
    
      26  if [[ "$CARCH" == "aarch64" ]]; then
    
      27    mv ${srcdir}/Zotero_linux-arm64 ${srcdir}/Zotero_linux-aarch64
    
      28  fi
    
      29}
    
      30
    
      31package() {
    
      32  install -dDm755 "$pkgdir"/usr/{bin,lib/zotero}
    
      33  mv "$srcdir"/Zotero_linux-$CARCH/* "$pkgdir"/usr/lib/zotero
    
      34  ln -s /usr/lib/zotero/zotero "$pkgdir"/usr/bin/zotero
    
      35  install -Dm644 "$srcdir"/zotero.desktop "$pkgdir"/usr/share/applications/zotero.desktop
    
      36  # Copy zotero icons to a standard location
    
      37  install -Dm644 "$pkgdir"/usr/lib/zotero/icons/icon32.png "$pkgdir"/usr/share/icons/hicolor/32x32/apps/zotero.png
    
      38  install -Dm644 "$pkgdir"/usr/lib/zotero/icons/icon64.png "$pkgdir"/usr/share/icons/hicolor/64x64/apps/zotero.png
    
      39  install -Dm644 "$pkgdir"/usr/lib/zotero/icons/icon128.png "$pkgdir"/usr/share/icons/hicolor/128x128/apps/zotero.png
    
      40  install -Dm644 "$pkgdir"/usr/lib/zotero/icons/symbolic.svg "$pkgdir"/usr/share/icons/hicolor/symbolic/apps/zotero-symbolic.svg
    
      41  # No need to keep a shell around when launching Zotero
    
      42  sed -i -r 's/^("\$CALLDIR\/zotero-bin" -app "\$CALLDIR\/application.ini" "\$@")/exec \1/' "$pkgdir"/usr/lib/zotero/zotero
    
      43}
    
      44

Changes since previous scan

--- PKGBUILD @ 2026-07-08 00:26
+++ PKGBUILD @ 2026-08-18 07:39
@@ -3,7 +3,7 @@
 # Contributor: Matthias Kurz <m.kurz@irregular.at>
 
 pkgname=zotero-bin
-pkgver=9.0.4
+pkgver=9.0.6
 pkgrel=1
 pkgdesc="Zotero Standalone. Is a free, easy-to-use tool to help you collect, organize, cite, and share your research sources."
 arch=('x86_64' 'i686' 'aarch64')
@@ -14,9 +14,9 @@
 conflicts=('zotero')
 
 sha256sums=('f727308716741cf9746b92047b890c3f76c4b8b010bc5ed21b5cdb1be85e21e9')
-sha256sums_x86_64=('a4f714901e5e50da8b60b081e94c816979acb5c2945cc5ab7f9c9f573c284a27')
-sha256sums_i686=('c92089efc430c50c8603a3ebc6e0ca2f3850d2337a51805815861983ee449e13')
-sha256sums_aarch64=('bd000850781de3d95eb8ebff695a9a1fc3eab22ed3aee4e5e1b06afd15b89388')
+sha256sums_x86_64=('0db6e8f94bd0d84e862e6ef5c3e217030e173c0cd3c6dfbc836252c650fea3dd')
+sha256sums_i686=('2cea60eaabac6df2b02bf84a3c7d0b11c98be3ef7b7793f0585e98d717c26762')
+sha256sums_aarch64=('5784ebc634387ae6dee1d4abc05ee0f73886c3ce444e2ea0956dd9f2972b4ec6')
 source=("zotero.desktop")
 source_x86_64=("Zotero-${pkgver}_linux_x86_64.tar.bz2::https://www.zotero.org/download/client/dl?channel=release&platform=linux-x86_64&version=${pkgver}")
 source_i686=("Zotero-${pkgver}_linux_i686.tar.bz2::https://www.zotero.org/download/client/dl?channel=release&platform=linux-i686&version=${pkgver}")

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 07:39:23	LOW	2
2026-07-08 00:26:52	CLEAN	2
2026-07-07 23:26:11	LOW	1
2026-06-19 19:07:35	CLEAN	2
2026-06-18 16:11:54	LOW	1