zpaqd

LOW

maintainer bitwave 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The source is a zip file from the project author's personal domain (mattmahoney.net), which hosts the official zpaqd tool; building from this source is normal for AUR packages, and the compiled binary is built transparently with no obfuscated or remote-execution steps.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a zip file from the project author's personal domain (mattmahoney.net), which hosts the official zpaqd tool; building from this source is normal for AUR packages, and the compiled binary is built transparently with no obfuscated or remote-execution steps.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("http://mattmahoney.net/dc/$pkgname$_pkgver.zip")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: bitwave <bitwave [Att] oomlu [d0T] de>
    
      2pkgname=zpaqd
    
      3pkgver=7.15
    
      4_pkgver=715
    
      5pkgrel=1
    
      6pkgdesc="a public domain development tool allows you to create, test, debug, and optimize new compression algorithms in streaming format that are compatible with all existing ZPAQ decompressors such as zpaq, zpipe, zpsfx, and the reference decoder"
    
      7arch=('i686' 'x86_64')
    
      8url="http://mattmahoney.net/dc/zpaqutil.html"
    
      9license=('GPL')
    
      10depends=()
    
      11makedepends=('grep')
    
      12provides=('zpaqd')
    
      13conflicts=('zpaqd')
    
      14replaces=('zpaqd')
    
      15
    
      16source=("http://mattmahoney.net/dc/$pkgname$_pkgver.zip")
    
      17md5sums=('0114cdd31e234cb84c51e520269c00b9')
    
      18sha256sums=('331f3b66dd000129346590a3c93cd86e19582405c195be7d3a9516b2aca7c820')
    
      19
    
      20build() {
    
      21	c++ -O3 -s -static -Dunix zpaqd.cpp libzpaq.cpp -o zpaqd
    
      22}
    
      23
    
      24check() {
    
      25	./zpaqd | grep zpaqd
    
      26}
    
      27
    
      28package() {
    
      29	install -Dm755 "$pkgname" "$pkgdir/usr/bin/$pkgname"
    
      30}
    
      31

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2