calibre-bin 9.18.0-1
Official binary version Calibre
config.json file.
/v1/packages/calibre-bin/versions SHAs are authoritative.
Metadata
Relations
Depends
Make dependencies
Conflicts
Security
Revision scans
| Revision | Status | Scanned | Findings |
|---|---|---|---|
| b839f79265ffhead | verified | 2026-11-06 15:34 | 4 |
| b9a73e5df08b | verified | 2026-11-05 16:10 | 4 |
| cdd7a29236cf | verified | 2026-11-05 16:07 | 4 |
| 054054ef7904 | verified | 2026-11-05 16:07 | 4 |
| 829fddbf8484 | verified | 2026-11-05 16:03 | 4 |
| 86485c2003a5 | verified | 2026-11-05 16:03 | 4 |
Head findings
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
CALIBRE_CONFIG_DIRECTORY=$(mktemp -d) \
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
local count=$(find "$srcdir/man-pages/en" -name '*.1' | wc -l)
command-substitution
in
PKGBUILDDynamic command construction - the effective command is computed at runtime and cannot be statically resolved.
for f in $(find "$pkgdir/opt/calibre" -maxdepth 1 -type f -printf "%f\n"); do
local-binary
in
share.tar.xzLocal source file 'share.tar.xz' is a binary archive - its contents cannot be reviewed as text, but it cannot execute on its own and is versioned in the repository.
share.tar.xz
Findings below High severity are retained for review but do not block serving. Verified means no obvious red flags from static analysis - never a guarantee that a package is safe.