← All KD5FMU repositories

Saytime-Weather-2026

https://github.com/KD5FMU/Saytime-Weather-2026 · Shell/Perl · 2 findings · Review date 2026-07-11

Executive Summary

Top of the Hour Spoken Time and Weather Conditions announcement. BETA VERSION

Top of the Hour Spoken Time and Weather Conditions announcement. BETA VERSION

Summary Counts

0
Critical Security
0
High Security
2
Medium Security
0
Low Security
0
Critical Bugs
0
High Bugs
0
Medium Bugs
0
Low Bugs

Quick Reference

IDSeverityCategoryFileLinesFinding
SAYTIME26-001 Medium Security install_asl3_weatherapi_v2.sh 9-10 Installer downloads sounds over HTTP without checksum
SAYTIME26-002 Medium Security install_asl3_weatherapi_v2.sh 70-78 WeatherAPI key in ini sourced by shell scripts

Medium Issues

[SAYTIME26-001] Installer downloads sounds over HTTP without checksum

install_asl3_weatherapi_v2.sh : 9-10

Sound archive fetched from http://198.58.124.150/tw/sound_files.zip.

Impact: Supply-chain tampering of voice prompt files.

[SAYTIME26-002] WeatherAPI key in ini sourced by shell scripts

install_asl3_weatherapi_v2.sh : 70-78

weatherapi.ini created and sourced; API key in URL query string.

Impact: Local users with config read access obtain API key.

Recommended Fix Priority

  1. Use HTTPS with checksum verification for remote downloads