1c-connect

maintainer KsenZ · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary tarball (an Electron/Qt application with native executables) from updates.1c-connect.com, which is the official vendor update server for the 1C-Connect product (a Russian business support/helpdesk client). While this is the vendor's own distribution host rather than a random personal server, it is still a non-redistributed prebuilt binary rather than source built from scratch. The sha256sum provides integrity verification against tampering in transit, but does not protect against the vendor themselves shipping malicious code. The binary is installed into /usr/lib and executed directly. This is a legitimate medium-risk pattern: prebuilt proprietary binary from a vendor host with checksum verification — standard for many AUR packages of proprietary software (like Zoom, Slack, etc.), but still carries inherent supply-chain risk since users must trust the vendor's distribution infrastructure. No obfuscation, no exfiltration, no piracy concerns. The risk level is consistent with other AUR packages distributing vendor-provided prebuilt binaries.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=('1c-connect.tar.gz::https://updates.1c-connect.com/desktop/distribs/1C-Connect-Linux-x64.tar.gz'

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary tarball (an Electron/Qt application with native executables) from updates.1c-connect.com, which is the official vendor update server for the 1C-Connect product (a Russian business support/helpdesk client). While this is the vendor's own distribution host rather than a random personal server, it is still a non-redistributed prebuilt binary rather than source built from scratch. The sha256sum provides integrity verification against tampering in transit, but does not protect against the vendor themselves shipping malicious code. The binary is installed into /usr/lib and executed directly. This is a legitimate medium-risk pattern: prebuilt proprietary binary from a vendor host with checksum verification — standard for many AUR packages of proprietary software (like Zoom, Slack, etc.), but still carries inherent supply-chain risk since users must trust the vendor's distribution infrastructure. No obfuscation, no exfiltration, no piracy concerns. The risk level is consistent with other AUR packages distributing vendor-provided prebuilt binaries.

PKGBUILD

1 offending line(s) highlighted

      1# Contributor: Gleb Liutsko <gleb@liutsko.ru>
    
      2# Contributor: Aleksey Ksenzov <aksenzov@gmail.com>
    
      3
    
      4pkgname=1c-connect
    
      5pkgver=5.4.2
    
      6pkgrel=1
    
      7pkgdesc="A solution for support services, consultations or service centers."
    
      8arch=('any')
    
      9url="https://connect.ru"
    
      10license=('custom')
    
      11depends=(libxcrypt-compat)
    
      12makedepends=()
    
      13checkdepends=()
    
      14
    
      15source=('1c-connect.tar.gz::https://updates.1c-connect.com/desktop/distribs/1C-Connect-Linux-x64.tar.gz'
    
      16        '1c-connect.desktop'
    
      17        'connect.sh')
    
      18
    
      19noextract=('1c-connect.tar.gz')
    
      20
    
      21sha256sums=('21dc6a44f75788b5dd03c3058de0d5aca7989e53a11ce4d10124458b4aa02943'
    
      22            '410d43e52f8f4a895268dcf612404df52b38b310eb39c64f40f3f32002d4c553'
    
      23            '48b91c95db0dbe98f7f99808b0633dc1cf44bfdd37349dfd374f37f9fada3c05')
    
      24
    
      25prepare() {
    
      26    cd "$srcdir"
    
      27
    
      28    mkdir 1c-connect
    
      29    tar -xzf 1c-connect.tar.gz -C 1c-connect
    
      30}
    
      31
    
      32package() {
    
      33   cd "$srcdir"
    
      34   
    
      35   mkdir -p "$pkgdir/usr/"{lib,share/icons}
    
      36   cp -r '1c-connect' "$pkgdir/usr/lib/1c-connect"
    
      37   ln -sf "$pkgdir/usr/lib/1c-connect/app/bin/ico-app.png" "$pkgdir/usr/share/icons/1c-connect.png"
    
      38   install -Dm 644 "1c-connect.desktop" -t "$pkgdir/usr/share/applications"
    
      39   install -Dm 755 'connect.sh' "$pkgdir/usr/bin/connect"
    
      40}
    
      41

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2