1panel-v2-bin

LOW

maintainer lingdianshiren 0 votes scanned 2026-10-06 00:19:23.678998

View on AUR

Why flagged

Downloads official prebuilt binaries from resource.fit2cloud.com, which is the vendor's own CDN used by the official 1Panel installer script; checksums are provided and pinned to a specific version, so the non-whitelisted host is plausibly the project's own official distribution infrastructure rather than an unrelated swappable source.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 75%): Downloads official prebuilt binaries from resource.fit2cloud.com, which is the vendor's own CDN used by the official 1Panel installer script; checksums are provided and pinned to a specific version, so the non-whitelisted host is plausibly the project's own official distribution infrastructure rather than an unrelated swappable source.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:26 "1panel-${_upver}-linux-amd64.tar.gz::https://resource.fit2cloud.com/1panel/package/v2/stable/${_upver}/release/1panel-${_upver}-linux-amd64.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: lingdianshiren <ldsrwu@foxmail.com>
    
      2# 1Panel v2 官方二进制包,下载逻辑同官方安装脚本 quick_start.sh(v2 分支):
    
      3#   https://github.com/1Panel-dev/installer/blob/v2/quick_start.sh
    
      4# 下载源用官方 CDN 快镜像 resource.fit2cloud.com(v2 安装脚本默认的
    
      5# resource.1panel.pro 对部分网络极慢);版本端点:
    
      6#   https://resource.fit2cloud.com/1panel/package/v2/stable/latest
    
      7# 凭据:安装时按官方 install.sh 的 NON_INTERACTIVE 逻辑随机生成端口、安全入口、
    
      8#   用户名、密码(写入 /usr/bin/1pctl 与 /opt/1panel/.install-credentials)
    
      9#
    
      10pkgname=1panel-v2-bin
    
      11_upver=v2.3.2
    
      12pkgver=${_upver#v}
    
      13pkgrel=3
    
      14pkgdesc="1Panel v2, a modern open source linux panel (official binary)"
    
      15arch=('x86_64' 'aarch64')
    
      16url="https://github.com/1Panel-dev/1Panel"
    
      17license=('GPL-3.0-or-later')
    
      18depends=('docker' 'docker-compose')
    
      19optdepends=(
    
      20  'ufw: firewall integration'
    
      21  'firewalld: firewall integration'
    
      22)
    
      23conflicts=('1panel-bin' '1panel' '1panel-git' '1panel-dev-bin')
    
      24install=1panel-v2-bin.install
    
      25source_x86_64=(
    
      26  "1panel-${_upver}-linux-amd64.tar.gz::https://resource.fit2cloud.com/1panel/package/v2/stable/${_upver}/release/1panel-${_upver}-linux-amd64.tar.gz"
    
      27)
    
      28source_aarch64=(
    
      29  "1panel-${_upver}-linux-arm64.tar.gz::https://resource.fit2cloud.com/1panel/package/v2/stable/${_upver}/release/1panel-${_upver}-linux-arm64.tar.gz"
    
      30)
    
      31sha256sums_x86_64=('f1265a4fadeaab3d7066dd71e3c6904ac54bb687baab1b205a23c369abb61cac')
    
      32sha256sums_aarch64=('e147b2ad27053eaef25db41779368a28d31ca2aa79221b37ce5ed62b9e5fa054')
    
      33
    
      34# 上游包目录/文件名的架构标识:amd64 / arm64
    
      35case "$CARCH" in
    
      36  x86_64) _arch=amd64 ;;
    
      37  aarch64) _arch=arm64 ;;
    
      38esac
    
      39
    
      40package() {
    
      41  cd "$srcdir/1panel-${_upver}-linux-${_arch}"
    
      42
    
      43  # 主服务与代理二进制。官方在线安装复制到 /usr/local/bin 后再链接到
    
      44  # /usr/bin；AUR 包直接安装到 Arch 原生路径，systemd 入口保持不变。
    
      45  install -Dm755 1panel-core "$pkgdir/usr/bin/1panel-core"
    
      46  install -Dm755 1panel-agent "$pkgdir/usr/bin/1panel-agent"
    
      47  ln -s 1panel-core "$pkgdir/usr/bin/1panel"
    
      48
    
      49  # 1pctl 的运行凭据在 .install 中写入，避免在构建阶段生成。
    
      50  sed -i \
    
      51    -e 's|^BASE_DIR=.*|BASE_DIR=/opt|' \
    
      52    -e 's|^ORIGINAL_VERSION=.*|ORIGINAL_VERSION='"${_upver}"'|' \
    
      53    -e 's|^LANGUAGE=.*|LANGUAGE=zh|' \
    
      54    -e 's|^PANEL_EDITION=.*|PANEL_EDITION=intl|' \
    
      55    -e 's|/usr/local/bin/lang|/usr/share/1panel/lang|g' \
    
      56    -e 's|/usr/local/bin/{1pctl,1panel-core,1panel-agent,lang}|/usr/share/1panel/lang /usr/local/bin/{1pctl,1panel-core,1panel-agent,lang}|g' \
    
      57    1pctl
    
      58  install -Dm755 1pctl "$pkgdir/usr/bin/1pctl"
    
      59
    
      60  install -dm755 "$pkgdir/usr/share/1panel"
    
      61  cp -a lang "$pkgdir/usr/share/1panel/"
    
      62
    
      63  # GeoIP 数据:官方安装到 $BASE_DIR/1panel/geo/(=/opt/1panel/geo/)
    
      64  install -Dm644 GeoIP.mmdb "$pkgdir/opt/1panel/geo/GeoIP.mmdb"
    
      65
    
      66  # systemd 服务(官方装 /etc/systemd/system;Arch 惯例 /usr/lib/systemd/system)
    
      67  install -Dm644 1panel-core.service "$pkgdir/usr/lib/systemd/system/1panel-core.service"
    
      68  install -Dm644 1panel-agent.service "$pkgdir/usr/lib/systemd/system/1panel-agent.service"
    
      69
    
      70}
    
      71

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-06 00:19:23	Low	3
2026-10-06 00:13:36	Low	3
2026-10-05 23:40:58	Medium	2