agent-mailru

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary tarball (agent.tar.xz) from hb.bizmrg.com, which is Mail.Ru's object storage (BizMRG is VK/Mail.Ru Group's cloud platform), so it is effectively the official vendor host rather than a random personal server. However, the binary is installed directly into /opt/agent without any signature verification beyond a sha256sum, and the source URL is not versioned (it always fetches 'agent.tar.xz' without a version in the path), meaning the checksum could become stale if the upstream file is silently replaced. The install hook (agentlink.install) is also sourced from an unreviewed local file. The core concern is a prebuilt closed-source binary from a vendor-controlled but non-auditable host installed with elevated privileges — this is a legitimate medium supply-chain concern (executed binary from an unofficial/unversioned path), not a clear attack. The sha256sum provides some integrity guarantee but no authenticity guarantee.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 'https://hb.bizmrg.com/agent-www/linux/x64/agent.tar.xz'

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary tarball (agent.tar.xz) from hb.bizmrg.com, which is Mail.Ru's object storage (BizMRG is VK/Mail.Ru Group's cloud platform), so it is effectively the official vendor host rather than a random personal server. However, the binary is installed directly into /opt/agent without any signature verification beyond a sha256sum, and the source URL is not versioned (it always fetches 'agent.tar.xz' without a version in the path), meaning the checksum could become stale if the upstream file is silently replaced. The install hook (agentlink.install) is also sourced from an unreviewed local file. The core concern is a prebuilt closed-source binary from a vendor-controlled but non-auditable host installed with elevated privileges — this is a legitimate medium supply-chain concern (executed binary from an unofficial/unversioned path), not a clear attack. The sha256sum provides some integrity guarantee but no authenticity guarantee.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: leoneii comdir@infonix.info
    
      2
    
      3pkgname=agent-mailru
    
      4pkgver=23.2.0.2605
    
      5pkgrel=1
    
      6pkgdesc='Official agent Mail.Ru desktop client for Arch Linux'
    
      7arch=('x86_64')
    
      8url=https://agent.mail.ru/
    
      9license=("Custom")
    
      10depends=(
    
      11        libxcursor
    
      12        libxrandr
    
      13)
    
      14conflicts=('icqdesktop-bin' 'icqdesktop-git' 'icqdesktop' 'agent-bin' 'agent')
    
      15provides=('agent')
    
      16
    
      17
    
      18source=(
    
      19        'https://hb.bizmrg.com/agent-www/linux/x64/agent.tar.xz'
    
      20        'agent.png'
    
      21        'agent.desktop'
    
      22        "agentlink.install"
    
      23)
    
      24
    
      25sha256sums=('8819651ba06ce14d2144d49f70e8e4823247418bb47940f8064550457245982d'
    
      26            'd13bd1c339b739fdbf678bed7cbdba09c5046cf598c3bf147cc16469534c8468'
    
      27            '051854c2c9bb6b50ec3ed1fe849cd454456879f1fa071df8403aedcfc5943e2d'
    
      28            '70e47339abb18cd2190ec31f51d5a1ede46d03c37612260324c092e42ccc9421')
    
      29
    
      30install='agentlink.install'
    
      31
    
      32build (){
    
      33
    
      34mkdir ${srcdir}/Agent
    
      35bsdtar -xf  "agent.tar.xz" --directory ${srcdir}/Agent
    
      36
    
      37}
    
      38
    
      39package () {
    
      40        install -dm755  "$pkgdir/opt/agent"
    
      41        cp -r "${srcdir}/Agent/." "${pkgdir}/opt/agent"
    
      42        #install -Dm755 agent "$pkgdir/opt/agent"
    
      43       # ln -s "/opt/agent/agent" "${pkgdir}/usr/bin/agent"
    
      44        install -Dm644 agent.png "${pkgdir}/usr/share/pixmaps/agent.png"
    
      45        install -Dm644 agent.desktop "${pkgdir}/usr/share/applications/agent.desktop"
    
      46}
    
      47
    
      48

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2