ahfail-bin

MEDIUM

maintainer asger.weirsoe 0 votes scanned 2026-10-06 00:19:23.678998

View on AUR

Why flagged

A prebuilt binary tarball is downloaded from a personal domain (asger.weirsoe.dk) unrelated to any major forge or official vendor infrastructure, meaning it could be silently swapped; the SHA256 checksum provides some integrity guarantee but the source is unverifiable and unofficial, making this a supply-chain risk typical of medium severity.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:52 source=("https://asger.weirsoe.dk/tarballz/ahfail-0.10.2-454f97eea9c0-x86_64.tar.zst")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): A prebuilt binary tarball is downloaded from a personal domain (asger.weirsoe.dk) unrelated to any major forge or official vendor infrastructure, meaning it could be silently swapped; the SHA256 checksum provides some integrity guarantee but the source is unverifiable and unofficial, making this a supply-chain risk typical of medium severity.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Asger Geel Weirsoe <asger at weircon dot dk>
    
      2#
    
      3# DISCLAIMER
    
      4#
    
      5# ahfail is a joke with a real screen locker underneath. Two things to know
    
      6# before installing it:
    
      7#
    
      8# 1. Security. It sits in the authentication path of your session. It is
    
      9#    provided as is, without any warranty (see the AGPL-3.0 license). On
    
      10#    Wayland a crash leaves the session locked; on X11, as with i3lock, a
    
      11#    killed locker leaves it open. /etc/pam.d/ahfail includes `login`, so
    
      12#    the system's pam_faillock policy applies to wrong guesses.
    
      13#
    
      14# 2. Media. The sprite frames and the audio clip are a parody of the
    
      15#    "ah ah ah, you didn't say the magic word" scene from Jurassic Park
    
      16#    (1993). The film and its characters belong to their respective rights
    
      17#    holders; they are used here non-commercially for parody, and the
    
      18#    AGPL-3.0 license covers the code, not those assets. Rights holders who
    
      19#    object can reach the maintainer at the address above and the assets
    
      20#    will be replaced.
    
      21#
    
      22# PROVENANCE OF THE BINARY
    
      23#
    
      24# Built by the gtk-ahfail release workflow from the tagged source, in an
    
      25# archlinux:base-devel container, with --prefix=/usr and without the Gitea
    
      26# update check. The same recipe builds the source package `ahfail`.
    
      27#
    
      28#   build recipe:  https://gitea.weircon.dk/agw/gtk-ahfail
    
      29#   download:      https://asger.weirsoe.dk/tarballz/ahfail-0.10.2-454f97eea9c0-x86_64.tar.zst
    
      30
    
      31pkgname=ahfail-bin
    
      32pkgver=0.10.2
    
      33pkgrel=2
    
      34pkgdesc="Screen locker that says 'ah ah ah, you didn't say the magic word' on a wrong password (prebuilt binary)"
    
      35arch=('x86_64')
    
      36url="https://asger.weirsøe.dk/en/projects/ahfail"
    
      37license=('AGPL-3.0-only')
    
      38# gst-plugins-bad-libs: libgstplayer. gst-plugins-base/-good are runtime plugins
    
      39# (audio conversion, the mpg123 mp3 decoder) that namcap cannot see being used.
    
      40depends=('gtk3' 'gtk-session-lock' 'gstreamer' 'gst-plugins-bad-libs' 'gst-plugins-base'
    
      41         'gst-plugins-good' 'pam' 'glib2' 'gdk-pixbuf2' 'cairo' 'pango' 'at-spi2-core' 'gst-plugins-base-libs' 'glibc' 'libgcc' 'libx11')
    
      42optdepends=('pipewire-pulse: raise the volume to 100% on a failed attempt (or libpulse)'
    
      43            'libpulse: raise the volume to 100% on a failed attempt'
    
      44            'swayidle: lock automatically on Wayland'
    
      45            'xss-lock: lock automatically on X11'
    
      46            'gtklock: legacy gtklock module (/usr/lib/gtklock/ahfail-module.so)')
    
      47provides=("ahfail=$pkgver")
    
      48conflicts=('ahfail')
    
      49backup=('etc/pam.d/ahfail')
    
      50install=ahfail.install
    
      51options=('!strip' '!debug')
    
      52source=("https://asger.weirsoe.dk/tarballz/ahfail-0.10.2-454f97eea9c0-x86_64.tar.zst")
    
      53sha256sums=('454f97eea9c02a4cab7b25e91b5ac050a608c4cf0143f895d7b6b01df2d34314')
    
      54
    
      55package() {
    
      56    # The tarball is a staged `meson install` tree: usr/ and etc/ at its root.
    
      57    cp -a "$srcdir/usr" "$srcdir/etc" "$pkgdir/"
    
      58}
    
      59

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-06 00:19:23	Medium	3
2026-10-06 00:13:36	Medium	3
2026-10-05 23:40:58	Medium	3