ailinux-client

maintainer zomb0_or · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a source tarball from a personal/project host (repo.ailinux.me) with sha256sums=('SKIP'), meaning no integrity verification whatsoever. The tarball is then executed: Python code from it is installed via pip/setup.py/installer. This is a real supply-chain risk — if the host is compromised or the maintainer pushes a malicious tarball, arbitrary code runs during installation with no checksum to detect tampering. The host is the same organization as the maintainer, which is not inherently malicious, but it is not an official upstream mirror or language-ecosystem index (PyPI). The SKIP checksum combined with a non-standard host and executed Python code meets the medium threshold. No evidence of active malice, obfuscation, or piracy.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 source=("https://repo.ailinux.me/mirror/archive.ailinux.me/pool/main/a/ailinux-client/ailinux-client_${pkgver}.orig.tar.gz")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a source tarball from a personal/project host (repo.ailinux.me) with sha256sums=('SKIP'), meaning no integrity verification whatsoever. The tarball is then executed: Python code from it is installed via pip/setup.py/installer. This is a real supply-chain risk — if the host is compromised or the maintainer pushes a malicious tarball, arbitrary code runs during installation with no checksum to detect tampering. The host is the same organization as the maintainer, which is not inherently malicious, but it is not an official upstream mirror or language-ecosystem index (PyPI). The SKIP checksum combined with a non-standard host and executed Python code meets the medium threshold. No evidence of active malice, obfuscation, or piracy.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: AILinux Repository <admin@ailinux.me>
    
      2pkgname=ailinux-client
    
      3pkgver=4.2.0
    
      4pkgrel=1
    
      5pkgdesc="AILinux Client - Multi-LLM AI Assistant with MCP Integration"
    
      6arch=('x86_64')
    
      7url="https://ailinux.me"
    
      8license=('MIT')
    
      9depends=(
    
      10    'python>=3.10'
    
      11    'python-pyqt6'
    
      12    'python-pyqt6-webengine'
    
      13    'python-httpx'
    
      14    'python-cryptography'
    
      15    'python-keyring'
    
      16    'qt6-webengine'
    
      17    'qt6-base'
    
      18    'tor'
    
      19)
    
      20optdepends=(
    
      21    'python-pystemmer: Enhanced search capabilities'
    
      22    'ollama: Local AI model support'
    
      23)
    
      24source=("https://repo.ailinux.me/mirror/archive.ailinux.me/pool/main/a/ailinux-client/ailinux-client_${pkgver}.orig.tar.gz")
    
      25sha256sums=('SKIP')
    
      26
    
      27package() {
    
      28    cd "$srcdir/ailinux-client-${pkgver}"
    
      29    
    
      30    # Python-Paket installieren
    
      31    python -m installer --destdir="$pkgdir" dist/*.whl 2>/dev/null || \
    
      32    pip install --root="$pkgdir" --no-deps --ignore-installed . 2>/dev/null || \
    
      33    python setup.py install --root="$pkgdir" --optimize=1
    
      34    
    
      35    # Desktop-Datei
    
      36    install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/ailinux-client.desktop" << DESKTOP
    
      37[Desktop Entry]
    
      38Name=AILinux Client
    
      39Comment=Multi-LLM AI Assistant
    
      40Exec=ailinux-client
    
      41Icon=ailinux-client
    
      42Type=Application
    
      43Categories=Utility;Development;
    
      44Keywords=AI;LLM;Assistant;Claude;GPT;
    
      45DESKTOP
    
      46
    
      47    # Icon (falls vorhanden)
    
      48    if [ -f "assets/icon.png" ]; then
    
      49        install -Dm644 assets/icon.png "$pkgdir/usr/share/icons/hicolor/256x256/apps/ailinux-client.png"
    
      50    fi
    
      51    
    
      52    # Lizenz
    
      53    install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE" 2>/dev/null || true
    
      54}
    
      55

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2