allmark-bin

maintainer gabmus · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary directly from allmark.io (the project's own domain, matching the upstream GitHub repo andreaskoch/allmark) rather than from a GitHub release asset. While allmark.io appears to be the official project site, the binary is not served from a verifiable, immutable release URL (e.g., GitHub releases). The sha256sum provides integrity checking against a known-good hash, which mitigates substitution risk somewhat, but the host allmark.io is a small personal/project domain that could change hands or be compromised without notice. The binary is directly installed as an executable, so any compromise of that host or the hash being stale would result in code execution. This is a genuine medium-severity supply-chain concern: an executed binary from a non-GitHub, non-package-registry host with no reproducibility guarantee, even if the domain matches the upstream project.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 "allmark::https://allmark.io/bin/files/allmark_linux_amd64"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary directly from allmark.io (the project's own domain, matching the upstream GitHub repo andreaskoch/allmark) rather than from a GitHub release asset. While allmark.io appears to be the official project site, the binary is not served from a verifiable, immutable release URL (e.g., GitHub releases). The sha256sum provides integrity checking against a known-good hash, which mitigates substitution risk somewhat, but the host allmark.io is a small personal/project domain that could change hands or be compromised without notice. The binary is directly installed as an executable, so any compromise of that host or the hash being stale would result in code execution. This is a genuine medium-severity supply-chain concern: an executed binary from a non-GitHub, non-package-registry host with no reproducibility guarantee, even if the domain matches the upstream project.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Gabriele Musco <gabmus@disroot.org>
    
      2# Upstream URL: https://github.com/andreaskoch/allmark
    
      3
    
      4pkgname=allmark-bin
    
      5pkgver=0.10.0
    
      6pkgrel=1
    
      7pkgdesc='Fast, standalone markdown web server'
    
      8arch=('any')
    
      9url='https://github.com/andreaskoch/allmark'
    
      10license=('custom: New BSD License')
    
      11depends=()
    
      12makedepends=()
    
      13provides=('allmark')
    
      14conflicts=('allmark' 'allmark-git')
    
      15source=(
    
      16  "allmark::https://allmark.io/bin/files/allmark_linux_amd64"
    
      17  "LICENSE::https://raw.githubusercontent.com/andreaskoch/allmark/develop/LICENSE"
    
      18)
    
      19sha256sums=(
    
      20  'e21313f89ec6773787ebaff54d55c380c3484cc523fa53a502cff7bbb8e83171'
    
      21  'bb45a00c4b29a24712c5e081b7d75fb58ef1ecf5adbbdd40ed81f93fed252b81'
    
      22)
    
      23
    
      24package() {
    
      25  install -D -m755 "$srcdir/allmark" "$pkgdir/usr/bin/allmark"
    
      26  install -D -m644 "$srcdir/LICENSE" "$pkgdir/usr/share/licenses/allmark/LICENSE"
    
      27}
    
      28

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2