arvanclouds3-bin

MEDIUM

maintainer ahp 0 votes scanned 2026-10-30 09:57:53.274557

View on AUR

Why flagged

Prebuilt proprietary Electron binary downloaded from a vendor-controlled S3 bucket (arvanstorage.ir) with a fixed filename that has been replaced in-place before; while the sha256 checksum pins the current build and the host is plausibly the project's own infrastructure, the combination of a mutable URL, a proprietary unauditable binary, and a non-standard object-storage host means a silently swapped payload cannot be ruled out.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:32 source=("${pkgname}-${pkgver}.deb::https://arvanclouds3app-exe.s3.ir-thr-at1.arvanstorage.ir/ArvanCloudS3App-${_debver}_amd64.deb")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Prebuilt proprietary Electron binary downloaded from a vendor-controlled S3 bucket (arvanstorage.ir) with a fixed filename that has been replaced in-place before; while the sha256 checksum pins the current build and the host is plausibly the project's own infrastructure, the combination of a mutable URL, a proprietary unauditable binary, and a non-standard object-storage host means a silently swapped payload cannot be ruled out.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Amir Husayn Panahifar <ahp@panahifar.ir>
    
      2# Unofficial package of ArvanCloud S3 Client
    
      3# ArvanCloud all rights reserved ©
    
      4
    
      5pkgname=arvanclouds3-bin
    
      6pkgver=1.2.5_24
    
      7_debver=2.0.0
    
      8pkgrel=1
    
      9pkgdesc="ArvanCloud Object Storage desktop explorer (unofficial package)"
    
      10arch=('x86_64')
    
      11url="https://www.arvancloud.ir"
    
      12# The app is proprietary ("SEE LICENSE IN LICENSE"); Electron is MIT.
    
      13license=('LicenseRef-arvancloud' 'MIT')
    
      14# Direct ELF dependencies of the main binary, plus fuse3 for mounting buckets.
    
      15depends=(
    
      16  'alsa-lib' 'at-spi2-core' 'cairo' 'dbus' 'expat' 'fuse3' 'glib2' 'glibc'
    
      17  'gtk3' 'libcups' 'libgcc' 'libx11' 'libxcb' 'libxcomposite' 'libxdamage'
    
      18  'libxext' 'libxfixes' 'libxkbcommon' 'libxrandr' 'mesa' 'nspr' 'nss'
    
      19  'pango' 'systemd-libs'
    
      20)
    
      21optdepends=(
    
      22  'libappindicator-gtk3: tray icon'
    
      23  'xdg-utils: open links in the default browser'
    
      24)
    
      25provides=("${pkgname%-bin}")
    
      26conflicts=("${pkgname%-bin}")
    
      27# Prebuilt Electron app: nothing to strip, no debug info.
    
      28options=('!strip' '!debug')
    
      29# The vendor publishes under a fixed "2.0.0" file name and has replaced its
    
      30# contents in place (2026-07-26: build 1.2.5-24, new /opt layout). The real
    
      31# version is in the .deb's control file; the checksum pins the exact build.
    
      32source=("${pkgname}-${pkgver}.deb::https://arvanclouds3app-exe.s3.ir-thr-at1.arvanstorage.ir/ArvanCloudS3App-${_debver}_amd64.deb")
    
      33sha256sums=('2a6f3e41400579f0d0f5bb8d4db991dae86be331d7b9a15e10c6cfa17c86f8af')
    
      34
    
      35package() {
    
      36  bsdtar -xf "${pkgname}-${pkgver}.deb" data.tar.xz
    
      37  bsdtar -xpf data.tar.xz -C "$pkgdir"
    
      38
    
      39  local _app=/opt/ArvanCloudS3 _res=/opt/ArvanCloudS3/resources
    
      40
    
      41  # The vendor's postinst makes its bundled fusermount3 setuid root. Use Arch's
    
      42  # fuse3 helper instead (already setuid, maintained). The bundled
    
      43  # libfuse3.so.3 stays: Arch's fuse3 is soname .so.4, and an unprivileged
    
      44  # library is not the risk a setuid binary is.
    
      45  ln -sf /usr/bin/fusermount3 "$pkgdir$_res/bin/linux/x64/fusermount3"
    
      46  # AppArmor profile for Debian/Ubuntu; not used on Arch.
    
      47  rm -f "$pkgdir$_res/apparmor-profile"
    
      48
    
      49  find "$pkgdir" -type d -exec chmod 755 {} +
    
      50
    
      51  install -dm755 "$pkgdir/usr/bin"
    
      52  ln -s "$_app/arvanclouds3" "$pkgdir/usr/bin/arvanclouds3"
    
      53
    
      54  install -dm755 "$pkgdir/usr/share/licenses/$pkgname"
    
      55  ln -s "$_app/LICENSE.electron.txt" "$pkgdir/usr/share/licenses/$pkgname/LICENSE.electron.txt"
    
      56  ln -s "$_res/THIRD_PARTY_NOTICES.md" "$pkgdir/usr/share/licenses/$pkgname/THIRD_PARTY_NOTICES.md"
    
      57}
    
      58

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-30 09:57:53	Medium	3
2026-10-30 09:55:25	Medium	2