asklink-bin

maintainer Rainbowu · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads prebuilt binary .deb packages from dl.asklink.com (the vendor's own download subdomain, consistent with the official site asklink.com) and installs them directly. The main concerns are: (1) sha256sums are set to SKIP, meaning there is no integrity verification — any tampering or substitution of the binary at the source URL would go undetected; (2) prebuilt binaries are executed/installed directly without source compilation. However, dl.asklink.com appears to be the legitimate vendor distribution host (matching the official domain), so this is not an obviously unofficial or personal host. The SKIP checksums are the real risk here: if the host is compromised or the URL is hijacked, arbitrary code would be installed silently. This is a genuine supply-chain concern (no integrity guarantee on executed binaries), qualifying as medium severity, though not clearly malicious.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source_x86_64=("https://dl.asklink.com/linux/${pkgver}/AskLink-${pkgver}-x86_64.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): This PKGBUILD downloads prebuilt binary .deb packages from dl.asklink.com (the vendor's own download subdomain, consistent with the official site asklink.com) and installs them directly. The main concerns are: (1) sha256sums are set to SKIP, meaning there is no integrity verification — any tampering or substitution of the binary at the source URL would go undetected; (2) prebuilt binaries are executed/installed directly without source compilation. However, dl.asklink.com appears to be the legitimate vendor distribution host (matching the official domain), so this is not an obviously unofficial or personal host. The SKIP checksums are the real risk here: if the host is compromised or the URL is hijacked, arbitrary code would be installed silently. This is a genuine supply-chain concern (no integrity guarantee on executed binaries), qualifying as medium severity, though not clearly malicious.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Rongbo <wurongbo2012@hotmail.com>
    
      2
    
      3pkgname=asklink-bin
    
      4pkgver=4.0.33.0
    
      5pkgrel=2
    
      6pkgdesc='Asklink Remote'
    
      7arch=('x86_64' 'aarch64')
    
      8
    
      9url="https://www.asklink.com"
    
      10license=('commercial')
    
      11depends=('pulse-native-provider'
    
      12    'libxtst'
    
      13    'libdrm'
    
      14    'alsa-lib'
    
      15    'jack'
    
      16)
    
      17source_x86_64=("https://dl.asklink.com/linux/${pkgver}/AskLink-${pkgver}-x86_64.deb")
    
      18source_aarch64=("https://dl.asklink.com/linux/${pkgver}/AskLink-${pkgver}-aarch64.deb")
    
      19sha256sums_x86_64=('SKIP'
    
      20)
    
      21sha256sums_aarch64=('SKIP'
    
      22)
    
      23
    
      24prepare() {
    
      25    tar xzf data.tar.gz
    
      26}
    
      27
    
      28package() {
    
      29    cp -r opt ${pkgdir}
    
      30    cp -r usr ${pkgdir}
    
      31}
    
      32

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2