aspia-host-bin

MEDIUM

maintainer andreymal 0 votes scanned 2026-09-28 15:21:17.813621

View on AUR

Why flagged

The package downloads a prebuilt binary from a GitHub release, which is an official source but not the primary project domain; while the checksum is verified, the use of a third-party fork and binary distribution introduces a supply-chain risk if the source were compromised.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package downloads a prebuilt binary from a GitHub release, which is an official source but not the primary project domain; while the checksum is verified, the use of a third-party fork and binary distribution introduces a supply-chain risk if the source were compromised.

PKGBUILD

      1# Maintainer: Andrey Kashlak <me@andreymal.org>
    
      2
    
      3pkgname=aspia-host-bin
    
      4_pkgname=${pkgname%-bin}
    
      5pkgver=3.0.19
    
      6pkgrel=1
    
      7pkgdesc="Remote desktop control and file transfer tool (host, official binary)"
    
      8url="https://aspia.org/"
    
      9arch=(x86_64)
    
      10license=(GPL-3.0-only)
    
      11depends=(
    
      12  dbus
    
      13  glibc
    
      14  hicolor-icon-theme
    
      15  libgcc
    
      16  libstdc++
    
      17  pam
    
      18  polkit
    
      19  ttf-font
    
      20)
    
      21backup=(etc/pam.d/aspia-terminal)
    
      22provides=(aspia-host)
    
      23conflicts=(aspia-host)
    
      24options=(!debug !strip)
    
      25source=(aspia-terminal.pam)
    
      26source_x86_64=("https://github.com/dchapyshev/aspia/releases/download/v${pkgver}/${_pkgname}-${pkgver}-${arch}.deb")
    
      27sha256sums=('8e0aced1c552483f1df1fe8dd7de1c18435c0c397741a9f6f60d36ec5aae1466')
    
      28sha256sums_x86_64=('9d4d3cbffecf954f873df8e868d48fadb7a9d1fb98a98ab8fc7296d1e37b9f43')
    
      29
    
      30package() {
    
      31  cd "${srcdir}"
    
      32  bsdtar -xzf data.tar.xz -C "${pkgdir}"
    
      33
    
      34  mkdir -p "${pkgdir}/etc/pam.d"
    
      35  install -m 644 aspia-terminal.pam "${pkgdir}"/etc/pam.d/aspia-terminal
    
      36}
    
      37

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-28 15:21:17	Medium	2