astrill

MEDIUM

maintainer megahertz 4 votes scanned 2026-09-26 09:14:41.464653

View on AUR

Why flagged

The package downloads prebuilt RPM binaries from a non-standard host (astrilldownloads.com), which is not the project's main domain and hosts executable content that could be silently swapped, posing a supply-chain risk despite valid checksums.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source_i686=('https://www.astrilldownloads.com/astrill-setup-linux.rpm')

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads prebuilt RPM binaries from a non-standard host (astrilldownloads.com), which is not the project's main domain and hosts executable content that could be silently swapped, posing a supply-chain risk despite valid checksums.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: yair reshef <yair99@gmail.com>
    
      2# Contributor: piojo, jediofthecode, megahertz
    
      3
    
      4pkgname=astrill
    
      5pkgver=3.10.0.3073
    
      6pkgrel=0
    
      7pkgdesc="VPN configuration tool for Astrill's servers"
    
      8arch=('x86_64' 'i686')
    
      9url="http://astrill.com/"
    
      10license=('custom')
    
      11depends=()
    
      12install=astrill.install
    
      13
    
      14# Astrill doesn't provide direct download links without authenticating
    
      15# But their QA shared the following links for building the package
    
      16source_i686=('https://www.astrilldownloads.com/astrill-setup-linux.rpm')
    
      17source_x86_64=('https://www.astrilldownloads.com/astrill-setup-linux64.rpm')
    
      18
    
      19sha256sums_x86_64=('2211073ef66a4389d96f500e74169d8db3cb4ca1955d020104496b372581402a')
    
      20sha256sums_i686=('cf5d376220988a6847684da1af525587dedf3cd1f0fb945d97972bdb1b477c42')
    
      21
    
      22# Use this path instead of /usr/local/Astrill
    
      23_install_path=/opt/astrill
    
      24
    
      25package() {
    
      26  install -Dm644 \
    
      27    "${srcdir}/etc/systemd/system/astrill-reconnect.service" \
    
      28    "${pkgdir}/etc/systemd/system/astrill-reconnect.service"
    
      29
    
      30  install -dm755 "${pkgdir}/usr/bin"
    
      31  install -dm755 "${pkgdir}${_install_path}"
    
      32  install -dm755 "${pkgdir}/usr/share"
    
      33
    
      34  cp -rT  "${srcdir}/usr/local/Astrill" "${pkgdir}${_install_path}"
    
      35  cp -rT  "${srcdir}/usr/share" "${pkgdir}/usr/share"
    
      36
    
      37  _patch_install_path '/etc/systemd/system/astrill-reconnect.service'
    
      38  _patch_install_path "${_install_path}/Astrill.desktop"
    
      39  _patch_install_path "/usr/share/applications/Astrill.desktop"
    
      40
    
      41  ln -s ${_install_path}/astrill "${pkgdir}"/usr/bin/astrill
    
      42}
    
      43
    
      44_patch_install_path() {
    
      45  local file_path="$1"
    
      46  sed "s%/usr/local/Astrill%${_install_path}%g" -i "${pkgdir}${file_path}"
    
      47}
    
      48

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-26 09:14:41	Medium	2
2026-06-20 16:03:41	Clean	2
2026-06-20 00:50:07	Medium	2
2026-06-20 00:18:46	Medium	1
2026-06-19 23:51:18	Medium	2
2026-06-19 19:07:35	Low	2
2026-06-18 16:11:54	Medium	1