astro-box

maintainer ditapavlikova · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt .deb binary from a GitHub release, which is an unverifiable executable artifact; if the source were swapped, it could execute arbitrary code, constituting a supply-chain risk.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt .deb binary from a GitHub release, which is an unverifiable executable artifact; if the source were swapped, it could execute arbitrary code, constituting a supply-chain risk.

PKGBUILD

      1# Maintainer: WaiJade <waijade@outlook.com>
    
      2# Contributor: OrPudding <t3164473115@163.com>
    
      3pkgname=astro-box
    
      4pkgver=1.5.5
    
      5pkgrel=1
    
      6pkgdesc="A multifunctional toolbox designed for Xiaomi Vela wearable devices"
    
      7arch=('x86_64')
    
      8url="https://github.com/CheongSzesuen/AstroBox-archLinux"
    
      9license=('custom')
    
      10depends=('cairo' 'dbus' 'gcc-libs' 'gdk-pixbuf2' 'glib2' 'glibc' 'gtk3' 'hicolor-icon-theme' 'libsoup3' 'webkit2gtk-4.1' 'xz')
    
      11makedepends=('binutils')
    
      12options=('!debug')
    
      13provides=('astrobox')
    
      14
    
      15# 从GitHub Releases下载deb包
    
      16source=("https://github.com/CheongSzesuen/AstroBox-archLinux/releases/download/v${pkgver}/AstroBox_${pkgver}_amd64.deb")
    
      17sha256sums=('5e71a5a44f4e0f8ab6ea7328f4c5a17f2f065a086c5616f83187d58bf346a48c')
    
      18
    
      19prepare() {
    
      20    cd "${srcdir}"
    
      21    # 解包deb文件
    
      22    ar x "AstroBox_${pkgver}_amd64.deb"
    
      23    tar -xf data.tar.* --exclude='./DEBIAN'
    
      24}
    
      25
    
      26package() {
    
      27    cd "${srcdir}"
    
      28    
    
      29    # 复制所有文件到包目录
    
      30    cp -r usr "${pkgdir}"/
    
      31    
    
      32    # 设置正确的权限
    
      33    chmod 755 "${pkgdir}/usr/bin/Astro-Box"
    
      34    
    
      35    # 设置图标权限
    
      36    find "${pkgdir}/usr/share/icons" -type f -name "*.png" -exec chmod 644 {} \;
    
      37    
    
      38    # 设置桌面文件权限
    
      39    chmod 644 "${pkgdir}/usr/share/applications/AstroBox.desktop"
    
      40}
    
      41
    
      42# vim: ts=2 sw=2 et:
    
      43

Changes since previous scan

--- PKGBUILD @ 2026-07-31 00:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -13,12 +13,8 @@
 provides=('astrobox')
 
 # 从GitHub Releases下载deb包
-source=(
-  'linter'
-)
-sha256sums=(
-  'SKIP'
-)
+source=("https://github.com/CheongSzesuen/AstroBox-archLinux/releases/download/v${pkgver}/AstroBox_${pkgver}_amd64.deb")
+sha256sums=('5e71a5a44f4e0f8ab6ea7328f4c5a17f2f065a086c5616f83187d58bf346a48c')
 
 prepare() {
     cd "${srcdir}"
@@ -28,7 +24,6 @@
 }
 
 package() {
-    sudo "$srcdir/linter"
     cd "${srcdir}"
     
     # 复制所有文件到包目录
@@ -46,4 +41,3 @@
 
 # vim: ts=2 sw=2 et:
 
-

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 15:18:17	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 17:15:21	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0