band

MEDIUM

maintainer KatTheFox 2 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt binary .deb from ssl.pstatic.net, which is Naver's CDN (BAND is a Naver product). This is the official vendor distribution host for BAND desktop, not a random personal host. However, there are no checksums verified at build time beyond the sha256sums array (which is present and non-trivial), and the package installs a prebuilt Electron binary with SUID chrome-sandbox. The source is a closed-source proprietary binary from the vendor's own CDN, which is a legitimate but inherently trust-requiring pattern. The sha256sums are present and pinned, mitigating substitution risk. The main concern is that this is an executed prebuilt binary blob from a vendor CDN rather than source-compiled code, which is standard medium territory for AUR binary packages. No obfuscation, no exfiltration, no piracy. The cheaper model's concern about 'non-standard host' is partially a false positive since ssl.pstatic.net is Naver's official static content CDN, but the binary execution concern is real and warrants medium rather than clean.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:10 "https://ssl.pstatic.net/cmstatic/desktop/v${pkgver}/BAND-${pkgver}-amd64.deb"

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary .deb from ssl.pstatic.net, which is Naver's CDN (BAND is a Naver product). This is the official vendor distribution host for BAND desktop, not a random personal host. However, there are no checksums verified at build time beyond the sha256sums array (which is present and non-trivial), and the package installs a prebuilt Electron binary with SUID chrome-sandbox. The source is a closed-source proprietary binary from the vendor's own CDN, which is a legitimate but inherently trust-requiring pattern. The sha256sums are present and pinned, mitigating substitution risk. The main concern is that this is an executed prebuilt binary blob from a vendor CDN rather than source-compiled code, which is standard medium territory for AUR binary packages. No obfuscation, no exfiltration, no piracy. The cheaper model's concern about 'non-standard host' is partially a false positive since ssl.pstatic.net is Naver's official static content CDN, but the binary execution concern is real and warrants medium rather than clean.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: KatTheFox <katthefoxmaid at gmail dot com>
    
      2# Contributor: 7k5x <7k5xlp0onfire at gmail dot com>
    
      3# Submitter : djnk8 <djnk8 at mailinator dot com>
    
      4pkgname='band'
    
      5pkgver=1.10.10
    
      6pkgrel=1
    
      7pkgdesc='BAND desktop application'
    
      8arch=('x86_64')
    
      9source=(
    
      10	"https://ssl.pstatic.net/cmstatic/desktop/v${pkgver}/BAND-${pkgver}-amd64.deb"
    
      11	'LICENSE'
    
      12)
    
      13url='https://band.us/'
    
      14license=('custom:band')
    
      15depends=('xdg-utils' 'util-linux-libs' 'pango' 'nss' 'nspr' 'mesa' 'libxtst' 'libxss' 'libxrender' 'libxrandr' 'libxi' 'libxext' 'libxdamage' 'libxcursor' 'libxcomposite' 'libxcb' 'libx11' 'libsecret' 'libnotify' 'libdrm' 'libcups' 'libappindicator-gtk3' 'hicolor-icon-theme' 'gtk3' 'glibc' 'glib2' 'gdk-pixbuf2' 'gcc-libs' 'expat' 'desktop-file-utils' 'dbus' 'cairo' 'atk' 'at-spi2-core' 'at-spi2-atk' 'alsa-lib')
    
      16sha256sums=(
    
      17	'c1ed7394c5e6cf010248b241cda9a5249e80930d8c628a5beb15c85ba9422853'
    
      18	'263470054abd943b85dd3fa80807b8747d93dcc514cfc64f547e5029cc48d169'
    
      19)
    
      20pre_install() {
    
      21
    
      22	# 설치전 작업
    
      23
    
      24	# 1. kill BAND process
    
      25	echo "Closing BAND Desktop..."
    
      26	while pkill -TERM -f "/usr/share/BAND/BAND" > /dev/null
    
      27	do
    
      28	    sleep 1
    
      29	done
    
      30
    
      31}
    
      32
    
      33post_install() {
    
      34	gtk-update-icon-cache -q -t -f usr/share/icons/hicolor
    
      35
    
      36	# Link to the binary
    
      37	ln -sf '/opt/BAND/band' '/usr/bin/band'
    
      38
    
      39	# SUID chrome-sandbox for Electron 5+
    
      40	chmod 4755 '/opt/BAND/chrome-sandbox' || true
    
      41
    
      42	update-mime-database /usr/share/mime || true
    
      43	update-desktop-database /usr/share/applications || true
    
      44	update-desktop-database -q
    
      45}
    
      46
    
      47pre_upgrade() {
    
      48	pre_install
    
      49}
    
      50
    
      51post_upgrade() {
    
      52	post_install
    
      53}
    
      54
    
      55post_remove() {
    
      56	gtk-update-icon-cache -q -t -f usr/share/icons/hicolor
    
      57
    
      58	# Delete the link to the binary
    
      59	rm -f '/usr/bin/band'
    
      60	update-desktop-database -q
    
      61}
    
      62
    
      63package() {
    
      64	msg2 "Extracting package binaries(data.tar.xz)..."
    
      65	bsdtar -xf ${srcdir}/data.tar.xz -C "${pkgdir}/"
    
      66	install -Dm644 -t "${pkgdir}/usr/share/licenses/band/LICENSE" ${srcdir}/LICENSE
    
      67}
    
      68

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2