bibabo-bilanz-bin

MEDIUM

maintainer kadrian 0 votes scanned 2026-11-01 20:05:43.262389

View on AUR

Why flagged

A prebuilt proprietary binary tarball downloaded from a personal/project website (kairollmann.de) that is not official vendor infrastructure anyone can independently verify; if the host were silently swapped the installed executable would run arbitrary code, though the checksum is present and the host appears to be the maintainer's own project site.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("https://kairollmann.de/bibabobilanz/releases/1.0.0/Bibabo-Bilanz_1.0.0_amd64.tar.gz")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 60%): A prebuilt proprietary binary tarball downloaded from a personal/project website (kairollmann.de) that is not official vendor infrastructure anyone can independently verify; if the host were silently swapped the installed executable would run arbitrary code, though the checksum is present and the host appears to be the maintainer's own project site.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Kai Rollmann <bibabobilanz@kairollmann.de>
    
      2pkgname=bibabo-bilanz-bin
    
      3pkgver=1.0.0
    
      4pkgrel=1
    
      5pkgdesc="Buchhaltung für eine kleine GmbH: SKR04, Bilanz und GuV, ELSTER-Vorbereitung, Jahresabschluss"
    
      6arch=('x86_64')
    
      7url="https://kairollmann.de/bibabobilanz"
    
      8license=('LicenseRef-Proprietary')
    
      9depends=('webkit2gtk-4.1' 'gtk3' 'hicolor-icon-theme')
    
      10provides=('bibabo-bilanz')
    
      11conflicts=('bibabo-bilanz')
    
      12options=('!strip')
    
      13source=("https://kairollmann.de/bibabobilanz/releases/1.0.0/Bibabo-Bilanz_1.0.0_amd64.tar.gz")
    
      14sha256sums=('911e947038d79a20c85a10bde04fdeb770dc363c083d94c3c5b5df25bc02cdac')
    
      15
    
      16package() {
    
      17  cp -a "${srcdir}/usr" "${pkgdir}/"
    
      18}
    
      19

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 20:05:43	Medium	3
2026-11-01 20:01:18	Medium	2