binders-bin

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged A prebuilt JAR is downloaded from generism.com (the upstream vendor's own site, matching the package URL), which is a small/personal vendor host rather than a well-known official mirror. The JAR is installed and executed at runtime via a wrapper script. The sha512sum is present and pins the binary, which mitigates interception risk significantly. However, the host is not a recognized major software distribution platform, and if the domain were compromised or the JAR silently replaced at the source, the checksum would only catch it if the PKGBUILD were updated. This is a classic medium-risk pattern: executed binary from an unofficial/small-vendor host with a checksum but no additional verification (e.g., GPG signature). Not clearly malicious, but a genuine supply-chain concern.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("http://generism.com/$_srcname.jar"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): A prebuilt JAR is downloaded from generism.com (the upstream vendor's own site, matching the package URL), which is a small/personal vendor host rather than a well-known official mirror. The JAR is installed and executed at runtime via a wrapper script. The sha512sum is present and pins the binary, which mitigates interception risk significantly. However, the host is not a recognized major software distribution platform, and if the domain were compromised or the JAR silently replaced at the source, the checksum would only catch it if the PKGBUILD were updated. This is a classic medium-risk pattern: executed binary from an unofficial/small-vendor host with a checksum but no additional verification (e.g., GPG signature). Not clearly malicious, but a genuine supply-chain concern.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Devin J. Pohly <djpohly+arch@gmail.com>
    
      2pkgname=binders-bin
    
      3_srcname=Binders
    
      4pkgver=4.371.416
    
      5pkgrel=1
    
      6pkgdesc="Flexible database creator for organizing arbitrary data"
    
      7arch=(any)
    
      8url="https://generism.com/"
    
      9license=('custom')
    
      10depends=('java8-openjfx')
    
      11source=("http://generism.com/$_srcname.jar"
    
      12        LICENSE
    
      13	binders.sh)
    
      14noextract=("$_srcname.jar")
    
      15sha512sums=('2e7127687f0b9d5eaff4c11523787a84eb1946788b4df89b73a86f799cf4a3deae8c0fe6f1136e06c3e04b19049b9b2e29922dacbd1f6f85d835380211f62d37'
    
      16            '608daed787b3f0753b4911d062ab2e89ec396f3d74a3d6b5655a68ea6e96b22e6da71001c126dda85780a7061c413f90482ef55598bd3b0dae02e68a1bab27af'
    
      17            '06d5fce19fc6c3cbc872059721d280ae2cd6e8e0baa191666be4dc0e14f3b6a6e120e24772946d91e772708e9e0c185571fb8fec88278204a413d7a312a1ac05')
    
      18
    
      19package() {
    
      20	install -Dm644 "$_srcname.jar" "$pkgdir/usr/share/java/$_srcname/$_srcname.jar"
    
      21	install -D binders.sh "$pkgdir/usr/bin/binders"
    
      22	install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      23}
    
      24

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2