blipnet

MEDIUM

maintainer agokule 0 votes scanned 2026-09-22 00:15:14.502938

View on AUR

Why flagged

Installs a prebuilt proprietary binary from static.blip.net, which is plausibly the project's own CDN but is a non-standard host with few votes and no independent verification; checksums are present which mitigates swap risk, but the closed-source executable cannot be audited for malicious behavior.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source_x86_64=("https://static.blip.net/linux/blip-${pkgver}-linux-amd64.tar.gz")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Installs a prebuilt proprietary binary from static.blip.net, which is plausibly the project's own CDN but is a non-standard host with few votes and no independent verification; checksums are present which mitigates swap risk, but the closed-source executable cannot be audited for malicious behavior.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Blip Studio Inc. <hello@blip.net>
    
      2pkgname=blipnet
    
      3pkgver=1.2.0
    
      4pkgrel=1
    
      5pkgdesc='Send files to people and devices around the world'
    
      6arch=('x86_64' 'aarch64')
    
      7url='https://blip.net'
    
      8license=('LicenseRef-proprietary')
    
      9depends=('alsa-lib' 'gcc-libs' 'glibc' 'fontconfig' 'freetype2' 'libx11')
    
      10options=('!strip' '!debug')
    
      11source_x86_64=("https://static.blip.net/linux/blip-${pkgver}-linux-amd64.tar.gz")
    
      12source_aarch64=("https://static.blip.net/linux/blip-${pkgver}-linux-aarch64.tar.gz")
    
      13sha256sums_x86_64=('c8fdb2910b59d6cc0984162b665902127528e28c47c01719c04af17e6e836340')
    
      14sha256sums_aarch64=('ff445c02a4edca8e89298ce2d45f120a6795feaba108ae5d2fca72a5d875fa41')
    
      15
    
      16package() {
    
      17  cd "$srcdir/blip-$pkgver"
    
      18
    
      19  install -d "$pkgdir/opt/blip"
    
      20  cp -r bin lib "$pkgdir/opt/blip/"
    
      21
    
      22  install -d "$pkgdir/usr/bin"
    
      23  ln -s /opt/blip/bin/blip "$pkgdir/usr/bin/blip"
    
      24
    
      25  install -d "$pkgdir/usr"
    
      26  cp -r share "$pkgdir/usr/"
    
      27
    
      28  install -Dm644 lib/app/LICENSE.txt \
    
      29    "$pkgdir/usr/share/licenses/$pkgname/LICENSE.txt"
    
      30
    
      31  find "$pkgdir/usr/share" -type f -exec chmod 644 {} +
    
      32  find "$pkgdir/usr/share" -type d -exec chmod 755 {} +
    
      33}
    
      34

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-22 00:15:14	Medium	3
2026-09-21 23:38:13	Medium	3
2026-09-21 23:36:21	Medium	2