blisk-browser-stable

maintainer bbuske · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt RPM binary from blisk.io via a parameterized URL ('?os=linux-rpm') that does not pin to a specific versioned filename. While blisk.io is the official vendor site, the download URL is a redirect/parameter-based endpoint rather than a direct, versioned artifact URL, making it harder to verify that the downloaded file matches the declared pkgver. The sha512sum is present and provides some integrity protection, but the non-deterministic URL means the checksum could silently mismatch if the endpoint changes. The RPM is then extracted and its contents copied directly into pkgdir without any inspection or filtering — an unreviewable prebuilt binary executed on the user's system. This is a genuine supply-chain concern (unofficial/parameterized binary download) but not clearly malicious, consistent with MEDIUM severity.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source_x86_64=("https://blisk.io/download/installer/?os=linux-rpm")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt RPM binary from blisk.io via a parameterized URL ('?os=linux-rpm') that does not pin to a specific versioned filename. While blisk.io is the official vendor site, the download URL is a redirect/parameter-based endpoint rather than a direct, versioned artifact URL, making it harder to verify that the downloaded file matches the declared pkgver. The sha512sum is present and provides some integrity protection, but the non-deterministic URL means the checksum could silently mismatch if the endpoint changes. The RPM is then extracted and its contents copied directly into pkgdir without any inspection or filtering — an unreviewable prebuilt binary executed on the user's system. This is a genuine supply-chain concern (unofficial/parameterized binary download) but not clearly malicious, consistent with MEDIUM severity.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Benjamin Buske (info@buske-it.com)
    
      2# Contributor: Benjamin Buske (info@buske-it.com)
    
      3pkgname=blisk-browser-stable
    
      4pkgver=25.0.115.28
    
      5pkgrel=1
    
      6pkgdesc="The browser from blisk.io. Blisk is the first developer-oriented browser. It provides teams and freelancers with a workspace to develop and test modern web applications at least twice faster."
    
      7arch=('i686' 'x86_64')
    
      8url="https://blisk.io"
    
      9depends=('alsa-lib' 'at-spi2-core' 'bash-completion' 'ca-certificates' 'cairo>=1.6.0' 'curl' 'dbus>=1.9.14' 'desktop-file-utils' 'expat>=2.1beta3' 'gcc-libs' 'glib2>=2.39.4' 'glibc>=2.17' 'gtk3' 'gtk4' 'hicolor-icon-theme' 'libcups>=1.6.0' 'libcurl-gnutls' 'libdrm>=2.4.75' 'libx11>=1.4.99.1' 'libxcb>=1.9.2' 'libxcomposite>=0.4.4' 'libxdamage>=1.1' 'libxext' 'libxfixes' 'libxrandr' 'mesa>=17.1.0rc2' 'nspr>=4.9' 'nss>=3.35' 'pango' 'ttf-liberation' 'xdg-utils>=1.0.2')
    
      10provides=('blisk-browser-stable')
    
      11options=('!strip' '!emptydirs')
    
      12source_x86_64=("https://blisk.io/download/installer/?os=linux-rpm")
    
      13
    
      14sha512sums_x86_64=('59288ef7390f59a134341a18c489d8912250bf5ae3aceaf0755e1e5b9fefaceae915cfdb136b176d74d8caea8b9779460437a2926201e1d33c5b3265be7cc653')
    
      15
    
      16package(){
    
      17
    
      18	# Extract package data
    
      19	find $srcdir/ -mindepth 1 -maxdepth 1 -type d | xargs cp -r -t "$pkgdir"
    
      20
    
      21}
    
      22

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2