boxd-cli-bin
MEDIUM
maintainer theorangeguo
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a prebuilt binary from a non-standard host (boxd.sh) which is not on the standard whitelist; while the domain appears project-specific, the lack of verifiable source code for the binary creates a supply-chain risk if the host is compromised.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:23
source_x86_64=(boxd-cli-bin-0.1.23-x86_64::https://boxd.sh/downloads/cli/boxd-linux-amd64 )
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt binary from a non-standard host (boxd.sh) which is not on the standard whitelist; while the domain appears project-specific, the lack of verifiable source code for the binary creates a supply-chain risk if the host is compromised.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: theorangeguo
2
# Packaging Repo: https://github.com/theorangeguo/aur-packages/tree/main/packages/boxd-cli-bin
3
pkgname=boxd-cli-bin
4
pkgver=0.1.23
5
pkgrel=1
6
pkgdesc=External\ CLI\ for\ managing\ boxd\ cloud\ VMs
7
arch=(x86_64 aarch64 )
8
url=https://boxd.sh/
9
license=(custom:boxd-terms )
10
depends=(ca-certificates glibc )
11
makedepends=()
12
checkdepends=()
13
optdepends=(openssh:\ connect\ to\ boxd\ VMs\ via\ ssh )
14
options=(\!strip )
15
provides=(boxd boxd-cli )
16
conflicts=(boxd boxd-cli )
17
validpgpkeys=()
18
install=boxd-cli-bin.install
19
source=(LICENSE )
20
sha256sums=('7f5da622099b2595235408e5130e231f74b8a4d6972fd0d5234be963f5baa247')
21
sha256sums_x86_64=('4e551e178d4972c31e91e1b1e32f1d2b28d343fa321f026b4b14452c3da76297')
22
sha256sums_aarch64=('4d50887bd8ba01d7e5b4e04688659ba68af494f357e34b0add7b77e4825639e1')
23
source_x86_64=(boxd-cli-bin-0.1.23-x86_64::https://boxd.sh/downloads/cli/boxd-linux-amd64 )
24
source_aarch64=(boxd-cli-bin-0.1.23-aarch64::https://boxd.sh/downloads/cli/boxd-linux-arm64 )
25
26
_binary_source_path=boxd-cli-bin-0.1.23-\*
27
_install_bin_path=/usr/bin/boxd
28
_wrapper_source_path=''
29
_wrapper_install_path=''
30
_wrapper_mode=755
31
_service_file=''
32
_service_install_path=''
33
_doc_files=()
34
_license_files=(LICENSE )
35
36
37
package() {
38
_resolve_required_source_file() {
39
local pattern=$1
40
local matches=()
41
local nullglob_was_set=false
42
43
shopt -q nullglob && nullglob_was_set=true
44
shopt -s nullglob
45
matches=("${srcdir}"/$pattern)
46
[ "$nullglob_was_set" = true ] || shopt -u nullglob
47
48
if [ "${#matches[@]}" -ne 1 ]; then
49
printf 'Expected exactly one source match for pattern %s, found %s\n' "$pattern" "${#matches[@]}" >&2
50
return 1
51
fi
52
53
[ -f "${matches[0]}" ] || {
54
printf 'Matched source is not a file: %s\n' "${matches[0]}" >&2
55
return 1
56
}
57
58
printf '%s\n' "${matches[0]}"
59
}
60
61
_install_optional_source_files() {
62
local pattern=$1
63
local target_dir=$2
64
local mode=$3
65
local matches=()
66
local matched_file
67
local nullglob_was_set=false
68
69
shopt -q nullglob && nullglob_was_set=true
70
shopt -s nullglob
71
matches=("${srcdir}"/$pattern)
72
[ "$nullglob_was_set" = true ] || shopt -u nullglob
73
74
for matched_file in "${matches[@]}"; do
75
[ -f "$matched_file" ] || continue
76
install -Dm"$mode" "$matched_file" "${pkgdir}${target_dir}/$(basename "$matched_file")"
77
done
78
}
79
80
local binary_source_file
81
binary_source_file=$(_resolve_required_source_file "${_binary_source_path}")
82
install -Dm755 "$binary_source_file" "${pkgdir}${_install_bin_path}"
83
84
if [ -n "${_wrapper_source_path}" ] && [ -n "${_wrapper_install_path}" ]; then
85
local wrapper_source_file
86
wrapper_source_file=$(_resolve_required_source_file "${_wrapper_source_path}")
87
install -Dm${_wrapper_mode} "$wrapper_source_file" "${pkgdir}${_wrapper_install_path}"
88
fi
89
90
local doc_file
91
for doc_file in "${_doc_files[@]}"; do
92
_install_optional_source_files "$doc_file" "/usr/share/doc/${pkgname}" 644
93
done
94
95
local license_file
96
for license_file in "${_license_files[@]}"; do
97
_install_optional_source_files "$license_file" "/usr/share/licenses/${pkgname}" 644
98
done
99
100
if [ -n "${_service_file}" ] && [ -f "${srcdir}/${_service_file}" ]; then
101
install -Dm644 "${srcdir}/${_service_file}" "${pkgdir}${_service_install_path}"
102
fi
103
}
104
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Medium | 2 |
| 2026-09-16 00:03:17 | Medium | 2 |
| 2026-09-15 00:25:31 | Medium | 2 |
| 2026-09-14 00:27:57 | Medium | 2 |
| 2026-09-13 00:19:54 | Medium | 2 |
| 2026-09-12 00:25:17 | Medium | 2 |
| 2026-09-11 00:19:22 | Medium | 2 |
| 2026-09-10 00:22:44 | Medium | 2 |
| 2026-09-09 00:04:09 | Medium | 2 |
| 2026-09-08 00:18:08 | Medium | 2 |
| 2026-09-07 00:30:15 | Medium | 2 |
| 2026-09-06 00:17:06 | Medium | 2 |
| 2026-09-05 00:16:27 | Medium | 2 |
| 2026-09-04 00:03:13 | Medium | 2 |
| 2026-09-03 00:15:47 | Medium | 2 |
| 2026-09-02 00:02:31 | Medium | 2 |
| 2026-09-01 00:11:19 | Medium | 2 |
| 2026-08-31 00:19:57 | Medium | 2 |
| 2026-08-30 00:04:14 | Medium | 2 |
| 2026-08-29 00:29:17 | Medium | 2 |