boxd-cli-bin

MEDIUM

maintainer theorangeguo 0 votes scanned 2026-11-01 05:59:34.516406

View on AUR

Why flagged

The package downloads a prebuilt binary from a non-whitelisted host (boxd.sh), which is not a major trusted source, creating a supply-chain risk if the host is compromised or subverted.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:23 source_x86_64=(boxd-cli-bin-0.2.32-x86_64::https://boxd.sh/downloads/cli/boxd-linux-amd64 )

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt binary from a non-whitelisted host (boxd.sh), which is not a major trusted source, creating a supply-chain risk if the host is compromised or subverted.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: theorangeguo
    
      2# Packaging Repo: https://github.com/theorangeguo/aur-packages/tree/main/packages/boxd-cli-bin
    
      3pkgname=boxd-cli-bin
    
      4pkgver=0.2.32
    
      5pkgrel=1
    
      6pkgdesc=External\ CLI\ for\ managing\ boxd\ cloud\ VMs
    
      7arch=(x86_64 aarch64 )
    
      8url=https://boxd.sh/
    
      9license=(custom:boxd-terms )
    
      10depends=(ca-certificates glibc )
    
      11makedepends=()
    
      12checkdepends=()
    
      13optdepends=(openssh:\ connect\ to\ boxd\ VMs\ via\ ssh )
    
      14options=(\!strip )
    
      15provides=(boxd boxd-cli )
    
      16conflicts=(boxd boxd-cli )
    
      17validpgpkeys=()
    
      18install=boxd-cli-bin.install
    
      19source=(LICENSE )
    
      20sha256sums=('7f5da622099b2595235408e5130e231f74b8a4d6972fd0d5234be963f5baa247')
    
      21sha256sums_x86_64=('d9a32db6e45b511855d79133e69dcecdc23177a880dfb0c6d1e103bceceec3c2')
    
      22sha256sums_aarch64=('1cf569c39fb719a6e9c0758fb8a8c7aff5ba3136499755788b5e290ae4e4458d')
    
      23source_x86_64=(boxd-cli-bin-0.2.32-x86_64::https://boxd.sh/downloads/cli/boxd-linux-amd64 )
    
      24source_aarch64=(boxd-cli-bin-0.2.32-aarch64::https://boxd.sh/downloads/cli/boxd-linux-arm64 )
    
      25
    
      26_binary_source_path=boxd-cli-bin-0.2.32-\*
    
      27_install_bin_path=/usr/bin/boxd
    
      28_wrapper_source_path=''
    
      29_wrapper_install_path=''
    
      30_wrapper_mode=755
    
      31_service_file=''
    
      32_service_install_path=''
    
      33_doc_files=()
    
      34_license_files=(LICENSE )
    
      35
    
      36
    
      37package() {
    
      38    _resolve_required_source_file() {
    
      39        local pattern=$1
    
      40        local matches=()
    
      41        local nullglob_was_set=false
    
      42
    
      43        shopt -q nullglob && nullglob_was_set=true
    
      44        shopt -s nullglob
    
      45        matches=("${srcdir}"/$pattern)
    
      46        [ "$nullglob_was_set" = true ] || shopt -u nullglob
    
      47
    
      48        if [ "${#matches[@]}" -ne 1 ]; then
    
      49            printf 'Expected exactly one source match for pattern %s, found %s\n' "$pattern" "${#matches[@]}" >&2
    
      50            return 1
    
      51        fi
    
      52
    
      53        [ -f "${matches[0]}" ] || {
    
      54            printf 'Matched source is not a file: %s\n' "${matches[0]}" >&2
    
      55            return 1
    
      56        }
    
      57
    
      58        printf '%s\n' "${matches[0]}"
    
      59    }
    
      60
    
      61    _install_optional_source_files() {
    
      62        local pattern=$1
    
      63        local target_dir=$2
    
      64        local mode=$3
    
      65        local matches=()
    
      66        local matched_file
    
      67        local nullglob_was_set=false
    
      68
    
      69        shopt -q nullglob && nullglob_was_set=true
    
      70        shopt -s nullglob
    
      71        matches=("${srcdir}"/$pattern)
    
      72        [ "$nullglob_was_set" = true ] || shopt -u nullglob
    
      73
    
      74        for matched_file in "${matches[@]}"; do
    
      75            [ -f "$matched_file" ] || continue
    
      76            install -Dm"$mode" "$matched_file" "${pkgdir}${target_dir}/$(basename "$matched_file")"
    
      77        done
    
      78    }
    
      79
    
      80    local binary_source_file
    
      81    binary_source_file=$(_resolve_required_source_file "${_binary_source_path}")
    
      82    install -Dm755 "$binary_source_file" "${pkgdir}${_install_bin_path}"
    
      83
    
      84    if [ -n "${_wrapper_source_path}" ] && [ -n "${_wrapper_install_path}" ]; then
    
      85        local wrapper_source_file
    
      86        wrapper_source_file=$(_resolve_required_source_file "${_wrapper_source_path}")
    
      87        install -Dm${_wrapper_mode} "$wrapper_source_file" "${pkgdir}${_wrapper_install_path}"
    
      88    fi
    
      89
    
      90    local doc_file
    
      91    for doc_file in "${_doc_files[@]}"; do
    
      92        _install_optional_source_files "$doc_file" "/usr/share/doc/${pkgname}" 644
    
      93    done
    
      94
    
      95    local license_file
    
      96    for license_file in "${_license_files[@]}"; do
    
      97        _install_optional_source_files "$license_file" "/usr/share/licenses/${pkgname}" 644
    
      98    done
    
      99
    
      100    if [ -n "${_service_file}" ] && [ -f "${srcdir}/${_service_file}" ]; then
    
      101        install -Dm644 "${srcdir}/${_service_file}" "${pkgdir}${_service_install_path}"
    
      102    fi
    
      103}
    
      104

Changes since previous scan

--- PKGBUILD @ 2026-11-01 00:21
+++ PKGBUILD @ 2026-11-01 05:59
@@ -1,7 +1,7 @@
 # Maintainer: theorangeguo
 # Packaging Repo: https://github.com/theorangeguo/aur-packages/tree/main/packages/boxd-cli-bin
 pkgname=boxd-cli-bin
-pkgver=0.2.31
+pkgver=0.2.32
 pkgrel=1
 pkgdesc=External\ CLI\ for\ managing\ boxd\ cloud\ VMs
 arch=(x86_64 aarch64 )
@@ -18,12 +18,12 @@
 install=boxd-cli-bin.install
 source=(LICENSE )
 sha256sums=('7f5da622099b2595235408e5130e231f74b8a4d6972fd0d5234be963f5baa247')
-sha256sums_x86_64=('d3d4475dc30fd259be9d26a14c7b1f054c7acbf94701885edab7175d1134d86a')
-sha256sums_aarch64=('0a3525d4fd6c0d466f0f6e83ef7ab7c5fac90fc17b425a63b947715c6866f41e')
-source_x86_64=(boxd-cli-bin-0.2.31-x86_64::https://boxd.sh/downloads/cli/boxd-linux-amd64 )
-source_aarch64=(boxd-cli-bin-0.2.31-aarch64::https://boxd.sh/downloads/cli/boxd-linux-arm64 )
+sha256sums_x86_64=('d9a32db6e45b511855d79133e69dcecdc23177a880dfb0c6d1e103bceceec3c2')
+sha256sums_aarch64=('1cf569c39fb719a6e9c0758fb8a8c7aff5ba3136499755788b5e290ae4e4458d')
+source_x86_64=(boxd-cli-bin-0.2.32-x86_64::https://boxd.sh/downloads/cli/boxd-linux-amd64 )
+source_aarch64=(boxd-cli-bin-0.2.32-aarch64::https://boxd.sh/downloads/cli/boxd-linux-arm64 )
 
-_binary_source_path=boxd-cli-bin-0.2.31-\*
+_binary_source_path=boxd-cli-bin-0.2.32-\*
 _install_bin_path=/usr/bin/boxd
 _wrapper_source_path=''
 _wrapper_install_path=''

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 05:59:34	Medium	2
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 23:51:05	Medium	2
2026-10-28 05:49:54	Medium	1
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 11:37:13	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 21:29:05	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 03:20:54	Medium	2