bt-client-bin

maintainer mineleng · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt x86_64 binary .deb from download-esa.bt.cn, which is a subdomain of bt.cn (BaoTa/aaPanel, a Chinese server management panel vendor). This is the vendor's own distribution host, not a random personal server, so it is somewhat analogous to an official release host. However, the package installs a prebuilt Electron/GUI binary directly from a Chinese vendor's CDN without any source build, and the domain (download-esa.bt.cn) is not a widely recognized or audited distribution channel. A sha256 checksum is provided, which mitigates substitution risk at the specific version, but does not address trust in the upstream binary itself. The core concern is that this is an opaque, prebuilt executable from a vendor-controlled host with no source build — a classic supply-chain risk pattern for AUR packages. This warrants MEDIUM: it is not clearly malicious, but it is an executed binary from an unofficial/vendor-only host with no reproducibility.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 source=("bt-client-${pkgver}.deb::https://download-esa.bt.cn/bt-client/bt-client-linux-${pkgver}-amd64.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt x86_64 binary .deb from download-esa.bt.cn, which is a subdomain of bt.cn (BaoTa/aaPanel, a Chinese server management panel vendor). This is the vendor's own distribution host, not a random personal server, so it is somewhat analogous to an official release host. However, the package installs a prebuilt Electron/GUI binary directly from a Chinese vendor's CDN without any source build, and the domain (download-esa.bt.cn) is not a widely recognized or audited distribution channel. A sha256 checksum is provided, which mitigates substitution risk at the specific version, but does not address trust in the upstream binary itself. The core concern is that this is an opaque, prebuilt executable from a vendor-controlled host with no source build — a classic supply-chain risk pattern for AUR packages. This warrants MEDIUM: it is not clearly malicious, but it is an executed binary from an unofficial/vendor-only host with no reproducibility.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: 堡塔 Technology Co., Ltd. <hwl@bt.cn>
    
      2# Contributor: mineleng <15119587808@163.com>
    
      3pkgname=bt-client-bin
    
      4pkgver=1.2.6
    
      5pkgrel=1
    
      6pkgdesc="堡塔多机管理"
    
      7arch=('x86_64')
    
      8url="https://www.bt.cn"
    
      9license=('Apache')
    
      10depends=(
    
      11  'gtk3'
    
      12  'libnotify'
    
      13  'nss'
    
      14  'libxss'
    
      15  'libxtst'
    
      16  'xdg-utils'
    
      17  'at-spi2-core'
    
      18  'util-linux'
    
      19  'libsecret'
    
      20  'binutils'
    
      21)
    
      22optdepends=('libappindicator-gtk3: systray indicator support')
    
      23
    
      24source=("bt-client-${pkgver}.deb::https://download-esa.bt.cn/bt-client/bt-client-linux-${pkgver}-amd64.deb")
    
      25sha256sums=('ddba7b1f6b364af450f3984dd89b3eaa3ee383d980994632dc60e438081e0f96')
    
      26
    
      27package() {
    
      28  cd "$srcdir"
    
      29  ar x "bt-client-${pkgver}.deb"
    
      30  tar -xf data.tar.xz -C "$pkgdir"
    
      31}
    
      32
    
      33

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2