cap-bin

MEDIUM

maintainer spinualexandru 0 votes scanned 2026-10-29 13:54:38.883394

View on AUR

Why flagged

Installs a prebuilt binary .deb from cdn.crabnebula.app, a third-party CDN not directly controlled by the project's own infrastructure; while CrabNebula is a known Tauri distribution service and the checksum is pinned, the URL uses '/latest/' which means the checksum could become stale if the version variable drifts, and the binary is unverifiable beyond the stated hash — a swapped CDN artifact would silently execute arbitrary code on the user's system.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:45 source=("$pkgname-$pkgver.deb::https://cdn.crabnebula.app/download/cap/cap/latest/Cap_${pkgver}_amd64.deb"

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Installs a prebuilt binary .deb from cdn.crabnebula.app, a third-party CDN not directly controlled by the project's own infrastructure; while CrabNebula is a known Tauri distribution service and the checksum is pinned, the URL uses '/latest/' which means the checksum could become stale if the version variable drifts, and the binary is unverifiable beyond the stated hash — a swapped CDN artifact would silently execute arbitrary code on the user's system.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Alexandru Spinu <spinualexandru@outlook.com>
    
      2
    
      3# Mirrors upstream's scripts/build-linux-arch-package.sh, but downloads the .deb
    
      4pkgname=cap-bin
    
      5_pkgname=cap
    
      6# Version of the bundled libonnxruntime.so.1, only used to fetch its license
    
      7_onnxver=1.24.3
    
      8pkgver=0.6.2
    
      9pkgrel=1
    
      10pkgdesc='Screen recording with Studio, Instant, and screenshot modes'
    
      11arch=('x86_64')
    
      12url='https://cap.so'
    
      13# Cap is AGPL-3.0-only and MIT; the bundled ffmpeg is built with --enable-gpl --enable-version3,
    
      14# libheif is LGPL-3.0-or-later and onnxruntime is MIT
    
      15license=('AGPL-3.0-only AND MIT AND GPL-3.0-or-later AND LGPL-3.0-or-later')
    
      16depends=(
    
      17  'alsa-lib'
    
      18  'alsa-plugins'
    
      19  'glibc'
    
      20  'hicolor-icon-theme'
    
      21  'libgcc'
    
      22  'libglvnd'
    
      23  'libpipewire'
    
      24  'libpulse'
    
      25  'libstdc++'
    
      26  'libva'
    
      27  'libx11'
    
      28  'libxkbcommon'
    
      29  'libxkbcommon-x11'
    
      30  'openssl'
    
      31  'vulkan-icd-loader'
    
      32  'wayland'
    
      33  'xdg-desktop-portal'
    
      34  'xdg-utils'
    
      35)
    
      36optdepends=(
    
      37  'xdg-desktop-portal-hyprland: screen capture on Hyprland and Omarchy'
    
      38  'vulkan-driver: hardware accelerated recording and editing'
    
      39)
    
      40provides=("$_pkgname=$pkgver")
    
      41conflicts=("$_pkgname")
    
      42# Upstream binaries are already stripped and bundle their own ffmpeg/onnxruntime
    
      43options=('!strip' '!debug')
    
      44# CrabNebula only serves the current release under /latest/
    
      45source=("$pkgname-$pkgver.deb::https://cdn.crabnebula.app/download/cap/cap/latest/Cap_${pkgver}_amd64.deb"
    
      46        "LICENSE-$pkgver::https://raw.githubusercontent.com/CapSoftware/Cap/cap-v$pkgver/LICENSE"
    
      47        "LICENSE-MIT-$pkgver::https://raw.githubusercontent.com/CapSoftware/Cap/cap-v$pkgver/licenses/LICENSE-MIT"
    
      48        "LICENSE-onnxruntime-$_onnxver::https://raw.githubusercontent.com/microsoft/onnxruntime/v$_onnxver/LICENSE")
    
      49noextract=("$pkgname-$pkgver.deb")
    
      50sha256sums=('4e7427eb7a46a1ef567419bbca7a82c356746baa51eed7f622a283ad8d223868'
    
      51            '146364c489e69407a2deaf7621a872339bde0be46d8db6495a51f3d63d95c8dc'
    
      52            '8078cb8be22f999ac72697dc96d930031203d18a52f22edd8f20b0f9f4defc1a'
    
      53            '2f07c72751aed99790b8a4869cf2311df85a860b22ded05fa22803587a48922c')
    
      54
    
      55package() {
    
      56  bsdtar -xOf "$srcdir/$pkgname-$pkgver.deb" 'data.tar*' | bsdtar -xf - -C "$pkgdir"
    
      57  for _binary in Cap cap-cli cap-muxer; do
    
      58    test -x "$pkgdir/usr/bin/$_binary"
    
      59  done
    
      60
    
      61  # Tells Cap's updater to point users at their package manager instead of the .deb
    
      62  printf 'arch\n' > "$pkgdir/usr/lib/cap/package-format"
    
      63
    
      64  install -Dm644 "LICENSE-$pkgver" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      65  install -Dm644 "LICENSE-MIT-$pkgver" "$pkgdir/usr/share/licenses/$pkgname/LICENSE-MIT"
    
      66  install -Dm644 "LICENSE-onnxruntime-$_onnxver" \
    
      67    "$pkgdir/usr/share/licenses/$pkgname/LICENSE-onnxruntime"
    
      68}
    
      69

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-29 13:54:38	Medium	3
2026-10-29 13:52:19	Medium	3