chaskis

maintainer xforever1313 · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary .deb from a personal/project host (files.shendrick.net) rather than an official distribution channel or the upstream GitHub releases page. The .deb contains compiled C# binaries and native libraries (libhostfxr.so etc.) that are directly installed and executed. There is no PGP signature verification (validpgpkeys is empty), only a sha256 checksum, meaning integrity depends entirely on the hash being correct and the host not being compromised. This is a genuine supply-chain concern: if the personal hosting domain is taken over or the artifact is swapped, users would install and run arbitrary code. The pattern is similar to the msbuild AUR package it references, which is itself a known compromise in packaging hygiene. The sha256 provides some protection against in-transit tampering but not against the host owner substituting the artifact. This is a real medium-severity supply-chain risk, not a false positive.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 source=("https://files.shendrick.net/projects/chaskis/releases/$pkgver/debian/chaskis.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from a personal/project host (files.shendrick.net) rather than an official distribution channel or the upstream GitHub releases page. The .deb contains compiled C# binaries and native libraries (libhostfxr.so etc.) that are directly installed and executed. There is no PGP signature verification (validpgpkeys is empty), only a sha256 checksum, meaning integrity depends entirely on the hash being correct and the host not being compromised. This is a genuine supply-chain concern: if the personal hosting domain is taken over or the artifact is swapped, users would install and run arbitrary code. The pattern is similar to the msbuild AUR package it references, which is itself a known compromise in packaging hygiene. The sha256 provides some protection against in-transit tampering but not against the host owner substituting the artifact. This is a real medium-severity supply-chain risk, not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Seth Hendrick <seth@shendrick.net>
    
      2
    
      3# This format is taken from msbuild, which also grabs a compiled .deb and installs it from that.
    
      4# https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=msbuild-stable
    
      5# We do this because of https://github.com/mono/mono/issues/9280.  Arch linux's msbuild package
    
      6# doesn't include MSBuildSdkResolver and libhostfxr.so.  So, this is the best we can do without
    
      7# user having to install all kinds of weird things that are not in the AUR or in pacman.
    
      8
    
      9pkgname=chaskis
    
      10pkgver=0.31.0
    
      11pkgrel=1
    
      12pkgdesc="A generic framework written in C# for making IRC Bots."
    
      13arch=('any')
    
      14url="https://github.com/xforever1313/Chaskis/"
    
      15license=('BSL')
    
      16depends=('dotnet-runtime>=3.1.0')
    
      17provides=('chaskis')
    
      18conflicts=('chaskis')
    
      19source=("https://files.shendrick.net/projects/chaskis/releases/$pkgver/debian/chaskis.deb")
    
      20sha256sums=('af69ea79de547aa50d1729f3ae04ea8cbbc90c9b818f338e886e83c736a81053')
    
      21validpgpkeys=()
    
      22
    
      23package() {
    
      24    cd "${srcdir}"
    
      25
    
      26    bsdtar xf data.tar.xz
    
      27
    
      28    chmod -R g-w usr
    
      29    mv usr "${pkgdir}"
    
      30}
    
      31
    
      32

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2