chfs

maintainer jay716 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads and installs a prebuilt binary executable (chfs-linux-amd64-3.1) from iscute.cn, which is the project's own official website (the url= field also points to iscute.cn/chfs). This is not a random personal host — it is the upstream vendor's own distribution site. However, iscute.cn is a small Chinese personal/commercial project site with no code-signing, no reproducible builds, and no well-known forge backing. The binary is installed directly to /usr/bin/chfs and executed by users. A sha256sum is present, which provides integrity against accidental corruption but not against a deliberate upstream substitution (the hash would need to be updated by the maintainer to catch that). The core concern is a closed-source prebuilt binary from a low-trust host with no independent verification mechanism — this is a genuine supply-chain risk pattern (medium), not a false positive, even though the host is the official upstream vendor site.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:10 source=("http://iscute.cn/tar/${pkgname}/${pkgver}/${pkgname}-linux-amd64-${pkgver}.zip")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads and installs a prebuilt binary executable (chfs-linux-amd64-3.1) from iscute.cn, which is the project's own official website (the url= field also points to iscute.cn/chfs). This is not a random personal host — it is the upstream vendor's own distribution site. However, iscute.cn is a small Chinese personal/commercial project site with no code-signing, no reproducible builds, and no well-known forge backing. The binary is installed directly to /usr/bin/chfs and executed by users. A sha256sum is present, which provides integrity against accidental corruption but not against a deliberate upstream substitution (the hash would need to be updated by the maintainer to catch that). The core concern is a closed-source prebuilt binary from a low-trust host with no independent verification mechanism — this is a genuine supply-chain risk pattern (medium), not a false positive, even though the host is the official upstream vendor site.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: jay716 <13422525511 at 163 dot com>
    
      2
    
      3pkgname=chfs
    
      4pkgver=3.1
    
      5pkgrel=2
    
      6pkgdesc="CuteHttpFileServer(CHFS) is a free, HTTP-protocol file-sharing server that is quickly accessible using a browser"
    
      7arch=('x86_64')
    
      8url='http://iscute.cn/chfs'
    
      9license=('custom')
    
      10source=("http://iscute.cn/tar/${pkgname}/${pkgver}/${pkgname}-linux-amd64-${pkgver}.zip")
    
      11sha256sums=('cf8a1787cdf84c355ef945d228f0595ccce3b325eb577a41af98180287e319c9')
    
      12
    
      13package() {
    
      14  cd "${srcdir}"
    
      15
    
      16  install -D -m755 "${srcdir}/chfs-linux-amd64-${pkgver}" "${pkgdir}/usr/bin/chfs"
    
      17}
    
      18
    
      19

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2