cia-accesa

maintainer accesa.me · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary package (pkg.tar.zst) from a personal Dropbox account with no integrity verification (md5sums='SKIP'). The binary is then extracted and installed directly into the system. This is a genuine supply-chain concern: Dropbox is not an official or verifiable release host, the link can be silently replaced at any time by the account owner or compromised, and there is no checksum to detect tampering. The package installs arbitrary prebuilt binaries into /usr without any source build or reproducibility. Additionally, the dependency on 'discord' and 'intel-oneapi-basekit' as hard dependencies is unusual and suspicious for an 'access control' application. The combination of an unverifiable binary host, skipped integrity checks, and opaque prebuilt content makes this a real medium-severity supply-chain risk.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("cia-2.1.2-1-x86_64.pkg.tar.zst::https://www.dropbox.com/scl/fi/5twjj776t99nfew3ie17i/cia-2.1.2-1-x86_64.pkg.tar.zst?rlkey=isx4fs14t2bvyx2q7sbjdv70a&dl=0")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 85%): This PKGBUILD downloads a prebuilt binary package (pkg.tar.zst) from a personal Dropbox account with no integrity verification (md5sums='SKIP'). The binary is then extracted and installed directly into the system. This is a genuine supply-chain concern: Dropbox is not an official or verifiable release host, the link can be silently replaced at any time by the account owner or compromised, and there is no checksum to detect tampering. The package installs arbitrary prebuilt binaries into /usr without any source build or reproducibility. Additionally, the dependency on 'discord' and 'intel-oneapi-basekit' as hard dependencies is unusual and suspicious for an 'access control' application. The combination of an unverifiable binary host, skipped integrity checks, and opaque prebuilt content makes this a real medium-severity supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: ACCESA <accesa.mdash@gmail.com>
    
      2pkgname=cia-accesa
    
      3pkgver=2.1.2
    
      4pkgrel=1
    
      5pkgdesc="Control Inteligente de Accesos"
    
      6arch=('x86_64')
    
      7url="https://accesa.me"
    
      8license=('GPL')
    
      9depends=('alsa-lib' 'at-spi2-core' 'cairo' 'dbus' 'desktop-file-utils' 'discord' 'expat' 'gcc-libs' 'glib2' 'glibc' 'gtk3' 'gvfs' 'hicolor-icon-theme' 'intel-oneapi-basekit' 'kde-cli-tools' 'libcups' 'libdrm' 'libnotify' 'libx11' 'libxcb' 'libxcomposite' 'libxdamage' 'libxext' 'libxfixes' 'libxrandr' 'libxtst' 'mesa' 'nspr' 'nss' 'pango' 'trash-cli' 'xdg-utils')
    
      10optdepends=('gir1.2-gnomekeyring-1.0: Description of optional feature'
    
      11            'libgnome-keyring: Another optional feature'
    
      12            'lsb-release: Yet another optional feature'
    
      13            'pulseaudio: Optional feature for sound support')
    
      14source=("cia-2.1.2-1-x86_64.pkg.tar.zst::https://www.dropbox.com/scl/fi/5twjj776t99nfew3ie17i/cia-2.1.2-1-x86_64.pkg.tar.zst?rlkey=isx4fs14t2bvyx2q7sbjdv70a&dl=0")
    
      15md5sums=('SKIP')
    
      16
    
      17package(){
    
      18    mkdir -p $pkgdir/usr/share/applications
    
      19    cp -r usr $pkgdir
    
      20}
    
      21
    
      22post_install() {
    
      23    gtk-update-icon-cache -q -t -f usr/share/icons/hicolor
    
      24    update-desktop-database -q
    
      25}
    
      26
    
      27post_upgrade() {
    
      28    post_install
    
      29}
    
      30
    
      31post_remove() {
    
      32    gtk-update-icon-cache -q -t -f usr/share/icons/hicolor
    
      33    update-desktop-database -q
    
      34}
    
      35

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2