clipd-bin

maintainer orphaned · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt closed-source binary (.deb) from apt.clipber.com, which is the vendor's own APT repository rather than a generic personal host. The sha256sum is pinned, which mitigates casual tampering, but the binary is not reproducible or independently verifiable — it is a proprietary executable with a custom license pointing to clipber.com. The dependency list (mosquitto, z3, imagemagick, libev, libevdev) suggests a complex application with significant system access. The host is the official vendor APT mirror, so this is not a random personal host, but it is still an unofficial/vendor-controlled binary blob being installed on an Arch system. This is a genuine medium-severity supply-chain concern: if the vendor's APT host is compromised or the vendor acts maliciously, the binary executes with user privileges and has access to clipboard data. The sha256 pin provides some protection against passive MITM but not against the vendor pushing a new version to the same URL (though the version is pinned in the URL here). Overall this is a legitimate medium: prebuilt proprietary binary from a vendor-controlled host, not clearly malicious but not independently verifiable.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("${_pkgname}_${pkgver}_amd64.deb::https://apt.clipber.com/debian/pool/main/c/clipd/clipd_1.0.1_amd64.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt closed-source binary (.deb) from apt.clipber.com, which is the vendor's own APT repository rather than a generic personal host. The sha256sum is pinned, which mitigates casual tampering, but the binary is not reproducible or independently verifiable — it is a proprietary executable with a custom license pointing to clipber.com. The dependency list (mosquitto, z3, imagemagick, libev, libevdev) suggests a complex application with significant system access. The host is the official vendor APT mirror, so this is not a random personal host, but it is still an unofficial/vendor-controlled binary blob being installed on an Arch system. This is a genuine medium-severity supply-chain concern: if the vendor's APT host is compromised or the vendor acts maliciously, the binary executes with user privileges and has access to clipboard data. The sha256 pin provides some protection against passive MITM but not against the vendor pushing a new version to the same URL (though the version is pinned in the URL here). Overall this is a legitimate medium: prebuilt proprietary binary from a vendor-controlled host, not clearly malicious but not independently verifiable.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: WhriedPlanck
    
      2
    
      3pkgname=clipd-bin
    
      4_pkgname=clipd
    
      5pkgver=1.0.1
    
      6pkgrel=1
    
      7pkgdesc="Clipd is a simple secure and cross-platform cloud clipboard application"
    
      8arch=(x86_64)
    
      9url="https://clipber.com"
    
      10license=('custom: clipber.com')
    
      11depends=('libnghttp2>=1.40.0' 'libbsd>=0.10.0' 'libev>=4.31' 'libevdev>=1.9.0' 'icu>=66.1'
    
      12         'libpng>=1.6.37' 'openssl>=1.1.1.f' 'libjpeg-turbo' 'libtiff>=4.1.0' 'libzip>=1.5.1'
    
      13	 'imagemagick>=6.9.10' 'mosquitto>=1.6.9' 'z3>=4.8.7')
    
      14source=("${_pkgname}_${pkgver}_amd64.deb::https://apt.clipber.com/debian/pool/main/c/clipd/clipd_1.0.1_amd64.deb")
    
      15sha256sums=('4d7db9bbc92c5f1c315e88910417322192170657305d5d4085d24af8b0982187')
    
      16
    
      17package() {
    
      18    cd "${srcdir}"
    
      19    bsdtar --acls --xattrs -xpf data.tar.xz -C "${pkgdir}"
    
      20
    
      21    cd "${pkgdir}"
    
      22    find . -type d -exec chmod 755 {} +
    
      23    chmod 755 usr/local/bin/clipd
    
      24    rm -rf "${pkgdir}"/usr/local/share/man
    
      25
    
      26    ln -sf /usr/lib/libicuuc.so "${pkgdir}"/usr/local/lib/libicuuc.so.66
    
      27    ln -sf /usr/lib/libicui18n.so "${pkgdir}"/usr/local/lib/libicui18n.so.66
    
      28    ln -sf /usr/lib/libMagickCore-7.Q16HDRI.so "${pkgdir}"/usr/local/lib/libMagickCore-6.Q16.so.6
    
      29    ln -sf /usr/lib/libMagickWand-7.Q16HDRI.so "${pkgdir}"/usr/local/lib/libMagickWand-6.Q16.so.6
    
      30    ln -sf /usr/lib/libMagick++-7.Q16HDRI.so "${pkgdir}"/usr/local/lib/libMagick++-6.Q16.so.8
    
      31}
    
      32

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2