clone-tracker

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt AppImage binary directly from clonetracker.com (the project's own domain), extracts it, and installs the contents. This is a standard pattern for proprietary AppImage-based AUR packages. The sha256sum is pinned, which mitigates casual tampering. The main concern is that this is a closed-source binary from a commercial vendor's own domain — not an unofficial or personal host — so the supply-chain risk is the same as any other proprietary binary package (e.g. zoom, slack, discord in the AUR). The cheaper model's 'non-whitelisted host' concern is a false positive in the sense that clonetracker.com is the canonical upstream. However, the package installs an opaque, unauditable proprietary binary with broad system access (webkit2gtk, GTK3, etc.), which is a genuine medium-level concern by AUR standards: executed binary from a non-open-source, single-vendor host with no source transparency. This is not high (no obfuscation, no exfiltration evidence, no unofficial mirror), but medium is defensible given the fully closed binary nature and the fact that the vendor is not a well-known entity.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:23 source=("https://clonetracker.com/dl/clone-tracker_${pkgver}_amd64.AppImage")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt AppImage binary directly from clonetracker.com (the project's own domain), extracts it, and installs the contents. This is a standard pattern for proprietary AppImage-based AUR packages. The sha256sum is pinned, which mitigates casual tampering. The main concern is that this is a closed-source binary from a commercial vendor's own domain — not an unofficial or personal host — so the supply-chain risk is the same as any other proprietary binary package (e.g. zoom, slack, discord in the AUR). The cheaper model's 'non-whitelisted host' concern is a false positive in the sense that clonetracker.com is the canonical upstream. However, the package installs an opaque, unauditable proprietary binary with broad system access (webkit2gtk, GTK3, etc.), which is a genuine medium-level concern by AUR standards: executed binary from a non-open-source, single-vendor host with no source transparency. This is not high (no obfuscation, no exfiltration evidence, no unofficial mirror), but medium is defensible given the fully closed binary nature and the fact that the vendor is not a well-known entity.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Asuka Minato <youremail@domain.com>
    
      2pkgname=clone-tracker
    
      3pkgver=1.22.0
    
      4pkgrel=1
    
      5pkgdesc="コピペコードに悩まされてきた開発環境へスマートなコード管理を実現"
    
      6arch=(x86_64)
    
      7url="https://clonetracker.com"
    
      8license=('custom')
    
      9depends=(webkit2gtk
    
      10	libsoup
    
      11	gdk-pixbuf2
    
      12	bash
    
      13	glibc
    
      14	pango
    
      15	gtk3
    
      16	zlib
    
      17	perl
    
      18	gcc-libs
    
      19	glib2
    
      20	cairo
    
      21	hicolor-icon-theme
    
      22)
    
      23source=("https://clonetracker.com/dl/clone-tracker_${pkgver}_amd64.AppImage")
    
      24sha256sums=('286359478deffbef57e2653f40a8e4eb18adb34686e47d2be7bc792b83b0df0c')
    
      25options=(!emptydirs)
    
      26
    
      27prepare() {
    
      28	chmod +x ./*.AppImage
    
      29	./*.AppImage --appimage-extract
    
      30	pushd squashfs-root
    
      31	rm usr/lib/lib*
    
      32	rm -r usr/share/glib-2.0
    
      33	rm usr/bin/xdg-open
    
      34	rm -r usr/lib/x86_64-linux-gnu/{gtk-3.0,gdk-pixbuf-2.0,webkit2gtk-4.0,gio}
    
      35	find . -xtype l -delete
    
      36	find . -name "*.desktop" -print -exec sed -i 's/Exec=.*/Exec=GDK_BACKEND=x11 clone-tracker/' {} \;
    
      37	popd
    
      38	rm *.AppImage
    
      39}
    
      40
    
      41package() {
    
      42	cp -av $srcdir/squashfs-root/usr $pkgdir
    
      43}
    
      44

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2