compassonpremise

maintainer roma_aw · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt .deb from a non-whitelisted, project-specific update domain (update.getcompass.ru), which is not a standard code hosting platform; this creates a supply-chain risk if the domain is compromised or controlled by an untrusted party, as the binary is not built from source and the checksum, while present, is not independently verifiable against upstream.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source_x86_64=("https://update.getcompass.ru/electron/onpremise-compass/30/${pkgver}/compass_linux_amd64.deb")

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb from a non-whitelisted, project-specific update domain (update.getcompass.ru), which is not a standard code hosting platform; this creates a supply-chain risk if the domain is compromised or controlled by an untrusted party, as the binary is not built from source and the checksum, while present, is not independently verifiable against upstream.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Roman <roma_aw at icloud dot com>
    
      2# Contributor: Roman <roma_aw at icloud dot com>
    
      3
    
      4pkgname=compassonpremise
    
      5pkgver=6.11.15
    
      6pkgrel=1
    
      7pkgdesc="A messaging app. A messenger for working with and managing teams"
    
      8arch=('x86_64')
    
      9url="https://getcompass.com"
    
      10license=('Redistributable, no modification permitted')
    
      11depends=('alsa-lib' 'at-spi2-core' 'cairo' 'dbus' 'expat' 'gcc-libs' 'glib2' 'glibc' 'gtk3' 'libcups' 'libdrm' 'libnotify' 'libx11' 'libxcb' 'libxcomposite' 'libxdamage' 'libxext' 'libxfixes' 'libxkbcommon' 'libxrandr' 'libxtst' 'mesa' 'nspr' 'nss' 'pango')
    
      12optdepends=('libappindicator-gtk3')
    
      13options=('!strip' '!emptydirs')
    
      14install=${pkgname}.install
    
      15source_x86_64=("https://update.getcompass.ru/electron/onpremise-compass/30/${pkgver}/compass_linux_amd64.deb")
    
      16sha512sums_x86_64=('1e7a8f89d0c33f356a082fd0170ad7a69e39f8cc6894162df1cd8cf12b0477e325a2755ca4818b391d37a345715bcde8d668e369293e798490304092512ef76f')
    
      17
    
      18package(){
    
      19	# Extract package data
    
      20	tar -xJ -f data.tar.xz -C "${pkgdir}"
    
      21}
    
      22

Changes since previous scan

--- PKGBUILD @ 2026-07-31 00:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -2,7 +2,7 @@
 # Contributor: Roman <roma_aw at icloud dot com>
 
 pkgname=compassonpremise
-pkgver=6.11.13
+pkgver=6.11.15
 pkgrel=1
 pkgdesc="A messaging app. A messenger for working with and managing teams"
 arch=('x86_64')
@@ -13,7 +13,7 @@
 options=('!strip' '!emptydirs')
 install=${pkgname}.install
 source_x86_64=("https://update.getcompass.ru/electron/onpremise-compass/30/${pkgver}/compass_linux_amd64.deb")
-sha512sums_x86_64=('e74f330de156f9fd986e5f5ac6cc18e53bdf4ace4848022ada3b9397596c1277a8b99b87cc284ae84daefeb8894252283da45853f4342def2d22467307ec267a')
+sha512sums_x86_64=('1e7a8f89d0c33f356a082fd0170ad7a69e39f8cc6894162df1cd8cf12b0477e325a2755ca4818b391d37a345715bcde8d668e369293e798490304092512ef76f')
 
 package(){
 	# Extract package data

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 11:17:50	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2