darkmx

maintainer lostmason · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary tarball from download.darkmx.app, which is the project's own official download host (matching the upstream URL darkmx.app). The sha256 checksum is verified. However, the core concern remains: a prebuilt closed-source binary is being downloaded and installed directly — the source is not compiled from auditable code. The binary is also patched at install time with patchelf to inject a custom shared library (darkmx-pixbuf-fix.so) built from a local C source. While the C source itself is included in the PKGBUILD sources and is checksum-verified, the combination of an opaque prebuilt binary + runtime library injection is a legitimate medium-severity supply-chain concern. The host appears to be the official vendor host, which reduces (but does not eliminate) the risk compared to a random personal host. This is a standard pattern for proprietary/closed-source AUR packages, but the lack of source availability and the binary patching keep it at medium rather than clean.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source_x86_64=("https://download.darkmx.app/${pkgname}-${pkgver}-linux64.tar.gz")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt binary tarball from download.darkmx.app, which is the project's own official download host (matching the upstream URL darkmx.app). The sha256 checksum is verified. However, the core concern remains: a prebuilt closed-source binary is being downloaded and installed directly — the source is not compiled from auditable code. The binary is also patched at install time with patchelf to inject a custom shared library (darkmx-pixbuf-fix.so) built from a local C source. While the C source itself is included in the PKGBUILD sources and is checksum-verified, the combination of an opaque prebuilt binary + runtime library injection is a legitimate medium-severity supply-chain concern. The host appears to be the official vendor host, which reduces (but does not eliminate) the risk compared to a random personal host. This is a standard pattern for proprietary/closed-source AUR packages, but the lack of source availability and the binary patching keep it at medium rather than clean.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: lostmason <lostmason@tutamail.com>
    
      2# Contributor: cyprus187 <cyprus187 AT noreply DOT archlinux DOT org>
    
      3# Contributor: santost12 <santost12 AT noreply DOT archlinux DOT org>
    
      4
    
      5pkgname=darkmx
    
      6pkgver=1.42
    
      7pkgrel=2
    
      8pkgdesc="Decentralized communication app that utilizes Tor hidden services to allow you to easily have an anonymous, reliable, and censorship-resistant presence on the internet."
    
      9arch=('x86_64')
    
      10url='https://darkmx.app/'
    
      11license=('custom:darkmx')
    
      12depends=('gtk3' 'libpng' 'dbus-glib')
    
      13makedepends=('patchelf')
    
      14optdepends=('gconf: for shell integration')
    
      15source=('LICENSE'
    
      16        'darkmx-pixbuf-fix.c')
    
      17source_x86_64=("https://download.darkmx.app/${pkgname}-${pkgver}-linux64.tar.gz")
    
      18sha256sums=('c4adbd46bfdeaf329fa03c578960b157f211a3626c532ae168be9d60514ef0d0'
    
      19            'dbf214252dc6b687064dc35c9dd4a9f036a4c38f616007b40bc5f0643657782b')
    
      20sha256sums_x86_64=('7608510f48df3289f6d16449ccf2e62b724d6f8058826bcf12c4c62c7efb00ce')
    
      21
    
      22build() {
    
      23  gcc -shared -fPIC -o darkmx-pixbuf-fix.so "$srcdir/darkmx-pixbuf-fix.c" \
    
      24    $(pkg-config --cflags --libs gdk-pixbuf-2.0 libpng) -ldl
    
      25}
    
      26
    
      27package() {
    
      28  cd "$srcdir/$pkgname-${pkgver}-linux64"
    
      29
    
      30  install -Dm755 $pkgname "$pkgdir/usr/bin/$pkgname"
    
      31  install -Dm755 "$srcdir/darkmx-pixbuf-fix.so" \
    
      32    "$pkgdir/usr/lib/$pkgname/darkmx-pixbuf-fix.so"
    
      33
    
      34  patchelf --add-rpath /usr/lib/$pkgname \
    
      35    --add-needed darkmx-pixbuf-fix.so \
    
      36    "$pkgdir/usr/bin/$pkgname"
    
      37
    
      38  install -Dm644 $pkgname.png \
    
      39    "$pkgdir/usr/share/icons/hicolor/48x48/apps/$pkgname.png"
    
      40  install -Dm644 $pkgname.desktop \
    
      41    "$pkgdir/usr/share/applications/$pkgname.desktop"
    
      42  install -Dm644 ../LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      43}
    
      44

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2