dayjournal-bin

maintainer JoeBlakeB · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary .deb package and supporting assets from Dropbox personal share links. The core concern is that Dropbox share links are controlled by the account holder and can be silently replaced at any time — the sha256sums provide integrity checking at the time of writing, but the host is not an official vendor release server or a recognized mirror. The binary extracted from the .deb is installed directly as an executable (/usr/bin/dayjournal), making this a real supply-chain risk: if the Dropbox link were ever replaced (account compromise, maintainer error, or deliberate substitution), a malicious binary could be distributed. This is a textbook medium-severity AUR pattern: prebuilt binary from an unofficial/personal hosting service. The sha256sums do mitigate the risk somewhat but do not eliminate the concern about the hosting choice. No obfuscation, no exfiltration, no piracy indicators observed.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("https://www.dropbox.com/s/7d6e8fqb6g6frwk/dayjournal_$pkgver-1_amd64.deb?dl=1"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): This PKGBUILD downloads a prebuilt binary .deb package and supporting assets from Dropbox personal share links. The core concern is that Dropbox share links are controlled by the account holder and can be silently replaced at any time — the sha256sums provide integrity checking at the time of writing, but the host is not an official vendor release server or a recognized mirror. The binary extracted from the .deb is installed directly as an executable (/usr/bin/dayjournal), making this a real supply-chain risk: if the Dropbox link were ever replaced (account compromise, maintainer error, or deliberate substitution), a malicious binary could be distributed. This is a textbook medium-severity AUR pattern: prebuilt binary from an unofficial/personal hosting service. The sha256sums do mitigate the risk somewhat but do not eliminate the concern about the hosting choice. No obfuscation, no exfiltration, no piracy indicators observed.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Ivan Semkin (ivan at semkin dot ru)
    
      2
    
      3appname=DayJournal
    
      4pkgname=dayjournal-bin
    
      5_pkgname=dayjournal
    
      6pkgver=23.0.8
    
      7pkgrel=2
    
      8pkgdesc='A minimalistic digital journal that lets the content you create outlast DayJournal itself'
    
      9arch=('any')
    
      10url='https://burnsoftware.wordpress.com/dayjournal/'
    
      11license=('GPL3')
    
      12depends=('gdk-pixbuf2' 'libgee' 'glib2' 'gtk3' 'libnotify' 'pango')
    
      13provides=('dayjournal')
    
      14conflicts=('dayjournal')
    
      15
    
      16source=("https://www.dropbox.com/s/7d6e8fqb6g6frwk/dayjournal_$pkgver-1_amd64.deb?dl=1"
    
      17        'https://www.dropbox.com/s/n6dat5amsbwin7a/dayjournal.png?dl=1'
    
      18        'https://www.dropbox.com/s/u5db0221flvrupm/dayjournal.desktop?dl=1')
    
      19sha256sums=('d39c27fd6d4463144807fadeaeb1c2c1328a4acc77a8c8a8fa955b62bd42eb46'
    
      20            '901d182afa6c838077cb163edb80d1e76e23f3bdd9f436797d82a7f7560ac664'
    
      21            '1c2e09afd5fc1c6b5ac4b1fd807b1827462a89d824f0c09f5689b8a81dee294a')
    
      22
    
      23package() {
    
      24  tar -xJf data.tar.xz ./usr/bin/dayjournal
    
      25  
    
      26  install -d "${pkgdir}/usr/bin"
    
      27  install -d "${pkgdir}/usr/share/applications"
    
      28  install -d "${pkgdir}/usr/share/icons" 
    
      29  
    
      30  install -m755 "${srcdir}/usr/bin/${_pkgname}" "${pkgdir}/usr/bin/${_pkgname}"
    
      31  install -m644 "${srcdir}/${_pkgname}.png?dl=1" "${pkgdir}/usr/share/icons/${_pkgname}.png"
    
      32  install -m644 "${srcdir}/${_pkgname}.desktop?dl=1" "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      33}
    
      34# vim:set ts=2 sw=2 et:
    
      35

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2