decentr-browser
Triggered rules
external_download_not_in_source
curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.
-
PKGBUILD:17
curl -s "https://decentr.net" | grep -oP "(?<=https://decentr.net/Ubuntu_X64_Decentr_).*(?=.zip)"
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:13
source=("https://decentr.net/Ubuntu_X64_Decentr_${pkgver}.zip")
llm_review
An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a ZIP from decentr.net (the project's own domain) containing a Debian package (.deb), then extracts and installs the prebuilt binary directly into the package directory. The sha256sum covers only the outer ZIP, not the inner .deb or its data.tar.xz, so the integrity of the actual executed binary is not independently verified. More importantly, this is a prebuilt browser binary (Chromium-based, given the structure) installed directly — not built from source — from the vendor's own host. This is a standard pattern for binary AUR packages, but the host is a small project (decentr.net) rather than a major vendor, and the package installs a full browser binary without any additional integrity checks on the extracted contents. The _pkgver() helper also makes an outbound curl to decentr.net at build time. Overall this is a legitimate medium-risk supply-chain concern: a prebuilt binary from a non-major vendor host installed without per-component integrity verification, but not clearly malicious.
PKGBUILD
2 offending line(s) highlighted# Maintainer: Ranadeep B < mail at rnbguy dot at >
pkgname=decentr-browser
pkgver=1.6.0
pkgrel=1
pkgdesc='A secure browser that gives you access to the blockchain'
arch=('x86_64')
url='https://decentr.net'
license=('Apache')
provides=($pkgname)
conflicts=($pkgname $pkgname-unstable-bin)
depends=()
source=("https://decentr.net/Ubuntu_X64_Decentr_${pkgver}.zip")
sha256sums=('b89d1ab0fa0b90bc1faf90def6f0fadd45589d4f60e0f5c75aa9c3cbb4cef1f9')
_pkgver() {
curl -s "https://decentr.net" | grep -oP "(?<=https://decentr.net/Ubuntu_X64_Decentr_).*(?=.zip)"
}
package() {
bsdtar -xf ${srcdir}/decentr-browser-stable_*_amd64.deb -C "$srcdir/"
bsdtar -xf ${srcdir}/data.tar.xz -C "$pkgdir/"
generic_path="decentr.org/decentr"
# Icons
for i in 16x16 24x24 32x32 48x48 64x64 128x128 256x256; do
install -Dm644 "$pkgdir"/opt/${generic_path}/product_logo_${i/x*/}.png \
"$pkgdir"/usr/share/icons/hicolor/$i/apps/${pkgname}.png
done
echo " -> Fixing Decentr browser desktop entry..."
sed -i \
-e "/Exec=/i\StartupWMClass=Decentr-browser" \
-e "s/x-scheme-handler\/ftp;\?//g" \
"$pkgdir"/usr/share/applications/${pkgname}.desktop
echo " -> Removing Debian Cron job, duplicate product logos and menu directory..."
rm -r \
"$pkgdir"/etc/cron.daily/ \
"$pkgdir"/opt/"$generic_path"/cron/ \
"$pkgdir"/opt/"$generic_path"/product_logo_*.{png,xpm} \
"$pkgdir"/usr/share/menu/
}
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | MEDIUM | 3 |
| 2026-08-02 00:16:08 | MEDIUM | 3 |
| 2026-08-01 00:11:18 | MEDIUM | 3 |
| 2026-07-31 00:14:10 | MEDIUM | 3 |
| 2026-07-30 00:17:23 | MEDIUM | 3 |
| 2026-07-29 00:25:53 | MEDIUM | 3 |
| 2026-07-28 00:07:28 | MEDIUM | 3 |
| 2026-07-27 00:24:32 | MEDIUM | 3 |
| 2026-07-26 00:07:32 | MEDIUM | 3 |
| 2026-07-25 00:13:44 | MEDIUM | 3 |
| 2026-07-24 00:02:28 | MEDIUM | 3 |
| 2026-07-23 00:14:47 | MEDIUM | 3 |
| 2026-07-22 00:29:32 | MEDIUM | 3 |
| 2026-07-21 00:24:15 | MEDIUM | 3 |
| 2026-07-20 00:19:49 | MEDIUM | 3 |
| 2026-07-19 00:17:08 | MEDIUM | 3 |
| 2026-07-18 00:14:48 | MEDIUM | 3 |
| 2026-07-17 00:06:16 | MEDIUM | 3 |
| 2026-07-16 00:05:41 | MEDIUM | 3 |
| 2026-07-15 00:09:25 | MEDIUM | 3 |