delta-walker-bin

maintainer alex.henrie · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary tarball from an S3 bucket (s3.amazonaws.com/deltawalker). While S3 is a legitimate AWS hosting service and this appears to be the official DeltaWalker distribution channel (matching the vendor's domain), S3 buckets can be misconfigured, taken over, or the bucket name could be squatted if ever abandoned. The sha256sum is pinned, which mitigates substitution attacks significantly. The real concern is that this is a closed-source prebuilt binary being installed system-wide — there is no way to audit what the binary does, and the source is not the vendor's primary website but an S3 bucket. This is a standard medium-risk pattern for binary AUR packages: not clearly malicious, but the combination of unauditable prebuilt binary + S3 hosting (rather than a versioned GitHub release or official download page with checksum verification) warrants medium. The sha256 pinning reduces but does not eliminate the risk (it only protects against future substitution, not against the current binary being malicious).

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("https://s3.amazonaws.com/deltawalker/DeltaWalker-$pkgver-Linux.tar.gz"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary tarball from an S3 bucket (s3.amazonaws.com/deltawalker). While S3 is a legitimate AWS hosting service and this appears to be the official DeltaWalker distribution channel (matching the vendor's domain), S3 buckets can be misconfigured, taken over, or the bucket name could be squatted if ever abandoned. The sha256sum is pinned, which mitigates substitution attacks significantly. The real concern is that this is a closed-source prebuilt binary being installed system-wide — there is no way to audit what the binary does, and the source is not the vendor's primary website but an S3 bucket. This is a standard medium-risk pattern for binary AUR packages: not clearly malicious, but the combination of unauditable prebuilt binary + S3 hosting (rather than a versioned GitHub release or official download page with checksum verification) warrants medium. The sha256 pinning reduces but does not eliminate the risk (it only protects against future substitution, not against the current binary being malicious).

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Alex Henrie <alexhenrie24@gmail.com>
    
      2pkgname=delta-walker-bin
    
      3pkgver=2.6.3
    
      4pkgrel=1
    
      5pkgdesc='File and folder comparison and synchronization'
    
      6arch=('x86_64')
    
      7url='https://www.deltawalker.com/'
    
      8license=('custom')
    
      9depends=('gtk3' 'jre11-openjdk')
    
      10provides=("delta-walker=${pkgver}")
    
      11conflicts=('delta-walker')
    
      12source=("https://s3.amazonaws.com/deltawalker/DeltaWalker-$pkgver-Linux.tar.gz"
    
      13        "local://delta-walker.desktop")
    
      14sha256sums=('56bcd3fb938701ec3e4a8c6063044c90ddb315ad4dabc00d0914669166935390'
    
      15            'SKIP')
    
      16
    
      17prepare() {
    
      18	sed -i 's!jre/lib/amd64/server/libjvm.so!/usr/lib/jvm/java-11-openjdk/lib/server/libjvm.so!' DeltaWalker.ini
    
      19}
    
      20
    
      21package() {
    
      22	mkdir -p "$pkgdir/opt/delta-walker"
    
      23	cp -r DeltaWalker DeltaWalker.ini configuration features icon.xpm p2 plugins "$pkgdir/opt/delta-walker"
    
      24
    
      25	mkdir -p "$pkgdir/usr/bin"
    
      26	ln -s /opt/delta-walker/DeltaWalker "$pkgdir/usr/bin/DeltaWalker"
    
      27
    
      28	mkdir -p "$pkgdir/usr/share/applications"
    
      29	cp delta-walker.desktop "$pkgdir/usr/share/applications"
    
      30}
    
      31

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2