discloud-cli-bin

maintainer orphaned · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

broken

Why flagged The PKGBUILD downloads a shell installer script from a GitHub Pages host (discloud.github.io) and executes it directly during the build() phase. This is a real supply-chain concern: the script is fetched from a personal/project GitHub Pages domain rather than a versioned release artifact, and its behavior is opaque — it could install binaries anywhere, phone home, or do other things outside the package() function's control. The package() function is essentially empty ('echo UwU'), meaning nothing is actually installed into $pkgdir, making this broken as a proper PKGBUILD. The sha256sum provides some integrity guarantee for the specific script version, but GitHub Pages content can be updated at any time by the repo owner, and the checksum would only catch changes after the PKGBUILD was written. Executing a downloaded installer script in build() rather than properly extracting and placing files is both a security concern (medium severity supply-chain risk from an unofficial host running arbitrary code) and makes the package non-functional as an Arch package.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("linux::https://discloud.github.io/cli-rust/installer/linux")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 85%): The PKGBUILD downloads a shell installer script from a GitHub Pages host (discloud.github.io) and executes it directly during the build() phase. This is a real supply-chain concern: the script is fetched from a personal/project GitHub Pages domain rather than a versioned release artifact, and its behavior is opaque — it could install binaries anywhere, phone home, or do other things outside the package() function's control. The package() function is essentially empty ('echo UwU'), meaning nothing is actually installed into $pkgdir, making this broken as a proper PKGBUILD. The sha256sum provides some integrity guarantee for the specific script version, but GitHub Pages content can be updated at any time by the repo owner, and the checksum would only catch changes after the PKGBUILD was written. Executing a downloaded installer script in build() rather than properly extracting and placing files is both a security concern (medium severity supply-chain risk from an unofficial host running arbitrary code) and makes the package non-functional as an Arch package.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Sencyy <sencyy@pm.me>
    
      2pkgname='discloud-cli-bin'
    
      3pkgver=1.1.1
    
      4pkgrel=1
    
      5pkgdesc="Blazingly fast Discloud CLI to host your apps."
    
      6arch=("x86_64")
    
      7url="https://discloudbot.com/"
    
      8license=('Apache')
    
      9depends=('curl' 'bash')
    
      10makedepends=('unzip')
    
      11provides=("discloud")
    
      12install="UwU"
    
      13source=("linux::https://discloud.github.io/cli-rust/installer/linux")
    
      14sha256sums=("ba8fe34943c81f79c1591be26d73835929a70b363066ac70806a79a23580103a")
    
      15
    
      16build() {
    
      17	chmod +x linux
    
      18	./linux
    
      19}
    
      20
    
      21package() {
    
      22	echo "UwU"
    
      23
    
      24}
    
      25

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2