dupliseek

maintainer bigpod9 · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The source tarball is fetched from Dropbox (a personal/unofficial host) rather than from the canonical GitLab repository listed in the url field. Dropbox links can be silently replaced by the owner at any time, and there is no way for a third party to verify the artifact matches the upstream source. The checksum is only MD5 (weak, collision-prone), providing minimal integrity assurance. The package installs a Python script (main.py) from this unverifiable tarball into /opt and creates a launcher in /usr/bin, meaning any malicious code in the tarball would be executed by users. This is a genuine supply-chain concern: executed code from an unofficial, swappable host with a weak checksum. The MEDIUM rating from the cheaper model is correct.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=(dupliseek.0.0.2.tar.xz::https://www.dropbox.com/s/0nf8r96lr20wnvj/dupliseek0.0.2.tar.xz?dl=1)

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The source tarball is fetched from Dropbox (a personal/unofficial host) rather than from the canonical GitLab repository listed in the url field. Dropbox links can be silently replaced by the owner at any time, and there is no way for a third party to verify the artifact matches the upstream source. The checksum is only MD5 (weak, collision-prone), providing minimal integrity assurance. The package installs a Python script (main.py) from this unverifiable tarball into /opt and creates a launcher in /usr/bin, meaning any malicious code in the tarball would be executed by users. This is a genuine supply-chain concern: executed code from an unofficial, swappable host with a weak checksum. The MEDIUM rating from the cheaper model is correct.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: bigpod9 <bigpod9@gmail.com>
    
      2pkgname=dupliseek
    
      3pkgver=0.0.2
    
      4pkgrel=7
    
      5pkgdesc="Application to find all your duplicate images."
    
      6arch=('any')
    
      7url="https://gitlab.com/magnusmj/dupliseek.git"
    
      8license=('MIT')
    
      9
    
      10depends=('python-pyqt5' 'python-numpy' 'python-imutils')
    
      11
    
      12install=dupliseek.install
    
      13source=(dupliseek.0.0.2.tar.xz::https://www.dropbox.com/s/0nf8r96lr20wnvj/dupliseek0.0.2.tar.xz?dl=1)
    
      14md5sums=('c0ff1a839dc47437d30b0e2e42ce225b')
    
      15
    
      16
    
      17package() {
    
      18    cd "$srcdir"/dupliseek
    
      19	mkdir -p "$pkgdir"/opt/dupliseek
    
      20	cp -r * "$pkgdir"/opt/dupliseek/
    
      21	mkdir -p "$pkgdir"/usr/share/applications
    
      22	cp dupliseek.desktop "$pkgdir"/usr/share/applications/
    
      23
    
      24	cd "$pkgdir"/opt/dupliseek/
    
      25	rm install_arch.sh
    
      26	rm install_fedora.sh
    
      27	rm install_ubuntu.sh
    
      28	rm -r snap-stuff
    
      29
    
      30	mkdir "$pkgdir/usr/bin/"
    
      31
    
      32	echo "/opt/dupliseek/main.py" >  "$pkgdir/usr/bin/dupliseek"
    
      33}
    
      34

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2