eblanbrowser-r

maintainer twgood · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a ZIP archive from a personal/unofficial host (update.riba.click) with SKIP checksums (no integrity verification), extracts it, and executes the contained Python code (EBLAN.py) as the browser entry point. This is a genuine supply-chain risk: the host operator can silently replace the archive contents at any time with arbitrary Python code that will run with user privileges. The lack of any checksum means there is zero tamper detection. The domain 'riba.click' is not an official software distribution channel. The package installs and executes whatever Python code is in the archive, making this a real medium-severity concern rather than a false positive.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:26 "eblan-browser.zip::https://update.riba.click/eb/r/lastest.zip"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a ZIP archive from a personal/unofficial host (update.riba.click) with SKIP checksums (no integrity verification), extracts it, and executes the contained Python code (EBLAN.py) as the browser entry point. This is a genuine supply-chain risk: the host operator can silently replace the archive contents at any time with arbitrary Python code that will run with user privileges. The lack of any checksum means there is zero tamper detection. The domain 'riba.click' is not an official software distribution channel. The package installs and executes whatever Python code is in the archive, making this a real medium-severity concern rather than a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: twgood <admin@eblanbrowser.ru>
    
      2
    
      3pkgname=eblanbrowser-r
    
      4pkgver=0.1
    
      5pkgrel=1
    
      6pkgdesc="EBLAN Browser - a lightweight web browser for russian users."
    
      7arch=("any")
    
      8url="https://eblanbrowser.ru/"
    
      9license=("custom:eblan-browser")
    
      10categories=("network")
    
      11
    
      12depends=(
    
      13    "python>=3.10"
    
      14    "python-pyqt6"
    
      15    "python-pyqt6-webengine"
    
      16    "qt6-webengine"
    
      17    "python-requests"
    
      18)
    
      19
    
      20optdepends=(
    
      21    "ffmpeg: media playback"
    
      22    "nss: SSL support"
    
      23)
    
      24
    
      25source=(
    
      26    "eblan-browser.zip::https://update.riba.click/eb/r/lastest.zip"
    
      27    "eblan.desktop"
    
      28)
    
      29md5sums=('SKIP' 'SKIP')
    
      30
    
      31# Находим папку с EBLAN.py внутри распакованного архива
    
      32_find_src() {
    
      33    find "${srcdir}" -maxdepth 3 -name "EBLAN.py" | head -n1 | xargs dirname
    
      34}
    
      35
    
      36prepare() {
    
      37    _eblan_src="$(_find_src)"
    
      38    if [[ -z "$_eblan_src" ]]; then
    
      39        echo "ERROR: EBLAN.py not found inside archive"
    
      40        return 1
    
      41    fi
    
      42    msg2 "Found EBLAN.py in: $_eblan_src"
    
      43}
    
      44
    
      45package() {
    
      46    local _eblan_src
    
      47    _eblan_src="$(_find_src)"
    
      48
    
      49    # --- Копируем файлы браузера в /opt/eblan-browser ---
    
      50    install -dm755 "${pkgdir}/opt/eblan-browser"
    
      51    cp -r "${_eblan_src}/." "${pkgdir}/opt/eblan-browser/"
    
      52
    
      53    # --- Лаунчер /usr/bin/eblan ---
    
      54    install -dm755 "${pkgdir}/usr/bin"
    
      55    cat > "${pkgdir}/usr/bin/eblan" <<'EOF'
    
      56#!/usr/bin/env bash
    
      57exec python3 /opt/eblan-browser/EBLAN.py "$@"
    
      58EOF
    
      59    chmod 755 "${pkgdir}/usr/bin/eblan"
    
      60
    
      61    # --- .desktop файл ---
    
      62    install -Dm644 "${srcdir}/eblan.desktop" \
    
      63        "${pkgdir}/usr/share/applications/eblan.desktop"
    
      64
    
      65    # --- Иконки (если есть в архиве) ---
    
      66    for size in 64 128 256; do
    
      67        local icon="${_eblan_src}/images/logo${size}.png"
    
      68        if [[ -f "$icon" ]]; then
    
      69            install -Dm644 "$icon" \
    
      70                "${pkgdir}/usr/share/icons/hicolor/${size}x${size}/apps/eblan-browser.png"
    
      71        fi
    
      72    done
    
      73
    
      74}
    
      75
    
      76post_install() {
    
      77    update-desktop-database /usr/share/applications
    
      78    gtk-update-icon-cache -f /usr/share/icons/hicolor 2>/dev/null || true
    
      79}
    
      80
    
      81post_upgrade() {
    
      82    post_install
    
      83}
    
      84

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2