echeai-cli-git

maintainer gameplayer · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary tarball (pkg.tar.gz) from a personal/unofficial domain (echeai.chimmie.k.vu) with 'SKIP' for the checksum, meaning no integrity verification is performed. The tarball is extracted and its contents are installed directly into the system, including executables placed in /usr/bin/. This is a genuine supply-chain concern: the host is a personal domain with no verifiable trust anchor, the checksum is skipped so any substitution would go undetected, and the installed artifacts are executed binaries. The pkgver() function uses the SHA256 of the downloaded tarball as a version string, which is a creative but insufficient substitute for a proper integrity check since it only records what was downloaded, not what was expected. The package also uses 'any' architecture despite installing binaries, which is suspicious. These factors combine to a real medium-severity supply-chain risk.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:35 "https://echeai.chimmie.k.vu/packages/zst/pkg.tar.gz"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): This PKGBUILD downloads a prebuilt binary tarball (pkg.tar.gz) from a personal/unofficial domain (echeai.chimmie.k.vu) with 'SKIP' for the checksum, meaning no integrity verification is performed. The tarball is extracted and its contents are installed directly into the system, including executables placed in /usr/bin/. This is a genuine supply-chain concern: the host is a personal domain with no verifiable trust anchor, the checksum is skipped so any substitution would go undetected, and the installed artifacts are executed binaries. The pkgver() function uses the SHA256 of the downloaded tarball as a version string, which is a creative but insufficient substitute for a proper integrity check since it only records what was downloaded, not what was expected. The package also uses 'any' architecture despite installing binaries, which is suspicious. These factors combine to a real medium-severity supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Chimmie Firefly <gameplayer2019pl (at) tutamail (dot) com>
    
      2pkgname=echeai-cli-git
    
      3_pkgname=echeai-cli-git
    
      4pkgver=0
    
      5pkgrel=1
    
      6pkgdesc='Provides a CLI access to Echedey ChatAI Service.'
    
      7
    
      8arch=(
    
      9	'any'
    
      10)
    
      11
    
      12url="https://echeai.chimmie.k.vu"
    
      13license=('MIT')
    
      14
    
      15depends=(
    
      16    'sed'
    
      17    'curl'
    
      18    'coreutils'
    
      19    'jq'
    
      20)
    
      21
    
      22makedepends=(
    
      23    'pacman'
    
      24)
    
      25
    
      26provides=(
    
      27	'echeai-cli'
    
      28)
    
      29
    
      30conflicts=(
    
      31	'echeai-cli'
    
      32)
    
      33
    
      34source=(
    
      35    "https://echeai.chimmie.k.vu/packages/zst/pkg.tar.gz"
    
      36)
    
      37
    
      38noextract=("pkg.tar.gz")
    
      39
    
      40sha256sums=(
    
      41    'SKIP'
    
      42)
    
      43
    
      44pkgver() {
    
      45    cd "${srcdir}"
    
      46    echo 'r'"$(sha256sum pkg.tar.gz | cut -d ' ' -f 1)"
    
      47}
    
      48
    
      49build() {
    
      50	cd "${srcdir}"
    
      51	tar -xvf pkg.tar.gz
    
      52    mv default-fs "${pkgname}"
    
      53    
    
      54}
    
      55
    
      56package() {
    
      57    cd "${srcdir}"
    
      58	cd "${srcdir}/${pkgname}"
    
      59    mkdir -p "${pkgdir}" 2>/dev/null 3>&2
    
      60    cp -rv * "${pkgdir}/"
    
      61    chmod +x "${pkgdir}"/usr/bin/*
    
      62}
    
      63

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2