ednovas-cloud

MEDIUM

maintainer Stevezxc 0 votes scanned 2026-11-01 14:00:44.307000

View on AUR

Why flagged

The package downloads prebuilt .deb binaries from a non-whitelisted, project-specific storage host; if compromised, an attacker could silently replace the executable with a malicious version, posing a supply-chain risk.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source_x86_64=("https://storage.ednovas.org/desktop/${pkgver}/EdNovas-Cloud-${pkgver}-Linux-amd64.deb")

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads prebuilt .deb binaries from a non-whitelisted, project-specific storage host; if compromised, an attacker could silently replace the executable with a malicious version, posing a supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Stevezxc <stevezhou586 at gmail dot com>
    
      2pkgname=ednovas-cloud
    
      3pkgver=1.1.90
    
      4pkgrel=1
    
      5pkgdesc="EdNovas Cloud Proxy Client. Official desktop client for EdNovas Cloud services."
    
      6arch=('x86_64' 'aarch64')
    
      7url="https://ednovas.org"
    
      8license=('Apache-2.0')
    
      9depends=('alsa-lib' 'at-spi2-core' 'cairo' 'dbus' 'expat' 'gcc-libs' 'glib2' 'glibc' 'gtk3' 'hicolor-icon-theme' 'libcups' 'libnotify' 'libsecret' 'libx11' 'libxcb' 'libxcomposite' 'libxdamage' 'libxext' 'libxfixes' 'libxkbcommon' 'libxrandr' 'libxss' 'libxtst' 'mesa' 'nspr' 'nss' 'pango' 'systemd-libs' 'util-linux-libs' 'xdg-utils')
    
      10optdepends=('libappindicator')
    
      11options=('!strip' '!debug')
    
      12source_x86_64=("https://storage.ednovas.org/desktop/${pkgver}/EdNovas-Cloud-${pkgver}-Linux-amd64.deb")
    
      13source_aarch64=("https://storage.ednovas.org/desktop/${pkgver}/EdNovas-Cloud-${pkgver}-Linux-arm64.deb")
    
      14sha512sums_x86_64=('61bed66b36369d6c3af604febba92700057469e1a969b31bda02e5eb59b8f0ae005381eee34f2f34da1ee1d6faf960449e2e21f7c643662636711b221e1b5d49')
    
      15sha512sums_aarch64=('9bb27ccb548ae58c238c70514fa8218a1dd603573bb8050c70c1d88d5323837217314b9e25fcfbb5d77bbbe32c698dd0eb412e6eb1d9a2f2adcee496b193c763')
    
      16
    
      17package(){
    
      18	tar -xJ -f data.tar.xz -C "${pkgdir}"
    
      19}
    
      20

Changes since previous scan

--- PKGBUILD @ 2026-11-01 00:21
+++ PKGBUILD @ 2026-11-01 14:00
@@ -1,6 +1,6 @@
 # Maintainer: Stevezxc <stevezhou586 at gmail dot com>
 pkgname=ednovas-cloud
-pkgver=1.1.89
+pkgver=1.1.90
 pkgrel=1
 pkgdesc="EdNovas Cloud Proxy Client. Official desktop client for EdNovas Cloud services."
 arch=('x86_64' 'aarch64')
@@ -11,8 +11,8 @@
 options=('!strip' '!debug')
 source_x86_64=("https://storage.ednovas.org/desktop/${pkgver}/EdNovas-Cloud-${pkgver}-Linux-amd64.deb")
 source_aarch64=("https://storage.ednovas.org/desktop/${pkgver}/EdNovas-Cloud-${pkgver}-Linux-arm64.deb")
-sha512sums_x86_64=('c5700a6a1112ef2d223913ce43591c1eb9310de0dd0b6371a763bb81c0149348c89f389cb31cdc83f8ee7e75b2d184369caad08d3fae4ca1d743ed4e8f93bdf8')
-sha512sums_aarch64=('ca4e400a893a190d4a391a4bc707fea19ddd094c49e146e934596ae4ac1d49f02cd9e89390e60f29c89bebc3fa98beb59d3ef1ec3fe34e59b7150207c7b9fb36')
+sha512sums_x86_64=('61bed66b36369d6c3af604febba92700057469e1a969b31bda02e5eb59b8f0ae005381eee34f2f34da1ee1d6faf960449e2e21f7c643662636711b221e1b5d49')
+sha512sums_aarch64=('9bb27ccb548ae58c238c70514fa8218a1dd603573bb8050c70c1d88d5323837217314b9e25fcfbb5d77bbbe32c698dd0eb412e6eb1d9a2f2adcee496b193c763')
 
 package(){
 	tar -xJ -f data.tar.xz -C "${pkgdir}"

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 14:00:44	Medium	2
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 13:56:02	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 13:52:19	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 13:48:00	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 13:40:12	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 13:37:25	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2