eis-bin

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary from a personal self-hosted Gitea instance (git.hering.sh) — specifically a CI job artifact — and installs it directly as an executable. There is no source compilation, no reproducible build, and the host is a personal server controlled solely by the maintainer. While the sha256sum provides integrity against accidental corruption, it offers no protection if the maintainer intentionally replaces the binary or if the server is compromised and the hash updated. The artifact URL references a specific CI job ID (496), which is somewhat pinned, but the binary itself is opaque. This is a classic supply-chain concern: an executed binary from an unofficial/personal host with no independent verification path. The cheaper model's MEDIUM rating is correct.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("$pkgname-$pkgver-$pkgrel::https://git.hering.sh/finn/eis/-/jobs/496/artifacts/raw/bin/eis")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 85%): This PKGBUILD downloads a prebuilt binary from a personal self-hosted Gitea instance (git.hering.sh) — specifically a CI job artifact — and installs it directly as an executable. There is no source compilation, no reproducible build, and the host is a personal server controlled solely by the maintainer. While the sha256sum provides integrity against accidental corruption, it offers no protection if the maintainer intentionally replaces the binary or if the server is compromised and the hash updated. The artifact URL references a specific CI job ID (496), which is somewhat pinned, but the binary itself is opaque. This is a classic supply-chain concern: an executed binary from an unofficial/personal host with no independent verification path. The cheaper model's MEDIUM rating is correct.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Finn Hering <finn at hering dot sh>
    
      2pkgname=eis-bin
    
      3_pkgname=eis
    
      4pkgver="1.0.1"
    
      5pkgrel=4
    
      6pkgdesc="Eis is a simple to use command line interface which allows you to use Christian R.'s elearning platform. This package is a forked version of eis which includes some fixes"
    
      7arch=('x86_64')
    
      8url="https://git.hering.sh/finn/eis"
    
      9license=('MIT')
    
      10provides=(eis)
    
      11source=("$pkgname-$pkgver-$pkgrel::https://git.hering.sh/finn/eis/-/jobs/496/artifacts/raw/bin/eis")
    
      12noextract=('eis')
    
      13sha256sums=('d045fe2120cdf8ac0c411a95252b36a2f1d67b74537733622ed3be900d10d5f9')
    
      14
    
      15package() {
    
      16    install -Dm755 "$pkgname-$pkgver-$pkgrel" "${pkgdir}/usr/bin/${_pkgname}"
    
      17}
    
      18

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2