eitaa-bin

maintainer ased.mammad · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary tarball directly from eitaa.com (an Iranian messaging platform) and installs it as an executable. While eitaa.com is the official vendor site for this app, the binary is not built from source, meaning users must fully trust the vendor's distribution infrastructure. The sha256sum provides integrity against tampering in transit but not against a malicious upstream binary. This is a classic 'binary blob from vendor' pattern — common in AUR (e.g., google-chrome, discord, zoom) but those are from well-known major vendors with established security practices. Eitaa is a lesser-known platform, but it is the official upstream vendor for this app, so this is not an 'unofficial or personal host' scenario. The risk is the standard prebuilt-binary supply-chain concern: if eitaa.com serves a malicious binary, users are compromised. This warrants medium severity — it's a real concern but not evidence of active malice.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 "Eitaa-linux-$pkgver.tar.xz::https://eitaa.com/app/desktop/linux"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt binary tarball directly from eitaa.com (an Iranian messaging platform) and installs it as an executable. While eitaa.com is the official vendor site for this app, the binary is not built from source, meaning users must fully trust the vendor's distribution infrastructure. The sha256sum provides integrity against tampering in transit but not against a malicious upstream binary. This is a classic 'binary blob from vendor' pattern — common in AUR (e.g., google-chrome, discord, zoom) but those are from well-known major vendors with established security practices. Eitaa is a lesser-known platform, but it is the official upstream vendor for this app, so this is not an 'unofficial or personal host' scenario. The risk is the standard prebuilt-binary supply-chain concern: if eitaa.com serves a malicious binary, users are compromised. This warrants medium severity — it's a real concern but not evidence of active malice.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Ased Mammad <mammad.ased@gmail.com>
    
      2# Maintainer: Mahdi Mirzadeh <mahdi@mirzadeh.pro>
    
      3
    
      4pkgname=eitaa-bin
    
      5pkgver=4.3.3
    
      6pkgrel=2
    
      7license=('Custom')
    
      8pkgdesc="Official Desktop version of Eitaa messaging app - Static binaries"
    
      9depends=()
    
      10makedepends=()
    
      11provides=('Eitaa')
    
      12arch=('x86_64')
    
      13url="https://eitaa.com"
    
      14source=(
    
      15  "Eitaa-linux-$pkgver.tar.xz::https://eitaa.com/app/desktop/linux"
    
      16  "com.eitaa.desktop"
    
      17  "eitaa.svg"
    
      18)
    
      19
    
      20sha256sums=(
    
      21  '7e6920381c385758e6de1a49157a600c0c71d12b370eeb338389a3a946802eb4'
    
      22  '6bf04092a60ef81317d53258ea9def8a096d6e066ef8922ed9233c2e91a5d93a'
    
      23  '9bbf5bb323260eefdd85082ef45a2174252601ae910bd3b26f7f0b3c1bfa6e14'
    
      24)
    
      25
    
      26package() {
    
      27  install -Dm755 -t "${pkgdir}/usr/bin" \
    
      28      ./Eitaa
    
      29  install -Dm644 -t "${pkgdir}/usr/share/icons" \
    
      30      ./eitaa.svg
    
      31  install -Dm644 -t "${pkgdir}/usr/share/applications" \
    
      32      ./com.eitaa.desktop
    
      33}
    
      34

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2