empoche

maintainer bytee · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary package (a .pacman archive containing an Electron/native application installed to /opt) from an AWS S3 bucket controlled by the upstream vendor (empoche-desktop.s3.eu-central-1.amazonaws.com). While this is the vendor's own distribution channel rather than a third-party unofficial host, it is still a prebuilt binary blob rather than source built from a verifiable VCS. The sha256sum provides integrity at the moment of packaging, but S3 objects can be silently replaced by the bucket owner at any time without changing the URL, and there is no GPG signature verification. The binary is executed directly (/opt/Empoche/empoche via a launcher script). This is a real supply-chain concern: a compromised or malicious update to the S3 object would result in arbitrary code execution on user systems with no additional verification. This pattern is common for proprietary AUR packages but still constitutes a medium-severity supply-chain risk — not a false positive.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source_x86_64=("https://empoche-desktop.s3.eu-central-1.amazonaws.com/empoche-${pkgver}.pacman")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt binary package (a .pacman archive containing an Electron/native application installed to /opt) from an AWS S3 bucket controlled by the upstream vendor (empoche-desktop.s3.eu-central-1.amazonaws.com). While this is the vendor's own distribution channel rather than a third-party unofficial host, it is still a prebuilt binary blob rather than source built from a verifiable VCS. The sha256sum provides integrity at the moment of packaging, but S3 objects can be silently replaced by the bucket owner at any time without changing the URL, and there is no GPG signature verification. The binary is executed directly (/opt/Empoche/empoche via a launcher script). This is a real supply-chain concern: a compromised or malicious update to the S3 object would result in arbitrary code execution on user systems with no additional verification. This pattern is common for proprietary AUR packages but still constitutes a medium-severity supply-chain risk — not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Yves Hoppe <contact@empoche.com>
    
      2# Maintainer: Guido de Gobbis <guido@degobbis.de>
    
      3
    
      4pkgname=empoche
    
      5pkgrel=1
    
      6pkgver=0.4.5
    
      7pkgdesc="New Time Tracking and Task Management application."
    
      8url="https://empoche.com"
    
      9provides=('empoche')
    
      10arch=('x86_64')
    
      11license=('proprietary')
    
      12depends=('libnotify' 'libappindicator-gtk3' 'libxss' 'nss')
    
      13source_x86_64=("https://empoche-desktop.s3.eu-central-1.amazonaws.com/empoche-${pkgver}.pacman")
    
      14sha256sums_x86_64=('643a3e474b6d53a8ab256066f644067c81a91d069ba7e6d48baa1a85742db662')
    
      15
    
      16package() {
    
      17    # Install in /opt
    
      18    install -d "${pkgdir}/opt"
    
      19    cp -R "${srcdir}/opt/Empoche" "${pkgdir}/opt/"
    
      20
    
      21    # Install the .desktop file
    
      22    install -D -m644 "${srcdir}/usr/share/applications/${pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      23
    
      24    # Install the icons
    
      25    for icon_size in 16 24 32 48 64 128 256 512 1024; do
    
      26        icons_dir="/usr/share/icons/hicolor/${icon_size}x${icon_size}/apps"
    
      27        install -d "${pkgdir}/${icons_dir}"
    
      28        install -m644 "${srcdir}${icons_dir}/${pkgname}.png" \
    
      29                      "${pkgdir}${icons_dir}/${pkgname}.png"
    
      30    done
    
      31
    
      32    # Add a launch script
    
      33    printf '#!/usr/bin/bash\n\nXDG_DATA_DIRS=/usr/local/share/:/usr/share/ "/opt/Empoche/empoche"' > "${srcdir}/empoche"
    
      34    install -d "${pkgdir}/usr/bin"
    
      35    install -D -m755 "${srcdir}/empoche" "${pkgdir}/usr/bin/"
    
      36}
    
      37

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2