encryptr

maintainer svantehedlund · 18 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads and installs prebuilt binaries (encryptr-bin, libffmpegsumo.so) from spideroak.com, which is actually the official vendor host for the Encryptr application (SpiderOak is the company behind Encryptr/Crypton). The URL path includes 'signed' suggesting these are vendor-signed releases. However, the binaries are not built from source and are executed directly, which is a legitimate medium-severity supply-chain concern regardless of the host being the official vendor. The sha256sums are present and pinned for all architecture-specific tarballs, which mitigates silent substitution risk. The concern is real but not elevated: it's a standard prebuilt binary AUR package from the official vendor, with checksums. This is a common AUR pattern for proprietary software distributed as binaries. The medium rating is appropriate — not high (no obfuscation, official vendor host, checksums present), not low/clean (executed binary from external host, not built from source).

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source_x86_64=("https://spideroak.com/dist/encryptr/signed/linux/targz/encryptr-${pkgver}_amd.tar.gz")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads and installs prebuilt binaries (encryptr-bin, libffmpegsumo.so) from spideroak.com, which is actually the official vendor host for the Encryptr application (SpiderOak is the company behind Encryptr/Crypton). The URL path includes 'signed' suggesting these are vendor-signed releases. However, the binaries are not built from source and are executed directly, which is a legitimate medium-severity supply-chain concern regardless of the host being the official vendor. The sha256sums are present and pinned for all architecture-specific tarballs, which mitigates silent substitution risk. The concern is real but not elevated: it's a standard prebuilt binary AUR package from the official vendor, with checksums. This is a common AUR pattern for proprietary software distributed as binaries. The medium rating is appropriate — not high (no obfuscation, official vendor host, checksums present), not low/clean (executed binary from external host, not built from source).

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Marek Petrik <marekpetrik@gmail.com>
    
      2# Prior Maintainer: Justin dray <justin@dray.be>
    
      3pkgname=encryptr
    
      4pkgver=2.0.0
    
      5pkgrel=5
    
      6pkgdesc="A zero-knowledge, cloud-based e-wallet / password manager powered by Crypton."
    
      7url="https://encryptr.org/"
    
      8arch=('i686' 'x86_64')
    
      9license=('custom')
    
      10depends=('gconf' 'gtk2')
    
      11makedepends=()
    
      12optdepents=()
    
      13backup=()
    
      14#install=${pkgname}.install
    
      15source_x86_64=("https://spideroak.com/dist/encryptr/signed/linux/targz/encryptr-${pkgver}_amd.tar.gz")
    
      16source_i686=("https://spideroak.com/dist/encryptr/signed/linux/targz/encryptr-${pkgver}_i386.tar.gz")
    
      17source=("${pkgname}.sh"
    
      18	"${pkgname}.desktop"
    
      19	"32x32.png"
    
      20	"64x64.png"
    
      21	"128x128.png"
    
      22	"256x256.png")
    
      23sha256sums=('c2497c8aa3379554d88ab3a478fb467c604a828dd4e4fa95d85e3145865618c0'
    
      24            '9ceb57496a45727653cd15121bae7aeba1661904a153e51c3d314e64715a68c8'
    
      25            '81b73f274a59e704233284053c14d956314fde2b9937cf8264a6dab049ace7fb'
    
      26            'f0979d8367759cb1aa0c727096f3312c4b4ce614bc31c133dd018838b559c73a'
    
      27            '8c87d22a2b52854c189f445757c1b959ccab571e318e30f38584035341247ee6'
    
      28            'e68796ec9378935285c2714b33ab0a0b28c1a741d2d6006419dfdd904382a9af')
    
      29sha256sums_i686=('95094f300a3ffd812c63403692dc183156431adad0491d70119bcab0d283490a')
    
      30sha256sums_x86_64=('028ff2844ee3c03f900813f24a928a040a588fab091b682f3428abf38e216fc8')
    
      31options=('!strip')
    
      32PKGEXT=.pkg.tar
    
      33
    
      34package() {
    
      35	install -dm 755 "$pkgdir/usr/lib/$pkgname"
    
      36	cd "$pkgdir/usr/lib/$pkgname"
    
      37
    
      38	install -Dm 755 "$srcdir/Encryptr/encryptr-bin" ./encryptr-bin
    
      39	install -Dm 644 "$srcdir/Encryptr/icudtl.dat" ./icudtl.dat
    
      40	install -Dm 644 "$srcdir/Encryptr/libffmpegsumo.so" ./libffmpegsumo.so
    
      41	install -Dm 644 "$srcdir/Encryptr/nw.pak" ./nw.pak
    
      42
    
      43	for size in 32x32 64x64 128x128 256x256
    
      44	do
    
      45		install -Dm 644 "$srcdir/${size}.png" "$pkgdir/usr/share/icons/hicolor/${size}/apps/encryptr.png"
    
      46	done
    
      47	install -Dm644 "$srcdir/256x256.png" "$pkgdir/usr/share/pixmaps/encryptr.png"
    
      48	ln -s '/usr/lib/libudev.so' "$pkgdir/usr/lib/$pkgname/libudev.so.0"
    
      49
    
      50	install -Dm 755 "$srcdir/encryptr.sh" "$pkgdir/usr/bin/encryptr"
    
      51	install -Dm 644 "$srcdir/encryptr.desktop" "$pkgdir/usr/share/applications/encryptr.desktop"
    
      52}
    
      53

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2