enpass

MEDIUM

maintainer swiftscythe 1 votes scanned 2026-10-31 00:07:41.364992

View on AUR

Why flagged

The package downloads a prebuilt .deb from a non-whitelisted host (apt.enpass.io), which is not a standard or widely trusted distribution endpoint, posing a supply-chain risk if the host were compromised or the download redirected.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 source=("https://apt.enpass.io/pool/main/e/enpass/${pkgname}_${pkgver}_amd64.deb"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb from a non-whitelisted host (apt.enpass.io), which is not a standard or widely trusted distribution endpoint, posing a supply-chain risk if the host were compromised or the download redirected.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Adrià Arrufat <adria.arrufat@gmail.com>
    
      2#
    
      3# Check for a new release with:
    
      4#   curl -so- https://apt.enpass.io/dists/stable/main/binary-amd64/Packages.gz | zcat | grep -E "Package|Version|SHA256" | head -n 3
    
      5
    
      6pkgname=enpass
    
      7pkgver=6.12.6.2258
    
      8pkgrel=1
    
      9pkgdesc='Cross-platform password manager'
    
      10arch=('x86_64')
    
      11url='https://www.enpass.io/'
    
      12license=('LicenseRef-Enpass-EULA')
    
      13depends=('brotli' 'curl' 'dbus' 'fontconfig' 'freetype2' 'gcc-libs' 'gdk-pixbuf2'
    
      14         'glib2' 'glibc' 'gtk3' 'hicolor-icon-theme' 'libcups' 'libglvnd'
    
      15         'libpsl' 'libx11' 'libxkbcommon' 'lsof' 'pango' 'util-linux-libs'
    
      16         'wayland' 'xz' 'zlib')
    
      17optdepends=('gnome-shell: keep the Enpass Assistant window on top (bundled extension)'
    
      18            'xdg-utils: open links in the default browser')
    
      19conflicts=('enpass-bin' 'enpass-beta')
    
      20source=("https://apt.enpass.io/pool/main/e/enpass/${pkgname}_${pkgver}_amd64.deb"
    
      21        'LICENSE')
    
      22sha256sums=('a98d2ff0d6ad392311022453598e59dcc2b9042cf9a001f0bf35e95aed5c3457'
    
      23            '8780f525e9cda983443286ed4be35d152a1ca062e09ec69977e52fd6227e3ce4')
    
      24# Upstream ships stripped binaries; stripping again breaks the browser extension's
    
      25# native messaging host.
    
      26options=('!strip')
    
      27
    
      28package() {
    
      29    # The .deb was built as uid 1000, so drop its ownership or the installed
    
      30    # files end up owned by whatever local user has that uid.
    
      31    bsdtar -xf data.tar.* -C "$pkgdir" --no-same-owner
    
      32    chmod -R u+rwX,go+rX,go-w "$pkgdir"
    
      33
    
      34    install -d "$pkgdir/usr/bin"
    
      35    ln -s /opt/enpass/Enpass "$pkgdir/usr/bin/enpass"
    
      36
    
      37    # GNOME Shell extension. Upstream's postinst copies the variant matching the
    
      38    # running shell; the "legacy" one targets GNOME 40-44, which Arch no longer
    
      39    # ships, so only the ES-module variant is installed. Enable it with:
    
      40    #   gnome-extensions enable enpass-assistant@enpass.io
    
      41    local uuid='enpass-assistant@enpass.io'
    
      42    install -Dm644 -t "$pkgdir/usr/share/gnome-shell/extensions/$uuid" \
    
      43        "$pkgdir/usr/share/enpass/gnome-extension/modern/"{extension.js,metadata.json}
    
      44    rm -r "$pkgdir/usr/share/enpass"
    
      45
    
      46    install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      47}
    
      48

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2
2026-10-13 00:23:45	Medium	2
2026-10-12 00:18:51	Medium	2