eosctl

MEDIUM

maintainer k1f0 0 votes scanned 2026-10-06 00:13:36.889724

View on AUR

Why flagged

The package downloads a prebuilt executable from a non-whitelisted, project-owned host with a fixed checksum, but the source is a binary blob that could be unverifiable and silently replaced upstream, posing a supply-chain risk.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package downloads a prebuilt executable from a non-whitelisted, project-owned host with a fixed checksum, but the source is a binary blob that could be unverifiable and silently replaced upstream, posing a supply-chain risk.

PKGBUILD

      1# Maintainer: k1f0 <archlinux at k1f0.mozmail.com>
    
      2
    
      3case "$CARCH" in
    
      4  x86_64) _debarch="amd64" ;;
    
      5  aarch64) _debarch="arm64" ;;
    
      6esac
    
      7
    
      8pkgname=eosctl
    
      9pkgver=0.12.1
    
      10pkgrel=1
    
      11pkgdesc='Software for managing EOS Cloud.'
    
      12depends=('bash-completion')
    
      13arch=('x86_64' 'aarch64')
    
      14url='https://dl.eoscloud.io/eosctl'
    
      15source=("${pkgname}-${pkgver}::${url}/archives/v${pkgver}/eosctl_${pkgver}_linux_${_debarch}.pacman")
    
      16sha256sums=('834515950fc072854cbd629148ba1cc77b12a7ddc88fb3daf756ad53b7c3084a')
    
      17options=(!debug !lto)
    
      18
    
      19package() {
    
      20  bsdtar -xf "${srcdir}/${pkgname}-${pkgver}" -C "$pkgdir"
    
      21
    
      22  # remove package metadata
    
      23  rm -rf "${pkgdir}/.PKGINFO" \
    
      24    "${pkgdir}/.MTREE" \
    
      25    "${pkgdir}/.BUILDINFO" \
    
      26    "${pkgdir}/.INSTALL" \
    
      27    "${pkgdir}/.CHANGELOG"
    
      28}
    
      29

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-06 00:13:36	Medium	2
2026-10-05 23:40:58	Low	1