extera-next-bin
MEDIUM
maintainer rustyraven
1 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads a prebuilt binary tarball from a non-standard, non-whitelisted host (get.extera.xyz) with a skipped checksum, representing a supply-chain risk if the host is compromised or controlled by an unrelated party.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:22
"linux-x64.tar.gz::https://get.extera.xyz/v${pkgver}/linux-x64.tar.gz"
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt binary tarball from a non-standard, non-whitelisted host (get.extera.xyz) with a skipped checksum, representing a supply-chain risk if the host is compromised or controlled by an unrelated party.
PKGBUILD
1 offending line(s) highlighted
1
pkgname=extera-next-bin
2
pkgver=26.5.8
3
pkgrel=1
4
pkgdesc="A feature-rich Matrix client made in Flutter"
5
arch=('x86_64')
6
url="https://source.extera.xyz/Extera/Extera"
7
license=('AGPL-3.0-only')
8
provides=('extera-next')
9
conflicts=('extera-next')
10
depends=(
11
'gtk3'
12
'libsecret'
13
'libkeybinder3'
14
'openssl'
15
'webkit2gtk-4.1'
16
'xdg-user-dirs'
17
'ttf-roboto'
18
'ttf-roboto-mono'
19
)
20
makedepends=('curl')
21
source=(
22
"linux-x64.tar.gz::https://get.extera.xyz/v${pkgver}/linux-x64.tar.gz"
23
)
24
sha256sums=('SKIP')
25
26
pkgver() {
27
curl -s "https://source.extera.xyz/Extera/Extera/raw/branch/main/pubspec.yaml" \
28
| sed -n 's/^version: \([^+]*\).*/\1/p'
29
}
30
31
package() {
32
cd "$srcdir"
33
34
install -d "$pkgdir/usr/lib/extera_next"
35
cp -r ./* "$pkgdir/usr/lib/extera_next/"
36
37
install -d "$pkgdir/usr/bin"
38
ln -s /usr/lib/extera_next/extera_next "$pkgdir/usr/bin/extera-next"
39
40
install -d "$pkgdir/usr/share/applications"
41
cat > "$pkgdir/usr/share/applications/extera-next.desktop" <<EOF
42
[Desktop Entry]
43
Name=extera-next
44
Comment=A feature-rich Matrix client made in Flutter
45
Exec=extera-next
46
Icon=extera
47
Type=Application
48
MimeType=x-scheme-handler/matrix;
49
StartupWMClass=extera_next
50
Terminal=false
51
Categories=Network;Chat;InstantMessaging;X-Matrix;
52
EOF
53
54
if [ -f "$srcdir/data/flutter_assets/assets/logo.png" ]; then
55
install -Dm644 "$srcdir/data/flutter_assets/assets/logo.png" \
56
"$pkgdir/usr/share/pixmaps/extera.png"
57
fi
58
}
59
Changes since previous scan
--- PKGBUILD @ 2026-10-25 00:20+++ PKGBUILD @ 2026-11-01 00:21@@ -1,5 +1,5 @@ pkgname=extera-next-bin-pkgver=26.5.7+pkgver=26.5.8 pkgrel=1 pkgdesc="A feature-rich Matrix client made in Flutter" arch=('x86_64')Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Medium | 2 |
| 2026-10-31 00:07:41 | Medium | 2 |
| 2026-10-30 00:29:30 | Medium | 2 |
| 2026-10-29 00:13:55 | Medium | 2 |
| 2026-10-28 00:06:54 | Medium | 2 |
| 2026-10-27 00:23:28 | Medium | 2 |
| 2026-10-26 00:12:40 | Medium | 2 |
| 2026-10-25 21:43:05 | Medium | 2 |
| 2026-10-25 00:20:48 | Medium | 2 |
| 2026-10-24 21:41:28 | Medium | 2 |
| 2026-10-24 00:14:55 | Medium | 2 |
| 2026-10-23 00:02:19 | Medium | 2 |
| 2026-10-22 00:13:10 | Medium | 2 |
| 2026-10-21 00:12:50 | Medium | 2 |
| 2026-10-20 00:10:31 | Medium | 2 |
| 2026-10-19 00:03:55 | Medium | 2 |
| 2026-10-18 00:06:55 | Medium | 2 |
| 2026-10-17 23:20:05 | Medium | 2 |
| 2026-10-17 00:21:55 | Medium | 2 |
| 2026-10-16 00:12:47 | Medium | 2 |