fastnet-bin

maintainer taotieren · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary tarball from fw0.koolcenter.com, which is a third-party host (a Chinese router firmware/software community site) rather than an official upstream release host (e.g., GitHub releases, PyPI, etc.). The binary is then installed directly as an executable. While a sha256sum is provided, this only protects against accidental corruption or a CDN swap — it does not protect against the original host having served a malicious binary, nor does it provide any code transparency. The source is a closed binary with no source code available for audit. This is a genuine medium-severity supply-chain concern: an executed binary from a non-official, non-whitelisted personal/community host with no reproducibility or source audit possible.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source=("https://fw0.koolcenter.com/binary/fastnet/${_name}-binary-raw-${pkgver}.tar.gz")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary tarball from fw0.koolcenter.com, which is a third-party host (a Chinese router firmware/software community site) rather than an official upstream release host (e.g., GitHub releases, PyPI, etc.). The binary is then installed directly as an executable. While a sha256sum is provided, this only protects against accidental corruption or a CDN swap — it does not protect against the original host having served a malicious binary, nor does it provide any code transparency. The source is a closed binary with no source code available for audit. This is a genuine medium-severity supply-chain concern: an executed binary from a non-official, non-whitelisted personal/community host with no reproducibility or source audit possible.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: taotieren <admin@taotieren.com>
    
      2
    
      3pkgbase=fastnet-bin
    
      4pkgname=fastnet-bin
    
      5_name=${pkgname%-bin}
    
      6pkgver=0.7.6
    
      7pkgrel=1
    
      8pkgdesc="FastNet -- Goal: Make a full-platform speed measurement software! - TUI"
    
      9arch=($CARCH)
    
      10url="https://www.koolcenter.com/t/topic/9148"
    
      11license=('LicenseRef-fastnet')
    
      12provides=(${pkgbase%-bin})
    
      13conflicts=(${pkgbase%-bin})
    
      14depends=()
    
      15makedepends=()
    
      16optdepends=()
    
      17source=("https://fw0.koolcenter.com/binary/fastnet/${_name}-binary-raw-${pkgver}.tar.gz")
    
      18sha256sums=('98a4272ea1b086f7ff7ef09e666283f4e37eb6b8c6ede8ba5d4ca87cf5f2b361')
    
      19options=(!debug !strip)
    
      20
    
      21package() {
    
      22    cd "${srcdir}/${_name}-binary-raw-${pkgver}/"
    
      23    if [ ${CARCH} = "x86_64" ]; then
    
      24        install -vDm755 ${_name}.x86_64 ${pkgdir}/usr/bin/${_name}
    
      25    elif [ ${CARCH} = "aarch64" ]; then
    
      26        install -vDm755 ${_name}.aarch64 ${pkgdir}/usr/bin/${_name}
    
      27    elif [ ${CARCH} = "armv7h" ]; then
    
      28        install -vDm755 ${_name}.arm ${pkgdir}/usr/bin/${_name}
    
      29    fi
    
      30}
    
      31

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2