fastnet-bin

MEDIUM

maintainer taotieren 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The PKGBUILD downloads a prebuilt binary tarball from fw0.koolcenter.com, which is a third-party host (a Chinese router firmware/software community site) rather than an official upstream release host (e.g., GitHub releases, PyPI, etc.). The binary is then installed directly as an executable. While a sha256sum is provided, this only protects against accidental corruption or a CDN swap — it does not protect against the original host having served a malicious binary, nor does it provide any code transparency. The source is a closed binary with no source code available for audit. This is a genuine medium-severity supply-chain concern: an executed binary from a non-official, non-whitelisted personal/community host with no reproducibility or source audit possible.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source=("https://fw0.koolcenter.com/binary/fastnet/${_name}-binary-raw-${pkgver}.tar.gz")

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary tarball from fw0.koolcenter.com, which is a third-party host (a Chinese router firmware/software community site) rather than an official upstream release host (e.g., GitHub releases, PyPI, etc.). The binary is then installed directly as an executable. While a sha256sum is provided, this only protects against accidental corruption or a CDN swap — it does not protect against the original host having served a malicious binary, nor does it provide any code transparency. The source is a closed binary with no source code available for audit. This is a genuine medium-severity supply-chain concern: an executed binary from a non-official, non-whitelisted personal/community host with no reproducibility or source audit possible.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: taotieren <admin@taotieren.com>
    
      2
    
      3pkgbase=fastnet-bin
    
      4pkgname=fastnet-bin
    
      5_name=${pkgname%-bin}
    
      6pkgver=0.7.6
    
      7pkgrel=1
    
      8pkgdesc="FastNet -- Goal: Make a full-platform speed measurement software! - TUI"
    
      9arch=($CARCH)
    
      10url="https://www.koolcenter.com/t/topic/9148"
    
      11license=('LicenseRef-fastnet')
    
      12provides=(${pkgbase%-bin})
    
      13conflicts=(${pkgbase%-bin})
    
      14depends=()
    
      15makedepends=()
    
      16optdepends=()
    
      17source=("https://fw0.koolcenter.com/binary/fastnet/${_name}-binary-raw-${pkgver}.tar.gz")
    
      18sha256sums=('98a4272ea1b086f7ff7ef09e666283f4e37eb6b8c6ede8ba5d4ca87cf5f2b361')
    
      19options=(!debug !strip)
    
      20
    
      21package() {
    
      22    cd "${srcdir}/${_name}-binary-raw-${pkgver}/"
    
      23    if [ ${CARCH} = "x86_64" ]; then
    
      24        install -vDm755 ${_name}.x86_64 ${pkgdir}/usr/bin/${_name}
    
      25    elif [ ${CARCH} = "aarch64" ]; then
    
      26        install -vDm755 ${_name}.aarch64 ${pkgdir}/usr/bin/${_name}
    
      27    elif [ ${CARCH} = "armv7h" ]; then
    
      28        install -vDm755 ${_name}.arm ${pkgdir}/usr/bin/${_name}
    
      29    fi
    
      30}
    
      31

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2