fido2-manage-bin

MEDIUM

maintainer windy 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package installs a prebuilt .deb from GitHub releases, which is an unverifiable executable binary; while GitHub is a plausible project host, the binary nature and lack of source build introduces a supply-chain risk if the release asset were swapped.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt .deb from GitHub releases, which is an unverifiable executable binary; while GitHub is a plausible project host, the binary nature and lack of source build introduces a supply-chain risk if the release asset were swapped.

PKGBUILD

      1# Maintainer: Stephan Windmüller <arch at freewarepoint dot de>
    
      2pkgname=fido2-manage-bin
    
      3pkgver=0.2.1
    
      4pkgrel=1
    
      5pkgdesc="A command-line tool for managing FIDO2 security keys"
    
      6arch=('x86_64')
    
      7url="https://www.token2.com/site/page/fido2-token-management-tool-fido2-manage-exe"
    
      8license=('BSD-2-Clause')
    
      9depends=('gtk3' 'pcsclite' 'webkit2gtk-4.1')
    
      10provides=("${pkgname%-bin}")
    
      11conflicts=("${pkgname%-bin}")
    
      12source=("https://github.com/token2/${pkgname%-bin}/releases/download/${pkgver}/Token2-key-manager_${pkgver}_amd64.deb")
    
      13sha256sums=('787ec7cdaae7dcd1e0daacc7beaf39f7d729e0c706dc336b0d8710b0a25ec146')
    
      14
    
      15package() {
    
      16  bsdtar xf data.tar.zst -C "$pkgdir/"
    
      17}
    
      18

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 23:59:16	Medium	2