finkeeper24-bin

maintainer Voland_White · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt .deb binary containing a bundled JRE (jpackage build) from finkeeper24.ru, which is the upstream vendor's own domain but is a small, personal/indie project site rather than a well-known platform. The binary is extracted and installed directly to /opt/finkeeper24 and executed. The sha256sum is pinned, which mitigates casual substitution, but the host is a single-operator Russian domain with no independent verification chain (no GitHub releases, no reproducible build, no signing). The bundled JRE means a large amount of executed native code is pulled from this single source. This is a classic medium-severity supply-chain concern: not clearly malicious, but an executed binary from an unofficial/personal host with no secondary trust anchor.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 source=("finkeeper24-${pkgver}.deb::https://finkeeper24.ru/downloads/linux/finkeeper24_${pkgver}_amd64.deb"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 78%): The PKGBUILD downloads a prebuilt .deb binary containing a bundled JRE (jpackage build) from finkeeper24.ru, which is the upstream vendor's own domain but is a small, personal/indie project site rather than a well-known platform. The binary is extracted and installed directly to /opt/finkeeper24 and executed. The sha256sum is pinned, which mitigates casual substitution, but the host is a single-operator Russian domain with no independent verification chain (no GitHub releases, no reproducible build, no signing). The bundled JRE means a large amount of executed native code is pulled from this single source. This is a classic medium-severity supply-chain concern: not clearly malicious, but an executed binary from an unofficial/personal host with no secondary trust anchor.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Vladimir <racerkafa@gmail.com>
    
      2
    
      3pkgname=finkeeper24-bin
    
      4pkgver=2.2.1
    
      5pkgrel=1
    
      6pkgdesc="FinKeeper24 - менеджер личных финансов (Personal Finance Manager)"
    
      7arch=('x86_64')
    
      8url="https://finkeeper24.ru"
    
      9license=('Apache-2.0')
    
      10# Графические зависимости (Arch-аналоги Depends из .deb).
    
      11# Java не нужна — в пакете свой встроенный JRE 17 (сборка через jpackage).
    
      12depends=('alsa-lib' 'brotli' 'libbsd' 'bzip2' 'glibc' 'expat' 'fontconfig'
    
      13         'freetype2' 'libglvnd' 'libmd' 'libpng' 'libx11' 'libxau' 'libxcb'
    
      14         'libxdmcp' 'libxext' 'libxi' 'libxrender' 'libxtst' 'xdg-utils' 'zlib')
    
      15provides=('finkeeper24')
    
      16conflicts=('finkeeper24')
    
      17# Не трогаем готовые бинарники апстрима
    
      18options=('!strip')
    
      19source=("finkeeper24-${pkgver}.deb::https://finkeeper24.ru/downloads/linux/finkeeper24_${pkgver}_amd64.deb"
    
      20        "LICENSE-Apache-2.0::https://www.apache.org/licenses/LICENSE-2.0.txt")
    
      21sha256sums=('0618506a52ec8f2dc9f6488fc0d6fe89fac608936919a42c150276065b3b5dcf'
    
      22            'cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30')
    
      23
    
      24package() {
    
      25	# Содержимое .deb (makepkg уже распаковал data.tar.* (любое сжатие) в srcdir)
    
      26	bsdtar -xf "${srcdir}"/data.tar.* -C "${pkgdir}/"
    
      27
    
      28	# Ярлык в меню (свой, с нормальной категорией — в апстримном стоит Unknown)
    
      29	install -d "${pkgdir}/usr/share/applications"
    
      30	cat > "${pkgdir}/usr/share/applications/finkeeper24.desktop" <<'EOF'
    
      31[Desktop Entry]
    
      32Name=FinKeeper24
    
      33Comment=Менеджер личных финансов
    
      34Exec=/opt/finkeeper24/bin/FinKeeper24
    
      35Icon=/opt/finkeeper24/lib/FinKeeper24.png
    
      36Terminal=false
    
      37Type=Application
    
      38Categories=Office;Finance;
    
      39# App ID, который окно Compose Desktop репортит на Wayland (= имя главного класса
    
      40# ru.homebudget.finkeeper.MainKt). Должен совпадать с ним, иначе Dock (Niri/DMS)
    
      41# не сопоставит окно с .desktop → дефолтная иконка и кривое имя.
    
      42StartupWMClass=ru-homebudget-finkeeper-MainKt
    
      43EOF
    
      44
    
      45	# Запуск командой finkeeper24
    
      46	install -d "${pkgdir}/usr/bin"
    
      47	ln -s /opt/finkeeper24/bin/FinKeeper24 "${pkgdir}/usr/bin/finkeeper24"
    
      48
    
      49	# Лицензия
    
      50	install -Dm644 "${srcdir}/LICENSE-Apache-2.0" \
    
      51		"${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      52}
    
      53

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2