finkeeper24-bin
MEDIUM
maintainer Voland_White
0 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads a prebuilt .deb binary from a non-whitelisted, project-owned host (finkeeper24.ru), which is an unverifiable executable artifact that could be silently swapped, representing a supply-chain risk.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:19
source=("finkeeper24-${pkgver}.deb::https://finkeeper24.ru/downloads/linux/finkeeper24_${pkgver}_amd64.deb"
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb binary from a non-whitelisted, project-owned host (finkeeper24.ru), which is an unverifiable executable artifact that could be silently swapped, representing a supply-chain risk.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Vladimir <racerkafa@gmail.com>
2
3
pkgname=finkeeper24-bin
4
pkgver=2.2.3
5
pkgrel=1
6
pkgdesc="FinKeeper24 - менеджер личных финансов (Personal Finance Manager)"
7
arch=('x86_64')
8
url="https://finkeeper24.ru"
9
license=('Apache-2.0')
10
# Графические зависимости (Arch-аналоги Depends из .deb).
11
# Java не нужна — в пакете свой встроенный JRE 17 (сборка через jpackage).
12
depends=('alsa-lib' 'brotli' 'libbsd' 'bzip2' 'glibc' 'expat' 'fontconfig'
13
'freetype2' 'libglvnd' 'libmd' 'libpng' 'libx11' 'libxau' 'libxcb'
14
'libxdmcp' 'libxext' 'libxi' 'libxrender' 'libxtst' 'xdg-utils' 'zlib')
15
provides=('finkeeper24')
16
conflicts=('finkeeper24')
17
# Не трогаем готовые бинарники апстрима
18
options=('!strip')
19
source=("finkeeper24-${pkgver}.deb::https://finkeeper24.ru/downloads/linux/finkeeper24_${pkgver}_amd64.deb"
20
"LICENSE-Apache-2.0::https://www.apache.org/licenses/LICENSE-2.0.txt")
21
sha256sums=('d54a274050756ae9c392296421e64bb068471ad39e04c04b043c289c0674caf3'
22
'cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30')
23
24
package() {
25
# Содержимое .deb (makepkg уже распаковал data.tar.* (любое сжатие) в srcdir)
26
bsdtar -xf "${srcdir}"/data.tar.* -C "${pkgdir}/"
27
28
# Ярлык в меню (свой, с нормальной категорией — в апстримном стоит Unknown)
29
install -d "${pkgdir}/usr/share/applications"
30
cat > "${pkgdir}/usr/share/applications/finkeeper24.desktop" <<'EOF'
31
[Desktop Entry]
32
Name=FinKeeper24
33
Comment=Менеджер личных финансов
34
Exec=/opt/finkeeper24/bin/FinKeeper24
35
Icon=/opt/finkeeper24/lib/FinKeeper24.png
36
Terminal=false
37
Type=Application
38
Categories=Office;Finance;
39
# App ID, который окно Compose Desktop репортит на Wayland (= имя главного класса
40
# ru.homebudget.finkeeper.MainKt). Должен совпадать с ним, иначе Dock (Niri/DMS)
41
# не сопоставит окно с .desktop → дефолтная иконка и кривое имя.
42
StartupWMClass=ru-homebudget-finkeeper-MainKt
43
EOF
44
45
# Запуск командой finkeeper24
46
install -d "${pkgdir}/usr/bin"
47
ln -s /opt/finkeeper24/bin/FinKeeper24 "${pkgdir}/usr/bin/finkeeper24"
48
49
# Лицензия
50
install -Dm644 "${srcdir}/LICENSE-Apache-2.0" \
51
"${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
52
}
53
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Medium | 2 |
| 2026-10-31 00:07:41 | Medium | 2 |
| 2026-10-30 00:29:30 | Medium | 2 |
| 2026-10-29 00:13:55 | Medium | 2 |
| 2026-10-28 00:06:54 | Medium | 2 |
| 2026-10-27 00:23:28 | Medium | 2 |
| 2026-10-26 00:12:40 | Medium | 2 |
| 2026-10-25 00:20:48 | Medium | 2 |
| 2026-10-24 00:14:55 | Medium | 2 |
| 2026-10-23 00:02:19 | Medium | 2 |
| 2026-10-22 00:13:10 | Medium | 2 |
| 2026-10-21 00:12:50 | Medium | 2 |
| 2026-10-20 00:10:31 | Medium | 2 |
| 2026-10-19 00:03:55 | Medium | 2 |
| 2026-10-18 00:06:55 | Medium | 2 |
| 2026-10-17 00:21:55 | Medium | 2 |
| 2026-10-16 00:12:47 | Medium | 2 |
| 2026-10-15 00:28:05 | Medium | 2 |
| 2026-10-14 00:06:47 | Medium | 2 |
| 2026-10-13 00:23:45 | Medium | 2 |