finkeeper24-bin

MEDIUM

maintainer Voland_White 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The PKGBUILD downloads a prebuilt .deb binary containing a bundled JRE (jpackage build) from finkeeper24.ru, which is the upstream vendor's own domain but is a small, personal/indie project site rather than a well-known platform. The binary is extracted and installed directly to /opt/finkeeper24 and executed. The sha256sum is pinned, which mitigates casual substitution, but the host is a single-operator Russian domain with no independent verification chain (no GitHub releases, no reproducible build, no signing). The bundled JRE means a large amount of executed native code is pulled from this single source. This is a classic medium-severity supply-chain concern: not clearly malicious, but an executed binary from an unofficial/personal host with no secondary trust anchor.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 source=("finkeeper24-${pkgver}.deb::https://finkeeper24.ru/downloads/linux/finkeeper24_${pkgver}_amd64.deb"

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 78%): The PKGBUILD downloads a prebuilt .deb binary containing a bundled JRE (jpackage build) from finkeeper24.ru, which is the upstream vendor's own domain but is a small, personal/indie project site rather than a well-known platform. The binary is extracted and installed directly to /opt/finkeeper24 and executed. The sha256sum is pinned, which mitigates casual substitution, but the host is a single-operator Russian domain with no independent verification chain (no GitHub releases, no reproducible build, no signing). The bundled JRE means a large amount of executed native code is pulled from this single source. This is a classic medium-severity supply-chain concern: not clearly malicious, but an executed binary from an unofficial/personal host with no secondary trust anchor.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Vladimir <racerkafa@gmail.com>
    
      2
    
      3pkgname=finkeeper24-bin
    
      4pkgver=2.2.1
    
      5pkgrel=1
    
      6pkgdesc="FinKeeper24 - менеджер личных финансов (Personal Finance Manager)"
    
      7arch=('x86_64')
    
      8url="https://finkeeper24.ru"
    
      9license=('Apache-2.0')
    
      10# Графические зависимости (Arch-аналоги Depends из .deb).
    
      11# Java не нужна — в пакете свой встроенный JRE 17 (сборка через jpackage).
    
      12depends=('alsa-lib' 'brotli' 'libbsd' 'bzip2' 'glibc' 'expat' 'fontconfig'
    
      13         'freetype2' 'libglvnd' 'libmd' 'libpng' 'libx11' 'libxau' 'libxcb'
    
      14         'libxdmcp' 'libxext' 'libxi' 'libxrender' 'libxtst' 'xdg-utils' 'zlib')
    
      15provides=('finkeeper24')
    
      16conflicts=('finkeeper24')
    
      17# Не трогаем готовые бинарники апстрима
    
      18options=('!strip')
    
      19source=("finkeeper24-${pkgver}.deb::https://finkeeper24.ru/downloads/linux/finkeeper24_${pkgver}_amd64.deb"
    
      20        "LICENSE-Apache-2.0::https://www.apache.org/licenses/LICENSE-2.0.txt")
    
      21sha256sums=('0618506a52ec8f2dc9f6488fc0d6fe89fac608936919a42c150276065b3b5dcf'
    
      22            'cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30')
    
      23
    
      24package() {
    
      25	# Содержимое .deb (makepkg уже распаковал data.tar.* (любое сжатие) в srcdir)
    
      26	bsdtar -xf "${srcdir}"/data.tar.* -C "${pkgdir}/"
    
      27
    
      28	# Ярлык в меню (свой, с нормальной категорией — в апстримном стоит Unknown)
    
      29	install -d "${pkgdir}/usr/share/applications"
    
      30	cat > "${pkgdir}/usr/share/applications/finkeeper24.desktop" <<'EOF'
    
      31[Desktop Entry]
    
      32Name=FinKeeper24
    
      33Comment=Менеджер личных финансов
    
      34Exec=/opt/finkeeper24/bin/FinKeeper24
    
      35Icon=/opt/finkeeper24/lib/FinKeeper24.png
    
      36Terminal=false
    
      37Type=Application
    
      38Categories=Office;Finance;
    
      39# App ID, который окно Compose Desktop репортит на Wayland (= имя главного класса
    
      40# ru.homebudget.finkeeper.MainKt). Должен совпадать с ним, иначе Dock (Niri/DMS)
    
      41# не сопоставит окно с .desktop → дефолтная иконка и кривое имя.
    
      42StartupWMClass=ru-homebudget-finkeeper-MainKt
    
      43EOF
    
      44
    
      45	# Запуск командой finkeeper24
    
      46	install -d "${pkgdir}/usr/bin"
    
      47	ln -s /opt/finkeeper24/bin/FinKeeper24 "${pkgdir}/usr/bin/finkeeper24"
    
      48
    
      49	# Лицензия
    
      50	install -Dm644 "${srcdir}/LICENSE-Apache-2.0" \
    
      51		"${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      52}
    
      53

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2