flexibee-client-bin

maintainer spidla · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt .deb binary (flexibee-client_${pkgver}_all.deb) from download.flexibee.eu, which is the official FlexiBee vendor download host (FlexiBee is a well-known Czech accounting software by ABRA Software). The binary is then extracted and installed directly. While this is a prebuilt binary from what appears to be the legitimate vendor host, it is still an executed binary (Java application launcher scripts + native binaries in /usr/bin) installed without any additional integrity verification beyond the sha256sum. The sha256sum does provide a pinned hash, which mitigates silent substitution risk somewhat. However, the binary is not from an official distribution channel (e.g., official distro repo) and the vendor host could theoretically serve different content if the URL is reused for a new build. This is a standard AUR pattern for proprietary software distributed as .deb packages, and the risk is typical medium-level supply-chain concern rather than an active attack. The prepare() function also has a missing extract step for the .deb (ar extraction) before tar, which may indicate the PKGBUILD is partially broken, but the security concern remains the prebuilt binary installation.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("https://download.flexibee.eu/download/$pkgbasever/$pkgver/flexibee-client_${pkgver}_all.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt .deb binary (flexibee-client_${pkgver}_all.deb) from download.flexibee.eu, which is the official FlexiBee vendor download host (FlexiBee is a well-known Czech accounting software by ABRA Software). The binary is then extracted and installed directly. While this is a prebuilt binary from what appears to be the legitimate vendor host, it is still an executed binary (Java application launcher scripts + native binaries in /usr/bin) installed without any additional integrity verification beyond the sha256sum. The sha256sum does provide a pinned hash, which mitigates silent substitution risk somewhat. However, the binary is not from an official distribution channel (e.g., official distro repo) and the vendor host could theoretically serve different content if the URL is reused for a new build. This is a standard AUR pattern for proprietary software distributed as .deb packages, and the risk is typical medium-level supply-chain concern rather than an active attack. The prepare() function also has a missing extract step for the .deb (ar extraction) before tar, which may indicate the PKGBUILD is partially broken, but the security concern remains the prebuilt binary installation.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Richard Cesar <richard.cesar@netkeepers.cz>
    
      2
    
      3pkgname=flexibee-client-bin
    
      4pkgver=2026.3.1
    
      5pkgbasever=2026.3
    
      6pkgrel=1
    
      7pkgdesc="Accounting economic system for person and business usage. Client-only package."
    
      8arch=('i686' 'x86_64')
    
      9url="http://www.flexibee.eu"
    
      10license=('custom')
    
      11depends=('glibc' 'java-environment=11' 'fontconfig' 'libxrender' 'libxtst' 'ttf-dejavu' 'gtk3' 'ttf-dejavu' 'libxi')
    
      12install=flexibee.install
    
      13source=("https://download.flexibee.eu/download/$pkgbasever/$pkgver/flexibee-client_${pkgver}_all.deb")
    
      14
    
      15sha256sums=('be009b2f36f628b8575e9a3a2ea339374a4e063db09cf6cbec2de5b44b7bf959')
    
      16
    
      17prepare() {
    
      18    cd ${srcdir}
    
      19    mkdir $pkgname-$pkgver
    
      20    tar -vxzf data.tar.gz -C ./$pkgname-$pkgver
    
      21    #sed -i 's/^# FLEXIBEE_JAVA=$/FLEXIBEE_JAVA=\/usr\/lib\/jvm\/java-11-openjdk\/jre\/bin\/java/' ./$pkgname-$pkgver/etc/default/flexibee
    
      22}
    
      23
    
      24package() {
    
      25
    
      26    cd ${srcdir}/$pkgname-$pkgver
    
      27
    
      28    # Prepare /etc
    
      29    install -d -m 755 "${pkgdir}/etc/flexibee"
    
      30    install -d -m 755 "${pkgdir}/etc/default"
    
      31    install -m 644 ./etc/default/flexibee "${pkgdir}/etc/default/"
    
      32
    
      33    # Prepare /usr/bin -> install executables
    
      34    install -d -m 755 "${pkgdir}/usr/bin"
    
      35    install -m 755 ./usr/bin/* "${pkgdir}/usr/bin/"
    
      36
    
      37    # Install everything in /usr/share
    
      38    install -d -m 755 "${pkgdir}/usr/share"
    
      39    find ./usr/share/ -type d -exec install -d -m 755 {} "${pkgdir}/{}" \;
    
      40    find ./usr/share/ -type f -exec install -m 664 {} "${pkgdir}/{}" \;
    
      41}
    
      42
    
      43
    
      44

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2