fusiontunx
maintainer bobbyunknown
· 0 votes
· scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged
The PKGBUILD downloads and executes a prebuilt mihomo binary from GitHub (MetaCubeX/mihomo releases) without any checksum verification — it uses 'SKIP' for the git source and no sums at all for the wget'd artifacts. The mihomo binary is installed to /usr/bin/mihomo and executed as a privileged network proxy/tunnel daemon. Additionally, geo-data files are fetched from a third-party repo (rtaserver/meta-rules-dat) at 'latest' with no pinned version or checksum. Web UI assets (zashboard, metacubexd, yacd) are also fetched at 'latest' without checksums. While all sources are from GitHub and the upstream projects are legitimate (mihomo/Clash Meta is a well-known proxy tool), the combination of: (1) an executed binary installed to /usr/bin with no integrity check, (2) unpinned 'latest' release downloads, and (3) a third-party geo-data host, constitutes a genuine supply-chain risk. If any of these GitHub release endpoints were compromised or the 'latest' tag redirected, a malicious binary could be installed. This is a real medium-severity concern, not a false positive.
Triggered rules
MEDIUM
External install via pipx/uv/poetry/cargo/go/gem
alt_pkg_manager_install
A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:45
go install github.com/swaggo/swag/cmd/swag@latest
MEDIUM
AI review
llm_review
An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 85%): The PKGBUILD downloads and executes a prebuilt mihomo binary from GitHub (MetaCubeX/mihomo releases) without any checksum verification — it uses 'SKIP' for the git source and no sums at all for the wget'd artifacts. The mihomo binary is installed to /usr/bin/mihomo and executed as a privileged network proxy/tunnel daemon. Additionally, geo-data files are fetched from a third-party repo (rtaserver/meta-rules-dat) at 'latest' with no pinned version or checksum. Web UI assets (zashboard, metacubexd, yacd) are also fetched at 'latest' without checksums. While all sources are from GitHub and the upstream projects are legitimate (mihomo/Clash Meta is a well-known proxy tool), the combination of: (1) an executed binary installed to /usr/bin with no integrity check, (2) unpinned 'latest' release downloads, and (3) a third-party geo-data host, constitutes a genuine supply-chain risk. If any of these GitHub release endpoints were compromised or the 'latest' tag redirected, a malicious binary could be installed. This is a real medium-severity concern, not a false positive.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: BobbyUnknown <https://github.com/bobbyunknown>
2
pkgname=fusiontunx
3
pkgver=1.0.3
4
pkgrel=4
5
pkgdesc="FusionTunX - Controller and manager for Mihomo (Clash Meta) core"
6
arch=('x86_64' 'aarch64' 'armv7h')
7
url="https://github.com/bobbyunknown/FusionTunX"
8
license=('MIT')
9
depends=('iptables' 'iproute2' 'ca-certificates')
10
makedepends=('go' 'npm' 'git' 'wget' 'unzip')
11
optdepends=('nftables: Modern firewall backend')
12
backup=('etc/fusiontunx/app.yaml'
13
'etc/fusiontunx/configs/config.yaml'
14
'etc/fusiontunx/proxy_providers/proxy.yaml'
15
'etc/fusiontunx/rule_providers/rule.yaml')
16
17
_branch="dev"
18
_mihomo_version="v1.19.17"
19
20
source=("${pkgname}-${pkgver}::git+https://github.com/bobbyunknown/FusionTunX.git#branch=${_branch}")
21
sha256sums=('SKIP')
22
23
prepare() {
24
cd "${srcdir}/${pkgname}-${pkgver}"
25
cd src
26
export GOPATH="${srcdir}/gopath"
27
go mod download
28
}
29
30
build() {
31
cd "${srcdir}/${pkgname}-${pkgver}"
32
33
cd src/dash
34
npm install
35
npm run build
36
cd ../..
37
38
rm -rf src/internal/ui/dist
39
cp -r src/dash/dist src/internal/ui/dist
40
chmod -R 755 src/internal/ui/dist
41
42
cd src
43
export GOPATH="${srcdir}/gopath"
44
export PATH="${GOPATH}/bin:${PATH}"
45
go install github.com/swaggo/swag/cmd/swag@latest
46
swag init -g cmd/server/main.go -o docs
47
go mod tidy
48
49
export CGO_ENABLED=0
50
export GIN_MODE=release
51
52
case "${CARCH}" in
53
x86_64)
54
_goarch="amd64"
55
;;
56
aarch64)
57
_goarch="arm64"
58
;;
59
armv7h)
60
_goarch="arm"
61
export GOARM=7
62
;;
63
esac
64
65
GOOS=linux GOARCH=${_goarch} go build -ldflags="-s -w" -o ../fusiontunx ./cmd/server
66
cd ..
67
68
case "${CARCH}" in
69
x86_64)
70
_mihomo_arch="amd64"
71
;;
72
aarch64)
73
_mihomo_arch="arm64"
74
;;
75
armv7h)
76
_mihomo_arch="armv7"
77
;;
78
esac
79
80
wget -q -O mihomo.gz "https://github.com/MetaCubeX/mihomo/releases/download/${_mihomo_version}/mihomo-linux-${_mihomo_arch}-${_mihomo_version}.gz"
81
gunzip -f mihomo.gz
82
chmod +x mihomo
83
84
wget -q -O country.mmdb https://github.com/rtaserver/meta-rules-dat/releases/latest/download/country.mmdb
85
wget -q -O geoip.dat https://github.com/rtaserver/meta-rules-dat/releases/latest/download/geoip.dat
86
wget -q -O geosite.dat https://github.com/rtaserver/meta-rules-dat/releases/latest/download/geosite.dat
87
wget -q -O geoip.metadb https://github.com/rtaserver/meta-rules-dat/releases/download/latest/geoip.metadb
88
89
mkdir -p ui/zashboard
90
wget -q -O zashboard.zip "https://github.com/Zephyruso/zashboard/releases/latest/download/dist.zip"
91
unzip -q zashboard.zip -d temp_zashboard
92
mv temp_zashboard/dist/* ui/zashboard/
93
rm -rf temp_zashboard zashboard.zip
94
95
mkdir -p ui/metacubexd
96
wget -q -O metacubexd.tgz "https://github.com/MetaCubeX/metacubexd/releases/latest/download/compressed-dist.tgz"
97
tar -xzf metacubexd.tgz -C ui/metacubexd
98
rm metacubexd.tgz
99
100
mkdir -p ui/yacd
101
wget -q -O yacd.zip "https://github.com/MetaCubeX/Yacd-meta/archive/refs/heads/gh-pages.zip"
102
unzip -q yacd.zip -d temp_yacd
103
mv temp_yacd/Yacd-meta-gh-pages/* ui/yacd/
104
rm -rf temp_yacd yacd.zip
105
}
106
107
package() {
108
cd "${srcdir}/${pkgname}-${pkgver}"
109
110
install -Dm755 fusiontunx "${pkgdir}/usr/share/fusiontunx/fusiontunx"
111
install -Dm755 mihomo "${pkgdir}/usr/bin/mihomo"
112
113
install -Dm644 files/app.yaml "${pkgdir}/etc/fusiontunx/app.yaml"
114
install -Dm644 country.mmdb "${pkgdir}/etc/fusiontunx/country.mmdb"
115
install -Dm644 geoip.dat "${pkgdir}/etc/fusiontunx/geoip.dat"
116
install -Dm644 geosite.dat "${pkgdir}/etc/fusiontunx/geosite.dat"
117
install -Dm644 geoip.metadb "${pkgdir}/etc/fusiontunx/geoip.metadb"
118
119
install -dm755 "${pkgdir}/etc/fusiontunx/configs"
120
install -dm755 "${pkgdir}/etc/fusiontunx/proxy_providers"
121
install -dm755 "${pkgdir}/etc/fusiontunx/rule_providers"
122
123
if [ -d "files/configs" ]; then
124
cp -r files/configs/* "${pkgdir}/etc/fusiontunx/configs/"
125
fi
126
if [ -d "files/proxy_providers" ]; then
127
cp -r files/proxy_providers/* "${pkgdir}/etc/fusiontunx/proxy_providers/"
128
fi
129
if [ -d "files/rule_providers" ]; then
130
cp -r files/rule_providers/* "${pkgdir}/etc/fusiontunx/rule_providers/"
131
fi
132
133
install -dm755 "${pkgdir}/etc/fusiontunx/ui"
134
cp -r ui/* "${pkgdir}/etc/fusiontunx/ui/"
135
136
install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
137
}
138
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | MEDIUM | 2 |
| 2026-08-02 00:16:08 | MEDIUM | 2 |
| 2026-08-01 00:11:18 | MEDIUM | 2 |
| 2026-07-31 00:14:10 | MEDIUM | 2 |
| 2026-07-30 00:17:23 | MEDIUM | 2 |
| 2026-07-29 00:25:53 | MEDIUM | 2 |
| 2026-07-28 00:07:28 | MEDIUM | 2 |
| 2026-07-27 00:24:32 | MEDIUM | 2 |
| 2026-07-26 00:07:32 | MEDIUM | 2 |
| 2026-07-25 00:13:44 | MEDIUM | 2 |
| 2026-07-24 00:02:28 | MEDIUM | 2 |
| 2026-07-23 00:14:47 | MEDIUM | 2 |
| 2026-07-22 00:29:32 | MEDIUM | 2 |
| 2026-07-21 00:24:15 | MEDIUM | 2 |
| 2026-07-20 00:19:49 | MEDIUM | 2 |
| 2026-07-19 00:17:08 | MEDIUM | 2 |
| 2026-07-18 00:14:48 | MEDIUM | 2 |
| 2026-07-17 00:06:16 | MEDIUM | 2 |
| 2026-07-16 00:05:41 | MEDIUM | 2 |
| 2026-07-15 00:09:25 | MEDIUM | 2 |