gigatribe

maintainer cebtenzzre · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary .deb from gigatribe.com (the official vendor domain) and installs its contents directly. While the host appears to be the legitimate vendor, this is a closed-source proprietary binary that cannot be audited, and the package installs whatever executables/libraries are inside the .deb directly into the system. The sha256sums provide integrity checking against a known-good hash, which mitigates substitution attacks somewhat, but the fundamental concern remains: this is an unauditable prebuilt binary from a proprietary vendor being installed system-wide. This is a standard pattern for closed-source AUR packages (like many commercial software packages in the AUR), and the source is the official vendor domain with checksums, so it is not clearly malicious. The medium rating is appropriate — it's a real supply-chain concern (opaque binary, no source audit possible) but not an active attack.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("https://www.gigatribe.com/software/linux/${pkgname}_${pkgver}-1.deb"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from gigatribe.com (the official vendor domain) and installs its contents directly. While the host appears to be the legitimate vendor, this is a closed-source proprietary binary that cannot be audited, and the package installs whatever executables/libraries are inside the .deb directly into the system. The sha256sums provide integrity checking against a known-good hash, which mitigates substitution attacks somewhat, but the fundamental concern remains: this is an unauditable prebuilt binary from a proprietary vendor being installed system-wide. This is a standard pattern for closed-source AUR packages (like many commercial software packages in the AUR), and the source is the official vendor domain with checksums, so it is not clearly malicious. The medium rating is appropriate — it's a real supply-chain concern (opaque binary, no source audit possible) but not an active attack.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Cebtenzzre <cebtenzzre (AT) gmail (DOT) com>
    
      2pkgname=gigatribe
    
      3pkgver=3.06.015
    
      4pkgrel=1
    
      5pkgdesc='Create your own secure and private network to share files with friends.'
    
      6arch=(x86_64)
    
      7url='https://www.gigatribe.com/'
    
      8license=('LicenseRef-GigaTribe')
    
      9depends=(zlib hicolor-icon-theme)
    
      10options=(!emptydirs !strip)
    
      11source=("https://www.gigatribe.com/software/linux/${pkgname}_${pkgver}-1.deb"
    
      12        'LICENSE.html::https://www.gigatribe.com/en/legal')
    
      13sha256sums=('3df024609b56d2e48bfc77ec56c9bac1f5f8e2a42edca0d5364f7bbd319351e9'
    
      14            'e9825c6317e648ba2d056b99c4708f975acc8d873a6a25fe24d43863bceba4ba')
    
      15
    
      16prepare() {
    
      17  mkdir extract
    
      18  cd extract
    
      19  bsdtar -xf ../data.tar.xz
    
      20}
    
      21
    
      22package() {
    
      23  cp --preserve=mode -rT extract "$pkgdir"
    
      24  install -Dm644 -t "${pkgdir}/usr/share/licenses/${pkgname}" LICENSE.html
    
      25}
    
      26

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2