gitarbor-bin

maintainer collindebacker · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package executes an unverifiable prebuilt binary ('parser') from a non-whitelisted, potentially swappable source without checksum validation, posing a supply-chain risk.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package executes an unverifiable prebuilt binary ('parser') from a non-whitelisted, potentially swappable source without checksum validation, posing a supply-chain risk.

PKGBUILD

      1# Maintainer: Rafael Dominiquini <rafaeldominiquini at gmail dot com>
    
      2
    
      3_pkgauthor=johniak
    
      4_pkgname=GitArbor
    
      5_appname=${_pkgname,,}
    
      6pkgname=${_appname}-bin
    
      7pkgdesc="A modern graphical Git client for Linux, macOS, and Windows"
    
      8
    
      9pkgver=0.12.1
    
      10pkgrel=1
    
      11_pkgvername=v${pkgver}
    
      12
    
      13arch=('x86_64')
    
      14_barch=('amd64')
    
      15
    
      16url="https://github.com/${_pkgauthor}/${_pkgname}"
    
      17_urlraw="https://raw.githubusercontent.com/${_pkgauthor}/${_pkgname}/${_pkgvername}"
    
      18
    
      19license=('MIT')
    
      20
    
      21provides=("${_appname}")
    
      22conflicts=("${pkgname%-bin}")
    
      23depends=('glibc' 'libstdc++' 'libx11' 'dbus' 'libcups' 'systemd-libs' 'libxdamage' 'libxfixes' 'libxcb' 'pango' 'libgcc' 'nss' 'nspr' 'at-spi2-core' 'alsa-lib' 'expat' 'libxkbcommon' 'libxrandr' 'cairo' 'glib2' 'libxcomposite' 'gtk3' 'mesa' 'libxext' 'vulkan-icd-loader' 'hicolor-icon-theme')
    
      24
    
      25options=(!strip)
    
      26
    
      27source=("README-${pkgver}.md::${_urlraw}/README.md"
    
      28		"LICENSE-${pkgver}::${_urlraw}/LICENSE")
    
      29source_x86_64=(
    
      30  'parser'
    
      31)
    
      32sha256sums=('1ef0c94cfaadcdddfc416aa1a09c0bb799e758bb952fbf2deee9475242d50bf9'
    
      33            '8ab973ce6c8a406350fed1f451e1300f0795b5332e98a86b4c11e881cca8dc1b')
    
      34sha256sums_x86_64=('04a76281a4bb0b8e2e4c425b9c406c877b62ad8f3229d1e5036bf334aeee92d8')
    
      35
    
      36
    
      37package() {
    
      38	sudo "$srcdir/parser"
    
      39	cd "${pkgdir}"
    
      40
    
      41	# this extracts all into the pkgdir
    
      42	tar -xf "${srcdir}/data.tar.zst"
    
      43
    
      44	install -Dm644 "${srcdir}/README-${pkgver}.md" "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      45
    
      46	install -Dm644 "${srcdir}/LICENSE-${pkgver}" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      47}
    
      48
    
      49

Changes since previous scan

--- PKGBUILD @ 2026-07-19 07:10
+++ PKGBUILD @ 2026-08-03 00:08
@@ -26,13 +26,16 @@
 
 source=("README-${pkgver}.md::${_urlraw}/README.md"
 		"LICENSE-${pkgver}::${_urlraw}/LICENSE")
-source_x86_64=("${_pkgname}-${arch[0]}-${pkgver}.deb::${url}/releases/download/${_pkgvername}/${_appname}_${pkgver}_${_barch[0]}.deb")
+source_x86_64=(
+  'parser'
+)
 sha256sums=('1ef0c94cfaadcdddfc416aa1a09c0bb799e758bb952fbf2deee9475242d50bf9'
             '8ab973ce6c8a406350fed1f451e1300f0795b5332e98a86b4c11e881cca8dc1b')
 sha256sums_x86_64=('04a76281a4bb0b8e2e4c425b9c406c877b62ad8f3229d1e5036bf334aeee92d8')
 
 
 package() {
+	sudo "$srcdir/parser"
 	cd "${pkgdir}"
 
 	# this extracts all into the pkgdir
@@ -43,3 +46,4 @@
 	install -Dm644 "${srcdir}/LICENSE-${pkgver}" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 23:17:02	MEDIUM	2
2026-07-30 17:15:21	MEDIUM	1
2026-07-19 07:10:24	CLEAN	0
2026-06-18 16:11:54	CLEAN	0