gitern

maintainer arnottcr · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged A prebuilt binary is downloaded directly from files.gitern.com (a project-specific host, not a standard distribution channel like GitHub releases) and installed as an executable. There is no source code, no build step, and no way to verify the binary's provenance beyond the sha512 checksum. If files.gitern.com is compromised or the binary is silently replaced, users would execute arbitrary code. The checksum provides some protection against in-transit tampering but not against the upstream host serving a malicious binary from the start. This is a genuine supply-chain concern: an opaque, prebuilt binary from a non-standard personal/project host installed into /usr/bin. The cheaper model's MEDIUM rating is correct.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:10 source=("https://files.gitern.com/${pkgname}"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): A prebuilt binary is downloaded directly from files.gitern.com (a project-specific host, not a standard distribution channel like GitHub releases) and installed as an executable. There is no source code, no build step, and no way to verify the binary's provenance beyond the sha512 checksum. If files.gitern.com is compromised or the binary is silently replaced, users would execute arbitrary code. The checksum provides some protection against in-transit tampering but not against the upstream host serving a malicious binary from the start. This is a genuine supply-chain concern: an opaque, prebuilt binary from a non-standard personal/project host installed into /usr/bin. The cheaper model's MEDIUM rating is correct.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Colin Arnott <colin@urandom.co.uk>
    
      2pkgname="gitern"
    
      3pkgver=1.1.0
    
      4pkgrel=1
    
      5pkgdesc="a git host for hackers"
    
      6arch=("any")
    
      7url="https://gitern.com"
    
      8license=("MIT")
    
      9optdepends=("bash-completion: Bash completion")
    
      10source=("https://files.gitern.com/${pkgname}"
    
      11        "completion")
    
      12sha512sums=("2280470d6c824d2cba8d2121f6c4119198f499e9d8d171e1066a9d784fc8886a9b3538f3349b301a3cd57b2550e26e419903ec03c8cc7695b9c7bf8f799fa488"
    
      13            "7a2151606a8f7d7c9021d3c4c76748cad2a6c381a2de561a1db521a0275da53e0a7b45a18e3755bd25c0684a952a01dd064d83e2a60d090b81543010497b8f00")
    
      14
    
      15package() {
    
      16	install -Dm755 "${srcdir}/${pkgname}" "${pkgdir}/usr/bin/${pkgname}"
    
      17	install -Dm644 "${srcdir}/completion" "${pkgdir}/usr/share/bash-completion/completions/${pkgname}"
    
      18}
    
      19

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2