gitio-git

maintainer gameplayer · 0 votes · scanned 2026-08-03 00:08:14.047287

HIGH

Why flagged This PKGBUILD downloads a prebuilt binary tarball (pkg.tar.gz) from a personal/unofficial host (gitio.chimmie.k.vu) with 'SKIP' checksums, extracts it, and installs its contents directly into the package root with execute permissions on all files in /usr/bin. There is no source code, no build step, no integrity verification whatsoever. The pkgver() function uses the SHA256 of the downloaded tarball as a version string, which is cosmetic and provides no security guarantee. The host is a personal domain with no transparency or reproducibility. This is a classic supply-chain attack vector: the maintainer (or anyone who compromises the host) can silently replace the tarball with malicious binaries at any time, and users will install and execute them with no warning. The 'SKIP' checksum means even a MITM or server compromise would go undetected. This constitutes a genuine high-risk package.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:42 "https://gitio.chimmie.k.vu/packages/zst/pkg.tar.gz"

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed it and judged it HIGH (confidence 88%): This PKGBUILD downloads a prebuilt binary tarball (pkg.tar.gz) from a personal/unofficial host (gitio.chimmie.k.vu) with 'SKIP' checksums, extracts it, and installs its contents directly into the package root with execute permissions on all files in /usr/bin. There is no source code, no build step, no integrity verification whatsoever. The pkgver() function uses the SHA256 of the downloaded tarball as a version string, which is cosmetic and provides no security guarantee. The host is a personal domain with no transparency or reproducibility. This is a classic supply-chain attack vector: the maintainer (or anyone who compromises the host) can silently replace the tarball with malicious binaries at any time, and users will install and execute them with no warning. The 'SKIP' checksum means even a MITM or server compromise would go undetected. This constitutes a genuine high-risk package.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Chimmie Firefly <gameplayer2019pl (at) tutamail (dot) com>
    
      2pkgname=gitio-git
    
      3_pkgname=gitio-git
    
      4pkgver=0
    
      5pkgrel=1
    
      6pkgdesc='Frontend API for interacting with git hosting for CI.'
    
      7
    
      8arch=(
    
      9	'any'
    
      10)
    
      11
    
      12url="https://gitio.chimmie.k.vu"
    
      13license=('Akini 3.1')
    
      14
    
      15depends=(
    
      16    'openssl'
    
      17    'coreutils'
    
      18    'git'
    
      19    'sed'
    
      20    'gawk'
    
      21    'curl'
    
      22)
    
      23
    
      24optdepends=(
    
      25    'kaniko: Build containers'
    
      26    'openssh: SSH based auth using git'
    
      27)
    
      28
    
      29makedepends=(
    
      30    'pacman'
    
      31)
    
      32
    
      33provides=(
    
      34	'gitio'
    
      35)
    
      36
    
      37conflicts=(
    
      38	'gitio'
    
      39)
    
      40
    
      41source=(
    
      42    "https://gitio.chimmie.k.vu/packages/zst/pkg.tar.gz"
    
      43)
    
      44
    
      45noextract=("pkg.tar.gz")
    
      46
    
      47sha256sums=(
    
      48    'SKIP'
    
      49)
    
      50
    
      51pkgver() {
    
      52    cd "${srcdir}"
    
      53    echo 'r'"$(sha256sum pkg.tar.gz | cut -d ' ' -f 1)"
    
      54}
    
      55
    
      56build() {
    
      57	cd "${srcdir}"
    
      58	tar -xvf pkg.tar.gz
    
      59    mv default-fs "${pkgname}"
    
      60    
    
      61}
    
      62
    
      63package() {
    
      64    cd "${srcdir}"
    
      65	cd "${srcdir}/${pkgname}"
    
      66    mkdir -p "${pkgdir}" 2>/dev/null 3>&2
    
      67    cp -rv * "${pkgdir}/"
    
      68    chmod +x "${pkgdir}"/usr/bin/*
    
      69}
    
      70

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 00:11:18	HIGH	2
2026-07-31 00:14:10	HIGH	2
2026-07-30 00:17:23	HIGH	2
2026-07-29 00:25:53	HIGH	2
2026-07-28 00:07:28	HIGH	2
2026-07-27 00:24:32	HIGH	2
2026-07-26 00:07:32	HIGH	2
2026-07-25 00:13:44	HIGH	2
2026-07-24 00:02:28	HIGH	2
2026-07-23 00:14:47	HIGH	2
2026-07-22 00:29:32	HIGH	2
2026-07-21 00:24:15	HIGH	2
2026-07-20 00:19:49	HIGH	2
2026-07-19 00:17:08	HIGH	2
2026-07-18 00:14:48	HIGH	2
2026-07-17 00:06:16	HIGH	2
2026-07-16 00:05:41	HIGH	2
2026-07-15 00:09:25	HIGH	2