go2train-bin

MEDIUM

maintainer ahp 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt .deb binary from a non-standard, non-official host (g2ns.ir) which is not the project's official domain, creating a supply-chain risk if the host is compromised or malicious.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:36 "go2train_${pkgver}.deb::https://g2ns.ir/e"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb binary from a non-standard, non-official host (g2ns.ir) which is not the project's official domain, creating a supply-chain risk if the host is compromised or malicious.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Amir Husayn Panahifar <ahp@panahifar.ir>
    
      2# This is the Unofficial package of Go2Train
    
      3# Go2Train all rights reserved ©
    
      4
    
      5pkgname=go2train-bin
    
      6pkgver=1.0.3
    
      7pkgrel=1
    
      8pkgdesc="Go2Train - Online Language Learning App (Unofficial)"
    
      9arch=('x86_64')
    
      10url="https://go2train.co/"
    
      11license=('custom')
    
      12depends=(
    
      13  'glibc'
    
      14  'gtk3'
    
      15  'libnotify'
    
      16  'nss'
    
      17  'xdg-utils'
    
      18  'at-spi2-core'
    
      19  'libdrm'
    
      20  'mesa'
    
      21  'libxcb'
    
      22)
    
      23optdepends=(
    
      24  'kde-cli-tools: Trash support via KDE trash'
    
      25  'trash-cli: Trash support alternative'
    
      26  'gvfs: Another trash support alternative'
    
      27  'pulseaudio: Sound server'
    
      28  'alsa-lib: Sound support alternative'
    
      29  'gnome-keyring: For keyring integration'
    
      30  'lsb-release: For distro info'
    
      31)
    
      32provides=("${pkgname%-bin}")
    
      33conflicts=("${pkgname%-bin}")
    
      34
    
      35source=(
    
      36  "go2train_${pkgver}.deb::https://g2ns.ir/e"
    
      37)
    
      38sha256sums=(
    
      39  "11ab4e935882975d9cf569e61d0427286aab2a6325956c1658d3a9f9f5e05a49"
    
      40)
    
      41
    
      42DLAGENTS=('https::/usr/bin/wget --referer=https://c.co/ --user-agent=Mozilla/5.0\ (X11;\ Linux\ x86_64)\ AppleWebKit/537.36\ \(KHTML,\ like\ Gecko\)\ Chrome/114.0.0.0\ Safari/537.36 -O %o %u')
    
      43
    
      44package() {
    
      45  bsdtar -xf "${srcdir}/go2train_${pkgver}.deb" -C "$srcdir"
    
      46  bsdtar -xf "$srcdir/data.tar.zst" -C "$pkgdir"
    
      47
    
      48  find "$pkgdir" -type d -exec chmod 755 {} +
    
      49  find "$pkgdir/usr/bin" -type f -exec chmod 755 {} + 2>/dev/null || true
    
      50  find "$pkgdir/usr/lib" -type f -name "*.so*" -exec chmod 644 {} + 2>/dev/null || true
    
      51}
    
      52

Changes since previous scan

--- PKGBUILD @ 2026-08-30 00:04
+++ PKGBUILD @ 2026-09-17 00:27
@@ -33,13 +33,13 @@
 conflicts=("${pkgname%-bin}")
 
 source=(
-  "go2train_${pkgver}.deb::https://train-apks.file.g2storage.com/production/desktop/linux/linux_${pkgver}.deb"
+  "go2train_${pkgver}.deb::https://g2ns.ir/e"
 )
 sha256sums=(
   "11ab4e935882975d9cf569e61d0427286aab2a6325956c1658d3a9f9f5e05a49"
 )
 
-DLAGENTS=('https::/usr/bin/wget --referer=https://go2train.co/ --user-agent=Mozilla/5.0\ (X11;\ Linux\ x86_64)\ AppleWebKit/537.36\ \(KHTML,\ like\ Gecko\)\ Chrome/114.0.0.0\ Safari/537.36 -O %o %u')
+DLAGENTS=('https::/usr/bin/wget --referer=https://c.co/ --user-agent=Mozilla/5.0\ (X11;\ Linux\ x86_64)\ AppleWebKit/537.36\ \(KHTML,\ like\ Gecko\)\ Chrome/114.0.0.0\ Safari/537.36 -O %o %u')
 
 package() {
   bsdtar -xf "${srcdir}/go2train_${pkgver}.deb" -C "$srcdir"

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 09:42:21	Medium	2
2026-08-30 00:04:14	Medium	2