go2train-bin

maintainer ahp · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary .deb from 'train-apks.file.g2storage.com', which appears to be a CDN/storage host associated with the Go2Train service (g2storage.com suggesting 'Go2 storage'). This is plausibly the vendor's own distribution infrastructure rather than a random third-party host, and the DLAGENTS referer points back to go2train.co, consistent with the app's official site. However, this is not a well-known, independently verifiable release host (e.g., GitHub releases, official distro mirrors), and there is no way to confirm the chain of custody. A prebuilt Electron-style binary (given the GTK3/nss/libdrm/mesa dependencies) is being extracted and installed directly. The sha256sum is pinned, which mitigates substitution risk at download time, but does not address whether the upstream host itself serves a trustworthy binary. The overall pattern — unofficial AUR package of a proprietary app, binary pulled from a storage CDN subdomain — is a legitimate medium supply-chain concern: not clearly malicious, but the binary is executed code from an unverified host with no reproducibility guarantee.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:36 "go2train_${pkgver}.deb::https://train-apks.file.g2storage.com/production/desktop/linux/linux_${pkgver}.deb"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary .deb from 'train-apks.file.g2storage.com', which appears to be a CDN/storage host associated with the Go2Train service (g2storage.com suggesting 'Go2 storage'). This is plausibly the vendor's own distribution infrastructure rather than a random third-party host, and the DLAGENTS referer points back to go2train.co, consistent with the app's official site. However, this is not a well-known, independently verifiable release host (e.g., GitHub releases, official distro mirrors), and there is no way to confirm the chain of custody. A prebuilt Electron-style binary (given the GTK3/nss/libdrm/mesa dependencies) is being extracted and installed directly. The sha256sum is pinned, which mitigates substitution risk at download time, but does not address whether the upstream host itself serves a trustworthy binary. The overall pattern — unofficial AUR package of a proprietary app, binary pulled from a storage CDN subdomain — is a legitimate medium supply-chain concern: not clearly malicious, but the binary is executed code from an unverified host with no reproducibility guarantee.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Amir Husayn Panahifar <ahp@panahifar.ir>
    
      2# This is the Unofficial package of Go2Train
    
      3# Go2Train all rights reserved ©
    
      4
    
      5pkgname=go2train-bin
    
      6pkgver=1.0.3
    
      7pkgrel=1
    
      8pkgdesc="Go2Train - Online Language Learning App (Unofficial)"
    
      9arch=('x86_64')
    
      10url="https://go2train.co/"
    
      11license=('custom')
    
      12depends=(
    
      13  'glibc'
    
      14  'gtk3'
    
      15  'libnotify'
    
      16  'nss'
    
      17  'xdg-utils'
    
      18  'at-spi2-core'
    
      19  'libdrm'
    
      20  'mesa'
    
      21  'libxcb'
    
      22)
    
      23optdepends=(
    
      24  'kde-cli-tools: Trash support via KDE trash'
    
      25  'trash-cli: Trash support alternative'
    
      26  'gvfs: Another trash support alternative'
    
      27  'pulseaudio: Sound server'
    
      28  'alsa-lib: Sound support alternative'
    
      29  'gnome-keyring: For keyring integration'
    
      30  'lsb-release: For distro info'
    
      31)
    
      32provides=("${pkgname%-bin}")
    
      33conflicts=("${pkgname%-bin}")
    
      34
    
      35source=(
    
      36  "go2train_${pkgver}.deb::https://train-apks.file.g2storage.com/production/desktop/linux/linux_${pkgver}.deb"
    
      37)
    
      38sha256sums=(
    
      39  "11ab4e935882975d9cf569e61d0427286aab2a6325956c1658d3a9f9f5e05a49"
    
      40)
    
      41
    
      42DLAGENTS=('https::/usr/bin/wget --referer=https://go2train.co/ --user-agent=Mozilla/5.0\ (X11;\ Linux\ x86_64)\ AppleWebKit/537.36\ \(KHTML,\ like\ Gecko\)\ Chrome/114.0.0.0\ Safari/537.36 -O %o %u')
    
      43
    
      44package() {
    
      45  bsdtar -xf "${srcdir}/go2train_${pkgver}.deb" -C "$srcdir"
    
      46  bsdtar -xf "$srcdir/data.tar.zst" -C "$pkgdir"
    
      47
    
      48  find "$pkgdir" -type d -exec chmod 755 {} +
    
      49  find "$pkgdir/usr/bin" -type f -exec chmod 755 {} + 2>/dev/null || true
    
      50  find "$pkgdir/usr/lib" -type f -name "*.so*" -exec chmod 644 {} + 2>/dev/null || true
    
      51}
    
      52

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2