go2train-bin

MEDIUM

maintainer ahp 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt .deb from a non-standard, untrusted host (file.g2storage.com), which could be swapped with a malicious version, posing a supply-chain risk despite correct checksum verification.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:38 source=("go2train_${pkgver}.deb::https://train-apks.file.g2storage.com/production/desktop/linux/linux_${pkgver}.deb")

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb from a non-standard, untrusted host (file.g2storage.com), which could be swapped with a malicious version, posing a supply-chain risk despite correct checksum verification.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Amir Husayn Panahifar <ahp@panahifar.ir>
    
      2# This is the Unofficial package of Go2Train
    
      3# Go2Train all rights reserved ©
    
      4
    
      5pkgname=go2train-bin
    
      6pkgver=1.0.3
    
      7pkgrel=2
    
      8pkgdesc="Online language learning app (unofficial package)"
    
      9arch=('x86_64')
    
      10url="https://go2train.co/"
    
      11# The app itself is proprietary; the bundled Electron runtime is MIT.
    
      12license=('LicenseRef-go2train' 'MIT')
    
      13depends=(
    
      14  'glibc'
    
      15  'gtk3'
    
      16  'libnotify'
    
      17  'nss'
    
      18  'xdg-utils'
    
      19  'at-spi2-core'
    
      20  'libdrm'
    
      21  'mesa'
    
      22  'libxcb'
    
      23)
    
      24optdepends=(
    
      25  'kde-cli-tools: Trash support via KDE trash'
    
      26  'trash-cli: Trash support alternative'
    
      27  'gvfs: Another trash support alternative'
    
      28  'pulseaudio: Sound server'
    
      29  'alsa-lib: Sound support alternative'
    
      30  'gnome-keyring: For keyring integration'
    
      31  'lsb-release: For distro info'
    
      32)
    
      33provides=("${pkgname%-bin}")
    
      34conflicts=("${pkgname%-bin}")
    
      35options=('!debug')
    
      36# Direct, versioned vendor URL. The g2ns.ir short link used before resolved to
    
      37# the same file but could start serving a newer .deb silently.
    
      38source=("go2train_${pkgver}.deb::https://train-apks.file.g2storage.com/production/desktop/linux/linux_${pkgver}.deb")
    
      39sha256sums=('11ab4e935882975d9cf569e61d0427286aab2a6325956c1658d3a9f9f5e05a49')
    
      40
    
      41package() {
    
      42  bsdtar -xf "${srcdir}/go2train_${pkgver}.deb" -C "$srcdir"
    
      43  bsdtar -xf "$srcdir/data.tar.zst" -C "$pkgdir"
    
      44
    
      45  find "$pkgdir" -type d -exec chmod 755 {} +
    
      46  find "$pkgdir/usr/bin" -type f -exec chmod 755 {} + 2>/dev/null || true
    
      47  find "$pkgdir/usr/lib" -type f -name "*.so*" -exec chmod 644 {} + 2>/dev/null || true
    
      48
    
      49  install -dm755 "$pkgdir/usr/share/licenses/$pkgname"
    
      50  ln -s /usr/share/doc/go2train/copyright "$pkgdir/usr/share/licenses/$pkgname/LICENSE.electron"
    
      51}
    
      52

Changes since previous scan

--- PKGBUILD @ 2026-10-30 00:29
+++ PKGBUILD @ 2026-11-01 00:21
@@ -4,11 +4,12 @@
 
 pkgname=go2train-bin
 pkgver=1.0.3
-pkgrel=1
-pkgdesc="Go2Train - Online Language Learning App (Unofficial)"
+pkgrel=2
+pkgdesc="Online language learning app (unofficial package)"
 arch=('x86_64')
 url="https://go2train.co/"
-license=('custom')
+# The app itself is proprietary; the bundled Electron runtime is MIT.
+license=('LicenseRef-go2train' 'MIT')
 depends=(
   'glibc'
   'gtk3'
@@ -31,15 +32,11 @@
 )
 provides=("${pkgname%-bin}")
 conflicts=("${pkgname%-bin}")
-
-source=(
-  "go2train_${pkgver}.deb::https://g2ns.ir/e"
-)
-sha256sums=(
-  "11ab4e935882975d9cf569e61d0427286aab2a6325956c1658d3a9f9f5e05a49"
-)
-
-DLAGENTS=('https::/usr/bin/wget --referer=https://c.co/ --user-agent=Mozilla/5.0\ (X11;\ Linux\ x86_64)\ AppleWebKit/537.36\ \(KHTML,\ like\ Gecko\)\ Chrome/114.0.0.0\ Safari/537.36 -O %o %u')
+options=('!debug')
+# Direct, versioned vendor URL. The g2ns.ir short link used before resolved to
+# the same file but could start serving a newer .deb silently.
+source=("go2train_${pkgver}.deb::https://train-apks.file.g2storage.com/production/desktop/linux/linux_${pkgver}.deb")
+sha256sums=('11ab4e935882975d9cf569e61d0427286aab2a6325956c1658d3a9f9f5e05a49')
 
 package() {
   bsdtar -xf "${srcdir}/go2train_${pkgver}.deb" -C "$srcdir"
@@ -48,5 +45,8 @@
   find "$pkgdir" -type d -exec chmod 755 {} +
   find "$pkgdir/usr/bin" -type f -exec chmod 755 {} + 2>/dev/null || true
   find "$pkgdir/usr/lib" -type f -name "*.so*" -exec chmod 644 {} + 2>/dev/null || true
+
+  install -dm755 "$pkgdir/usr/share/licenses/$pkgname"
+  ln -s /usr/share/doc/go2train/copyright "$pkgdir/usr/share/licenses/$pkgname/LICENSE.electron"
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 09:55:25	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2