godoos-bin

maintainer zxp19821005 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD installs a prebuilt binary downloaded directly from godoos.com/upload/ — the vendor's own website rather than a standard forge release page (GitHub/Gitee releases). While the vendor operates the project and the domain matches the project URL, the /upload/ path is an informal hosting location rather than a versioned release artifact on a code forge. SHA256 checksums are provided, which mitigates substitution risk somewhat, but the binary is executed directly (install -Dm755) with no source build. The concern is real but not clearly malicious: if godoos.com were compromised or the upload path were manipulated, users would receive and execute a trojanized binary. This is a genuine medium-severity supply-chain concern — prebuilt binary from an unofficial/informal host path — consistent with the original rating.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:23 source_aarch64=("${pkgname%-bin}-${pkgver}-aarch64::https://godoos.com/upload/${pkgname%-bin}/${pkgver}/web/${pkgname%-bin}_web_linux_arm64")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 78%): This PKGBUILD installs a prebuilt binary downloaded directly from godoos.com/upload/ — the vendor's own website rather than a standard forge release page (GitHub/Gitee releases). While the vendor operates the project and the domain matches the project URL, the /upload/ path is an informal hosting location rather than a versioned release artifact on a code forge. SHA256 checksums are provided, which mitigates substitution risk somewhat, but the binary is executed directly (install -Dm755) with no source build. The concern is real but not clearly malicious: if godoos.com were compromised or the upload path were manipulated, users would receive and execute a trojanized binary. This is a genuine medium-severity supply-chain concern — prebuilt binary from an unofficial/informal host path — consistent with the original rating.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2pkgname=godoos-bin
    
      3_pkgname=GodoOS
    
      4pkgver=1.0.5
    
      5pkgrel=1
    
      6pkgdesc="An efficient intranet office platform that includes various tools such as Word, Excel, PPT, PDF, intranet chat, whiteboard, and mind mapping, and supports native file storage."
    
      7arch=(
    
      8    'aarch64'
    
      9    'x86_64'
    
      10)
    
      11url="https://godoos.com/home/os/"
    
      12_ghurl="https://github.com/phpk/godoos"
    
      13_gturl="https://gitee.com/godoos/godoos"
    
      14license=('MIT')
    
      15provides=("${pkgname%-bin}=${pkgver}")
    
      16conflicts=("${pkgname%-bin}")
    
      17depends=()
    
      18source=(
    
      19    "LICENSE-${pkgver}::${_gturl}/raw/v${pkgver}/LICENSE"
    
      20    "README-${pkgver}.en.md::${_gturl}/raw/v${pkgver}/README.en.md"
    
      21    "README-${pkgver}.zhs.md::${_gturl}/raw/v${pkgver}/README.md"
    
      22)
    
      23source_aarch64=("${pkgname%-bin}-${pkgver}-aarch64::https://godoos.com/upload/${pkgname%-bin}/${pkgver}/web/${pkgname%-bin}_web_linux_arm64")
    
      24source_x86_64=("${pkgname%-bin}-${pkgver}-x86_64::https://godoos.com/upload/${pkgname%-bin}/${pkgver}/web/${pkgname%-bin}_web_linux_amd64")
    
      25sha256sums=('13fb48a6c31a72e0e2b69650b1cebe8954f7b73449848492dcfd22b25bd91afa'
    
      26            '3d0df5272c4b4c94a859eaa74022934a1239ba1f9b6445bc91e53a8e7b11e361'
    
      27            '3f0a57e751c9352cd03afa60ecad878d3ffd2243586a0e4ad991886916dee180')
    
      28sha256sums_aarch64=('01cf0a81e8f16ddeba510b0ac9465a54aa67961c3a280ee8006d56772fa5ec0c')
    
      29sha256sums_x86_64=('0edb476ab2b2287c2b0b22c8922df94d11c9fd020a89f7c67a0bb11da43fc06e')
    
      30package() {
    
      31    install -Dm755 "${srcdir}/${pkgname%-bin}-${pkgver}-${CARCH}" "${pkgdir}/usr/bin/${pkgname%-bin}"
    
      32    install -Dm644 "${srcdir}/LICENSE-${pkgver}" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      33    install -Dm644 "${srcdir}/README-${pkgver}.en.md" "${pkgdir}/usr/share/doc/${pkgname%-bin}/README.en.md"
    
      34    install -Dm644 "${srcdir}/README-${pkgver}.zhs.md" "${pkgdir}/usr/share/doc/${pkgname%-bin}/README.md"
    
      35}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2