gopanda

maintainer dakling · 13 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt proprietary AppImage binary directly from pandanet-igs.com (the official vendor site for the GoPanda2 go client) and executes it during prepare() to extract its contents. The domain appears to be the legitimate upstream vendor, which reduces risk compared to a personal/random host. However, the source URL has no version pinning (the filename is just 'GoPanda2.AppImage' with no version in the URL), meaning the downloaded binary could silently change without the checksum catching it on a rebuild — though the md5sum does provide a point-in-time integrity check. The check() function attempts to verify the version matches pkgver, which is a reasonable mitigation. The main concern is: (1) a prebuilt binary is executed, (2) the URL is not version-specific so future downloads could differ, and (3) MD5 is a weak hash. This is a genuine medium-risk supply-chain pattern — an executed binary from an external host with weak integrity verification — even though the host appears to be the legitimate vendor.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source_x86_64=("https://pandanet-igs.com/gopanda2/download/GoPanda2.AppImage")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt proprietary AppImage binary directly from pandanet-igs.com (the official vendor site for the GoPanda2 go client) and executes it during prepare() to extract its contents. The domain appears to be the legitimate upstream vendor, which reduces risk compared to a personal/random host. However, the source URL has no version pinning (the filename is just 'GoPanda2.AppImage' with no version in the URL), meaning the downloaded binary could silently change without the checksum catching it on a rebuild — though the md5sum does provide a point-in-time integrity check. The check() function attempts to verify the version matches pkgver, which is a reasonable mitigation. The main concern is: (1) a prebuilt binary is executed, (2) the URL is not version-specific so future downloads could differ, and (3) MD5 is a weak hash. This is a genuine medium-risk supply-chain pattern — an executed binary from an external host with weak integrity verification — even though the host appears to be the legitimate vendor.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Alex Kubica <alexkubicail@gmail.com>
    
      2# Contributor: Sébastien Feugère <smonff@riseup.net>
    
      3# Contributor: Dario Klingenberg <dario.klingenberg at web.de>
    
      4pkgname=gopanda
    
      5pkgver=2.8.3
    
      6pkgrel=1
    
      7pkgdesc="Client for the Pandanet-IGS go Server" 
    
      8arch=('x86_64')
    
      9url="http://pandanet-igs.com/communities/gopanda2"
    
      10license=('custom')
    
      11depends=(fuse2)
    
      12options=(!strip)
    
      13source_x86_64=("https://pandanet-igs.com/gopanda2/download/GoPanda2.AppImage")
    
      14md5sums_x86_64=('133aaa6cf74acc5715efd3c3cd8bb322')
    
      15_DEST="/opt/${pkgname}"
    
      16_CLIENT="GoPanda2.AppImage"
    
      17_NAME="GoPanda2"
    
      18_DESKTOP="/usr/share/applications/${_CLIENT}.desktop"
    
      19_ICON="/usr/share/pixmaps/${_NAME}.png"
    
      20
    
      21prepare() {
    
      22    chmod u+x "${srcdir}/${_CLIENT}"
    
      23    ./${_CLIENT} --appimage-extract 2> /dev/null
    
      24}
    
      25
    
      26check() {
    
      27    MATCH=$(cat ${srcdir}/squashfs-root/gopanda2.desktop | grep X-AppImage-Version=$pkgver || [[ $? == 1 ]])
    
      28    if [[ -z ${MATCH} ]]; then
    
      29        echo "Version check failed! A newer version has been released, but the
    
      30        PKGBUILD has not yet been updated. Change the pkgver and checksums in
    
      31        the PKGUILB yourself and/or leave a comment at
    
      32        https://aur.archlinux.org/packages/gopanda/ so that the PKGBUILD will be
    
      33        updated.";
    
      34        exit 1;
    
      35    fi
    
      36}
    
      37
    
      38package() {
    
      39
    
      40    # Copy license
    
      41	install -Dm644 "${srcdir}/squashfs-root/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      42
    
      43	cd "$srcdir/"
    
      44
    
      45	# Program
    
      46  	install -Dm755 "${_CLIENT}" "${pkgdir}${_DEST}/${_CLIENT}"
    
      47	
    
      48	# Link to program
    
      49	install -dm755 "${pkgdir}/usr/bin"
    
      50	ln -s "${_DEST}/${_CLIENT}" "${pkgdir}/usr/bin/${pkgname}"
    
      51
    
      52	# Icon
    
      53	install -Dm644 "${srcdir}/squashfs-root/${pkgname}2.png" "${pkgdir}${_ICON}"
    
      54
    
      55	# Desktop file
    
      56	install -Dm644 "${srcdir}/squashfs-root/${pkgname}2.desktop" "${pkgdir}${_DESKTOP}"
    
      57	echo "Exec=${_DEST}/${_CLIENT}" >> "${pkgdir}${_DESKTOP}"
    
      58	echo "Icon=${_ICON}" >> "${pkgdir}${_DESKTOP}"
    
      59	echo "MimeType=application/x-go-sgf;application/x-go-ugf;application/x-go-ugi;" >> "${pkgdir}${_DESKTOP}"
    
      60        rm -r "${srcdir}/squashfs-root"
    
      61}
    
      62

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2