gravityfile-bin

maintainer Dominiquini · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads prebuilt binaries from a Microsoft Azure blob storage URL, which is an unverifiable and swappable host, creating a supply-chain risk despite correct checksums.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:41 source_x86_64=("${_appname}-${arch[0]}-${pkgver}.zip::https://productionresultssa13.blob.core.windows.net/actions-results/6ed40e8d-1e55-4b49-8b00-db7b8d5221d3/workflow-job-run-da8a0002-ac1a-51a4-ab99-02d2949e14ef/artifacts/1bb87e07be9e52fc0dca53a1c0718fac23e8b4202b9c346e12f075762507a544.zip?rscd=attachment%3B+filename%3D%22x86_64-unknown-linux-gnu.zip%22&rsct=application%2Fzip&se=2026-06-27T00%3A54%3A25Z&sig=j3SfwVMu9eEwKIC2iKKKpGvlvzGP2gmfNyJRN45hmH4%3D&ske=2026-06-27T02%3A29%3A18Z&skoid=ca7593d4-ee42-46cd-af88-8b886a2f84eb&sks=b&skt=2026-06-26T22%3A29%3A18Z&sktid=398a6654-997b-47e9-b12b-9515b896b4de&skv=2025-11-05&sp=r&spr=https&sr=b&st=2026-06-27T00%3A44%3A20Z&sv=2025-11-05")

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads prebuilt binaries from a Microsoft Azure blob storage URL, which is an unverifiable and swappable host, creating a supply-chain risk despite correct checksums.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Rafael Dominiquini <rafaeldominiquini at gmail dot com>
    
      2
    
      3_gitauthor=Epistates
    
      4_gitname=gravityfile
    
      5_appname=${_gitname}
    
      6_alias=grav
    
      7pkgname=${_appname}-bin
    
      8pkgdesc="File system explorer and analyzer with an interactive TUI"
    
      9
    
      10pkgver=0.3.0
    
      11pkgrel=1
    
      12_gitversion=v${pkgver}
    
      13
    
      14arch=('x86_64' 'aarch64')
    
      15_barch=('x86_64-unknown-linux-gnu' 'aarch64-unknown-linux-gnu')
    
      16
    
      17_ghurl="https://github.com/${_gitauthor}/${_gitname}"
    
      18_ghurlraw="https://raw.githubusercontent.com/${_gitauthor}/${_gitname}/${_gitversion}"
    
      19url=${_ghurl}
    
      20
    
      21license=('Apache-2.0' 'MIT')
    
      22
    
      23provides=("${_appname}")
    
      24conflicts=("${_appname}")
    
      25depends=('glibc' 'libgcc')
    
      26
    
      27options=(!strip)
    
      28
    
      29source=("${_alias}-${pkgver}.bash::${_ghurlraw}/scripts/${_alias}.bash"
    
      30		"${_alias}-${pkgver}.fish::${_ghurlraw}/scripts/${_alias}.fish"
    
      31		"${_alias}-${pkgver}.zsh::${_ghurlraw}/scripts/${_alias}.zsh"
    
      32		"LICENSE-APACHE-${pkgver}::${_ghurlraw}/LICENSE-APACHE"
    
      33		"LICENSE-MIT-${pkgver}::${_ghurlraw}/LICENSE-MIT"
    
      34		"README-${pkgver}.md::${_ghurlraw}/README.md"
    
      35		"AUDIT-${pkgver}.md::${_ghurlraw}/AUDIT_FIXES.md"
    
      36		"CHANGELOG-${pkgver}.md::${_ghurlraw}/CHANGELOG.md"
    
      37		"PLUGINS-${pkgver}.md::${_ghurlraw}/docs/PLUGINS.md"
    
      38		"ARCHITECTURE-${pkgver}.md::${_ghurlraw}/docs/ARCHITECTURE.md")
    
      39# source_x86_64=("${_appname}-${arch[0]}-${pkgver}.tgz::${_ghurl}/releases/download/${_gitversion}/${_appname}-${_barch[0]}.tar.gz")
    
      40# source_aarch64=("${_appname}-${arch[1]}-${pkgver}.tgz::${_ghurl}/releases/download/${_gitversion}/${_appname}-${_barch[1]}.tar.gz")
    
      41source_x86_64=("${_appname}-${arch[0]}-${pkgver}.zip::https://productionresultssa13.blob.core.windows.net/actions-results/6ed40e8d-1e55-4b49-8b00-db7b8d5221d3/workflow-job-run-da8a0002-ac1a-51a4-ab99-02d2949e14ef/artifacts/1bb87e07be9e52fc0dca53a1c0718fac23e8b4202b9c346e12f075762507a544.zip?rscd=attachment%3B+filename%3D%22x86_64-unknown-linux-gnu.zip%22&rsct=application%2Fzip&se=2026-06-27T00%3A54%3A25Z&sig=j3SfwVMu9eEwKIC2iKKKpGvlvzGP2gmfNyJRN45hmH4%3D&ske=2026-06-27T02%3A29%3A18Z&skoid=ca7593d4-ee42-46cd-af88-8b886a2f84eb&sks=b&skt=2026-06-26T22%3A29%3A18Z&sktid=398a6654-997b-47e9-b12b-9515b896b4de&skv=2025-11-05&sp=r&spr=https&sr=b&st=2026-06-27T00%3A44%3A20Z&sv=2025-11-05")
    
      42source_aarch64=("${_appname}-${arch[1]}-${pkgver}.zip::https://productionresultssa13.blob.core.windows.net/actions-results/6ed40e8d-1e55-4b49-8b00-db7b8d5221d3/workflow-job-run-34b3754e-f87f-53f1-93b1-77ae6c29aff9/artifacts/86bf552cb29f61118330fb817bc3819ddbade898c26ec8c0a3c825f4bc5e2e27.zip?rscd=attachment%3B+filename%3D%22aarch64-unknown-linux-gnu.zip%22&rsct=application%2Fzip&se=2026-06-27T00%3A55%3A14Z&sig=f4TEFOeSmpd%2Bfx%2FFRq8rtPvU9F6uNe7VhXLQbeHVmqo%3D&ske=2026-06-27T02%3A08%3A56Z&skoid=ca7593d4-ee42-46cd-af88-8b886a2f84eb&sks=b&skt=2026-06-26T22%3A08%3A56Z&sktid=398a6654-997b-47e9-b12b-9515b896b4de&skv=2025-11-05&sp=r&spr=https&sr=b&st=2026-06-27T00%3A45%3A09Z&sv=2025-11-05")
    
      43sha256sums=('9b9fbd3c5b3494061a29b9f78957d3f888cbf5ec4ad0859efac96435be85f03e'
    
      44            '80ee5be553b56f756dc64c81c1520c6ebdf5c8c69a043a4bc65665d79b669518'
    
      45            '033531c8d865b05008b99b76c10b89d36ba4249d9aa365ae85a621202357b2bf'
    
      46            '2795063013f0f7498d460ef22570b194db597071f9261154f1ba055c6ab60189'
    
      47            'd2fb587595a98e66310d2d3152994e6f1078b82f9e8bceab42d053e18d212f73'
    
      48            '2bf1ee46f18db53ddcd81e9995afa297c121d6b5338fb1164a73c7971bd44cb6'
    
      49            'b0e28ef4f18c384121c6e9570abc1efae5907667aad82eb40589e92b173192fb'
    
      50            '769803033f68c3022a1f88e326cdb0be0ddf32c7be7d639bd7e1b177c635efb1'
    
      51            '7c29be36dad9b233df5ad0cefc361264e4ca8602172bceaabcb93dd86f1e382c'
    
      52            'dc5c24dec266c9db2d1563a335c26aa8e4c6adef64e5f572419f22231baa1d09')
    
      53sha256sums_x86_64=('22bc2d77a545409c6d201cd4ec310af02ddd8480956321934fa4b093a1d13824')
    
      54sha256sums_aarch64=('b0c18fe445afe4492127dced823b506646c5cd1083050db98cb4f496bfee4085')
    
      55
    
      56
    
      57case ${CARCH} in
    
      58  ${arch[0]})
    
      59    _CARCH=${_barch[0]}
    
      60    ;;
    
      61
    
      62  ${arch[1]})
    
      63    _CARCH=${_barch[1]}
    
      64    ;;
    
      65esac
    
      66
    
      67prepare() {
    
      68	cd "${srcdir}/" || exit
    
      69
    
      70	tar -xvf "${_appname}-${_CARCH}.tar.gz"
    
      71}
    
      72
    
      73package() {
    
      74	cd "${srcdir}/" || exit
    
      75
    
      76	install -Dm755 "${_appname}-${_CARCH}/${_appname}" "${pkgdir}/usr/bin/${_appname}"
    
      77
    
      78	install -Dm644 "${_alias}-${pkgver}.zsh" "${pkgdir}/usr/share/${_appname}/${_alias}.zsh"
    
      79	install -Dm644 "${_alias}-${pkgver}.bash" "${pkgdir}/usr/share/${_appname}/${_alias}.bash"
    
      80	install -Dm644 "${_alias}-${pkgver}.fish" "${pkgdir}/usr/share/${_appname}/${_alias}.fish"
    
      81
    
      82	install -Dm644 "README-${pkgver}.md" "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      83
    
      84	install -Dm644 "AUDIT-${pkgver}.md" "${pkgdir}/usr/share/doc/${pkgname}/AUDIT.md"
    
      85	install -Dm644 "PLUGINS-${pkgver}.md" "${pkgdir}/usr/share/doc/${pkgname}/PLUGINS.md"
    
      86	install -Dm644 "CHANGELOG-${pkgver}.md" "${pkgdir}/usr/share/doc/${pkgname}/CHANGELOG.md"
    
      87	install -Dm644 "ARCHITECTURE-${pkgver}.md" "${pkgdir}/usr/share/doc/${pkgname}/ARCHITECTURE.md"
    
      88
    
      89	install -Dm644 "LICENSE-MIT-${pkgver}" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE-MIT"
    
      90	install -Dm644 "LICENSE-APACHE-${pkgver}" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE-APACHE"
    
      91}
    
      92
    
      93

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2