gtaf-quran

maintainer enamulhasanabid · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD installs prebuilt binaries (a Flutter/native executable 'qm_flutter' and bundled shared libraries) downloaded from a personal/vendor S3 bucket (direct-download-apps.s3.us-east-2.amazonaws.com) that is not an official distribution channel like Flathub or a distro repo. The binaries are placed directly into /usr/lib and /usr/bin and executed by users. While sha256sums are provided for the architecture-specific tarballs (so integrity is checked at build time), the checksums themselves are only as trustworthy as the PKGBUILD — if the S3 bucket is compromised and the PKGBUILD updated, users get malicious binaries. The appdata.xml has 'SKIP' for its checksum, which is minor. The prepare() step also fetches a favicon at build time via curl without any checksum, though this is only used as an icon. The core concern is the prebuilt binary from an unofficial S3 host: this is a genuine medium-severity supply-chain risk, not a false positive. The package is proprietary (LicenseRef-Proprietary) and appears to be a legitimate app by Greentech Apps Foundation distributed via Flathub as a Flatpak, but this AUR package bypasses Flatpak sandboxing and installs native binaries system-wide.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:39 curl -LO https://quran.gtaf.org/favicon.ico

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:26 "https://direct-download-apps.s3.us-east-2.amazonaws.com/quran/quran_${_x86_64_ver}_x86_64.tar.gz"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD installs prebuilt binaries (a Flutter/native executable 'qm_flutter' and bundled shared libraries) downloaded from a personal/vendor S3 bucket (direct-download-apps.s3.us-east-2.amazonaws.com) that is not an official distribution channel like Flathub or a distro repo. The binaries are placed directly into /usr/lib and /usr/bin and executed by users. While sha256sums are provided for the architecture-specific tarballs (so integrity is checked at build time), the checksums themselves are only as trustworthy as the PKGBUILD — if the S3 bucket is compromised and the PKGBUILD updated, users get malicious binaries. The appdata.xml has 'SKIP' for its checksum, which is minor. The prepare() step also fetches a favicon at build time via curl without any checksum, though this is only used as an icon. The core concern is the prebuilt binary from an unofficial S3 host: this is a genuine medium-severity supply-chain risk, not a false positive. The package is proprietary (LicenseRef-Proprietary) and appears to be a legitimate app by Greentech Apps Foundation distributed via Flathub as a Flatpak, but this AUR package bypasses Flatpak sandboxing and installs native binaries system-wide.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Enamul Hasan <enamulhabid at gmail dot com>
    
      2pkgname=gtaf-quran
    
      3pkgver=0.5.11  # Default to x86_64 version
    
      4pkgrel=1
    
      5pkgdesc="Al Quran (Tafsir & By Word) by Greentech Apps Foundation"
    
      6arch=('x86_64' 'aarch64')
    
      7url="https://flathub.org/apps/org.gtaf.quran"
    
      8license=('LicenseRef-Proprietary')
    
      9depends=(
    
      10  'ffmpeg' 'libass' 'libplacebo' 'mpv' 'gnutls' 'aom' 'dav1d' 'freetype2'
    
      11  'lame' 'opus' 'vulkan-icd-loader' 'shaderc' 'pipewire-pulse' 'libaacs'
    
      12)
    
      13makedepends=('imagemagick' 'curl')  # needed to convert .ico to .png
    
      14
    
      15# Version variables for different architectures
    
      16_x86_64_ver=0.5.11
    
      17_aarch64_ver=0.5.9
    
      18
    
      19# Source files
    
      20source=(
    
      21  "https://raw.githubusercontent.com/flathub/org.gtaf.quran/master/org.gtaf.quran.appdata.xml"
    
      22)
    
      23
    
      24# Architecture-specific sources
    
      25source_x86_64=(
    
      26  "https://direct-download-apps.s3.us-east-2.amazonaws.com/quran/quran_${_x86_64_ver}_x86_64.tar.gz"
    
      27)
    
      28source_aarch64=(
    
      29  "https://direct-download-apps.s3.us-east-2.amazonaws.com/quran/quran_${_aarch64_ver}_arm64.tar.gz"
    
      30)
    
      31
    
      32# Checksums
    
      33sha256sums=('SKIP')  # For the appdata.xml from GitHub
    
      34sha256sums_x86_64=('2dea85c6b7ec1f95405a9c9724008be759d8688124aa332e459927d41752d68b')
    
      35sha256sums_aarch64=('d690a161d3e919392a4f1c1ef15d715395ed3010d01c4328bc6775fb0f34e4b9')
    
      36
    
      37prepare() {
    
      38  cd "$srcdir"
    
      39  curl -LO https://quran.gtaf.org/favicon.ico
    
      40  # Convert favicon.ico to PNG with ImageMagick's convert
    
      41  convert favicon.ico "${pkgname}.png"
    
      42  rm favicon.ico
    
      43}
    
      44
    
      45package() {
    
      46  # Create directory structure
    
      47  install -d "${pkgdir}/usr/lib/${pkgname}"
    
      48  install -d "${pkgdir}/usr/share/${pkgname}"
    
      49  install -d "${pkgdir}/usr/bin"
    
      50
    
      51  # Move files to their destinations
    
      52  mv "${srcdir}/data/quran/lib" "${pkgdir}/usr/lib/${pkgname}/lib"
    
      53  mv "${srcdir}/data/quran/data/"* "${pkgdir}/usr/share/${pkgname}"
    
      54  mv "${srcdir}/data/quran/qm_flutter" "${pkgdir}/usr/lib/${pkgname}/quran"
    
      55
    
      56  # Create symlinks
    
      57  ln -s "../lib/${pkgname}/quran" "${pkgdir}/usr/bin/${pkgname}"
    
      58  ln -s "../../share/${pkgname}" "${pkgdir}/usr/lib/${pkgname}/data"
    
      59
    
      60  # Install desktop file and icon
    
      61  install -Dm644 "${srcdir}/data/gui/quran.desktop" \
    
      62    "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      63  install -Dm644 "${srcdir}/data/gui/quran.svg" \
    
      64    "${pkgdir}/usr/share/icons/hicolor/scalable/apps/${pkgname}.svg"
    
      65  install -Dm644 /dev/stdin "${pkgdir}/usr/share/applications/${pkgname}.desktop" <<EOF
    
      66[Desktop Entry]
    
      67Name=Al Quran (Tafsir & By Word)
    
      68Comment=Al Quran (Tafsir & By Word) by Greentech Apps Foundation
    
      69Exec=/usr/bin/${pkgname}
    
      70Icon=${pkgname}
    
      71Terminal=false
    
      72Type=Application
    
      73Categories=Education;
    
      74Keywords=alquran;quran;quranlinux;tafsir;tafseer;gtaf;greentechapps;greentech
    
      75EOF
    
      76
    
      77  install -Dm644 "${srcdir}/${pkgname}.png" "${pkgdir}/usr/share/icons/hicolor/scalable/apps/${pkgname}.png"
    
      78
    
      79  # Install appdata
    
      80  install -Dm644 "${srcdir}/org.gtaf.quran.appdata.xml" \
    
      81    "${pkgdir}/usr/share/metainfo/${pkgname}.appdata.xml"
    
      82}
    
      83

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 00:29:32	MEDIUM	3
2026-07-21 00:24:15	MEDIUM	3
2026-07-20 00:19:49	MEDIUM	3
2026-07-19 00:17:08	MEDIUM	3
2026-07-18 00:14:48	MEDIUM	3
2026-07-17 00:06:16	MEDIUM	3
2026-07-16 00:05:41	MEDIUM	3
2026-07-15 00:09:25	MEDIUM	3