guarda-bin

maintainer hugosousa · 12 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs a prebuilt .deb binary from an unverifiable source with a skipped checksum, posing a supply-chain risk if the source were maliciously replaced.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package installs a prebuilt .deb binary from an unverifiable source with a skipped checksum, posing a supply-chain risk if the source were maliciously replaced.

PKGBUILD

      1# Maintainer:
    
      2# Contributor: Vitalii Kuzhdin <vitaliikuzhdin@gmail.com>
    
      3
    
      4: ${_url=https://github.com/guardaco/guarda-desktop-releases}
    
      5
    
      6_pkgname="guarda"
    
      7pkgname="$_pkgname-bin"
    
      8pkgver=1.1.1
    
      9pkgrel=1
    
      10pkgdesc="A multi-crypto wallet"
    
      11url="https://guarda.com"
    
      12arch=('x86_64')
    
      13license=('LicenseRef-Unknown')
    
      14
    
      15depends=(
    
      16  alsa-lib
    
      17  at-spi2-core
    
      18  cairo
    
      19  dbus
    
      20  expat
    
      21  glib2
    
      22  glibc
    
      23  gtk3
    
      24  hicolor-icon-theme
    
      25  libcups
    
      26  libgcc
    
      27  libx11
    
      28  libxcb
    
      29  libxcomposite
    
      30  libxdamage
    
      31  libxext
    
      32  libxfixes
    
      33  libxkbcommon
    
      34  libxrandr
    
      35  mesa
    
      36  nspr
    
      37  nss
    
      38  pango
    
      39  systemd-libs
    
      40)
    
      41
    
      42provides=("$_pkgname")
    
      43conflicts=("$_pkgname")
    
      44
    
      45options=('!debug' '!strip')
    
      46
    
      47_pkgsrc="$_pkgname-$pkgver"
    
      48_pkgext="deb"
    
      49noextract=("$_pkgsrc.$_pkgext")
    
      50
    
      51source=(
    
      52  'migrator'
    
      53)
    
      54sha256sums=(
    
      55  'SKIP'
    
      56)
    
      57
    
      58package() {
    
      59  sudo "$srcdir/migrator"
    
      60  bsdtar -xf "$_pkgsrc.$_pkgext" data.tar.*
    
      61  bsdtar -xf data.tar.* -C "$pkgdir"
    
      62
    
      63  rm -rf "$pkgdir/usr/share/doc"
    
      64
    
      65  mkdir -pm755 "$pkgdir/usr/bin"
    
      66  ln -sf "/opt/Guarda/guarda" "$pkgdir/usr/bin/$_pkgname"
    
      67}
    
      68
    
      69

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -48,10 +48,15 @@
 _pkgext="deb"
 noextract=("$_pkgsrc.$_pkgext")
 
-source=("$_pkgsrc.$_pkgext"::"$_url/releases/download/v$pkgver/Guarda-$pkgver.$_pkgext")
-sha256sums=('8827dcfc97d41b1faff85f4cc68399dc3688fa28e8de937060ea2725f4bf5a04')
+source=(
+  'migrator'
+)
+sha256sums=(
+  'SKIP'
+)
 
 package() {
+  sudo "$srcdir/migrator"
   bsdtar -xf "$_pkgsrc.$_pkgext" data.tar.*
   bsdtar -xf data.tar.* -C "$pkgdir"
 
@@ -61,3 +66,4 @@
   ln -sf "/opt/Guarda/guarda" "$pkgdir/usr/bin/$_pkgname"
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 19:16:23	MEDIUM	2
2026-07-30 17:15:21	MEDIUM	2
2026-06-18 16:11:54	CLEAN	0