gui-for-clash

MEDIUM

maintainer newtalan 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The PKGBUILD installs a prebuilt binary (GUI.for.Clash) downloaded from a GitHub release of the GUI-for-Cores organization. While GitHub releases are a common distribution mechanism, this is still a pre-compiled binary being installed directly to /opt without any source build step, creating a supply-chain risk if the release artifact were compromised. The icon is fetched from jsDelivr CDN pointing to the main branch (not a pinned commit), which is slightly concerning but mitigated by the sha256sum check. The binary itself has a sha256sum, which provides some integrity guarantee, but there is no reproducible build from source. The project (GUI-for-Cores/GUI.for.Clash) appears to be a legitimate open-source project with real upstream activity. The risk is a genuine medium: an executed binary from a third-party release, not clearly malicious but representing a real supply-chain concern if the release were tampered with before the sha256sum was recorded.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:25 "https://cdn.jsdelivr.net/gh/GUI-for-Cores/${_pkgname}@main/build/appicon.png"

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD installs a prebuilt binary (GUI.for.Clash) downloaded from a GitHub release of the GUI-for-Cores organization. While GitHub releases are a common distribution mechanism, this is still a pre-compiled binary being installed directly to /opt without any source build step, creating a supply-chain risk if the release artifact were compromised. The icon is fetched from jsDelivr CDN pointing to the main branch (not a pinned commit), which is slightly concerning but mitigated by the sha256sum check. The binary itself has a sha256sum, which provides some integrity guarantee, but there is no reproducible build from source. The project (GUI-for-Cores/GUI.for.Clash) appears to be a legitimate open-source project with real upstream activity. The risk is a genuine medium: an executed binary from a third-party release, not clearly malicious but representing a real supply-chain concern if the release were tampered with before the sha256sum was recorded.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: newtalan <newtalan@gmail.com>
    
      2
    
      3pkgname='gui-for-clash'
    
      4_pkgname='GUI.for.Clash'
    
      5pkgver='1.15.1'
    
      6pkgrel='1'
    
      7pkgdesc='GUI for Clash'
    
      8arch=('x86_64')
    
      9
    
      10license=('GPL3')
    
      11
    
      12depends=(
    
      13    'glibc'
    
      14    'webkit2gtk-4.1'
    
      15)
    
      16
    
      17url="https://github.com/GUI-for-Cores/${_pkgname}"
    
      18
    
      19install="${pkgname}.install"
    
      20
    
      21# Bin package
    
      22source=(
    
      23    "${url}/releases/download/v${pkgver}/${_pkgname}-linux-amd64.zip"
    
      24    "${pkgname}.desktop"
    
      25    "https://cdn.jsdelivr.net/gh/GUI-for-Cores/${_pkgname}@main/build/appicon.png"
    
      26    "${pkgname}.install"
    
      27)
    
      28
    
      29sha256sums=('d4983c0e0e6cca1508562a36632ca5af9aea5d10c2c87d28d011196d803c1f80'
    
      30            'aec5e2cc7c4fe3885fc57258f52100de8716fa8b93c8e9e0d62cc976c78f0502'
    
      31            '8933f6159cb5de8bd623eefc0a82ebeab50c9633a4fee87ac2f30054938ff8a4'
    
      32            '9f7062c9f445d26b677bb875e17b832845856882d41f53d83789960c33539ee6')
    
      33
    
      34package() {
    
      35    msg "make ${pkgname} package"
    
      36
    
      37    install -Dm755 "${_pkgname}" -t "${pkgdir}/opt/${pkgname}"
    
      38    install -Dm644 *.png ${pkgdir}/opt/${pkgname}/icon/${pkgname}.png
    
      39    install -Dm644 *.desktop -t ${pkgdir}/usr/share/applications
    
      40}
    
      41

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2