gui-for-clash

maintainer newtalan · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD installs a prebuilt binary (GUI.for.Clash) downloaded from a GitHub release of the GUI-for-Cores organization. While GitHub releases are a common distribution mechanism, this is still a pre-compiled binary being installed directly to /opt without any source build step, creating a supply-chain risk if the release artifact were compromised. The icon is fetched from jsDelivr CDN pointing to the main branch (not a pinned commit), which is slightly concerning but mitigated by the sha256sum check. The binary itself has a sha256sum, which provides some integrity guarantee, but there is no reproducible build from source. The project (GUI-for-Cores/GUI.for.Clash) appears to be a legitimate open-source project with real upstream activity. The risk is a genuine medium: an executed binary from a third-party release, not clearly malicious but representing a real supply-chain concern if the release were tampered with before the sha256sum was recorded.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:25 "https://cdn.jsdelivr.net/gh/GUI-for-Cores/${_pkgname}@main/build/appicon.png"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD installs a prebuilt binary (GUI.for.Clash) downloaded from a GitHub release of the GUI-for-Cores organization. While GitHub releases are a common distribution mechanism, this is still a pre-compiled binary being installed directly to /opt without any source build step, creating a supply-chain risk if the release artifact were compromised. The icon is fetched from jsDelivr CDN pointing to the main branch (not a pinned commit), which is slightly concerning but mitigated by the sha256sum check. The binary itself has a sha256sum, which provides some integrity guarantee, but there is no reproducible build from source. The project (GUI-for-Cores/GUI.for.Clash) appears to be a legitimate open-source project with real upstream activity. The risk is a genuine medium: an executed binary from a third-party release, not clearly malicious but representing a real supply-chain concern if the release were tampered with before the sha256sum was recorded.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: newtalan <newtalan@gmail.com>
    
      2
    
      3pkgname='gui-for-clash'
    
      4_pkgname='GUI.for.Clash'
    
      5pkgver='1.15.1'
    
      6pkgrel='1'
    
      7pkgdesc='GUI for Clash'
    
      8arch=('x86_64')
    
      9
    
      10license=('GPL3')
    
      11
    
      12depends=(
    
      13    'glibc'
    
      14    'webkit2gtk-4.1'
    
      15)
    
      16
    
      17url="https://github.com/GUI-for-Cores/${_pkgname}"
    
      18
    
      19install="${pkgname}.install"
    
      20
    
      21# Bin package
    
      22source=(
    
      23    "${url}/releases/download/v${pkgver}/${_pkgname}-linux-amd64.zip"
    
      24    "${pkgname}.desktop"
    
      25    "https://cdn.jsdelivr.net/gh/GUI-for-Cores/${_pkgname}@main/build/appicon.png"
    
      26    "${pkgname}.install"
    
      27)
    
      28
    
      29sha256sums=('d4983c0e0e6cca1508562a36632ca5af9aea5d10c2c87d28d011196d803c1f80'
    
      30            'aec5e2cc7c4fe3885fc57258f52100de8716fa8b93c8e9e0d62cc976c78f0502'
    
      31            '8933f6159cb5de8bd623eefc0a82ebeab50c9633a4fee87ac2f30054938ff8a4'
    
      32            '9f7062c9f445d26b677bb875e17b832845856882d41f53d83789960c33539ee6')
    
      33
    
      34package() {
    
      35    msg "make ${pkgname} package"
    
      36
    
      37    install -Dm755 "${_pkgname}" -t "${pkgdir}/opt/${pkgname}"
    
      38    install -Dm644 *.png ${pkgdir}/opt/${pkgname}/icon/${pkgname}.png
    
      39    install -Dm644 *.desktop -t ${pkgdir}/usr/share/applications
    
      40}
    
      41

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2