highflux-preview-bin

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary from 'https://www.highflux.io/ping/dl_redirect/linux_tgz', which is a redirect/dynamic URL rather than a versioned, static release artifact. This means the sha256sum check is only valid at the time the PKGBUILD was written — the redirect target could silently change to serve a different binary in the future without any version or hash mismatch being detectable by pacman. The downloaded binary ('hf' and 'highflux') is directly installed to /usr/bin and executed by users. While the domain is the project's own official domain, the use of a redirect endpoint rather than a pinned versioned URL is a genuine supply-chain concern: the maintainer cannot guarantee reproducibility, and any compromise or silent update of the redirect target would deliver arbitrary code to users. No checksums can meaningfully protect against future redirect changes. This is a real medium-severity supply-chain risk — not a false positive.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:21 'https://www.highflux.io/ping/dl_redirect/linux_tgz' )

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt binary from 'https://www.highflux.io/ping/dl_redirect/linux_tgz', which is a redirect/dynamic URL rather than a versioned, static release artifact. This means the sha256sum check is only valid at the time the PKGBUILD was written — the redirect target could silently change to serve a different binary in the future without any version or hash mismatch being detectable by pacman. The downloaded binary ('hf' and 'highflux') is directly installed to /usr/bin and executed by users. While the domain is the project's own official domain, the use of a redirect endpoint rather than a pinned versioned URL is a genuine supply-chain concern: the maintainer cannot guarantee reproducibility, and any compromise or silent update of the redirect target would deliver arbitrary code to users. No checksums can meaningfully protect against future redirect changes. This is a real medium-severity supply-chain risk — not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Erwann Lagouche <popgthyrd@gmail.com>
    
      2pkgname=highflux-preview-bin
    
      3pkgver=0.7.0
    
      4pkgrel=3
    
      5epoch=
    
      6pkgdesc='Highflux preview version'
    
      7arch=('any')
    
      8url='https://www.highflux.io/'
    
      9license=('copyright')
    
      10groups=()
    
      11depends=('wget')
    
      12makedepends=()
    
      13checkdepends=()
    
      14conflicts=('highflux' 'hf')
    
      15replaces=()
    
      16backup=()
    
      17option=()
    
      18install=
    
      19changelog=
    
      20source=( 'entry.desktop'
    
      21'https://www.highflux.io/ping/dl_redirect/linux_tgz' )
    
      22noextract=()
    
      23md5sum=()
    
      24validpkgkeys=()
    
      25
    
      26package() {
    
      27  tar -xf "./linux_tgz"
    
      28    mkdir -p "$pkgdir/usr/bin"
    
      29  cp "./highflux-$pkgver/hf" "$pkgdir/usr/bin/hf"
    
      30  cp "./highflux-$pkgver/highflux" "$pkgdir/usr/bin/highflux"
    
      31    mkdir -p "$pkgdir/usr/share/applications"
    
      32  cp "$srcdir/entry.desktop" "$pkgdir/usr/share/applications/highflux.desktop"
    
      33}
    
      34sha256sums=('7b346ed8a4ff76d44b77e57504406d3d56c88cd2c9770379173c374af45a0d3d'
    
      35'47028ba2e52a48aca7a888d8e8acf2c1ed6151be310fc236b1af004ac01a7547')
    
      36

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2