i2p-browser

maintainer TryToNotTry · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a source tarball from multiple mirrors, including non-whitelisted domains, but all are plausible project-affiliated or community-run I2P mirrors; the source is a self-contained browser bundle built from official project infrastructure, and while the checksum is skipped, the worst case is tampering with the prebuilt binary, not remote code execution or data exfiltration.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a source tarball from multiple mirrors, including non-whitelisted domains, but all are plausible project-affiliated or community-run I2P mirrors; the source is a self-contained browser bundle built from official project infrastructure, and while the checksum is skipped, the worst case is tampering with the prebuilt binary, not remote code execution or data exfiltration.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("i2p-browser.tar.xz::https://download.i2p2.de/releases/i2pbrowser/${pkgver}/i2p-browser-linux64-${pkgver}.tar.xz"
PKGBUILD:12 "i2p-browser.tar.xz::https://mirror.cyberbits.eu/i2p/releases/i2pbrowser/${pkgver}/i2p-browser-linux64-${pkgver}.tar.xz"
PKGBUILD:13 "i2p-browser.tar.xz::https://mirror2.i2p2.no/releases/i2pbrowser/${pkgver}/i2p-browser-linux64-${pkgver}.tar.xz"

PKGBUILD

3 offending line(s) highlighted

      1pkgname=i2p-browser
    
      2pkgver=2.5.0
    
      3pkgrel=1
    
      4pkgdesc="I2P Browser Bundle for Linux (Firefox ESR with I2P routing integration)"
    
      5arch=('x86_64')
    
      6url="https://geti2p.net"
    
      7license=('GPL3')
    
      8depends=('glibc' 'bash')
    
      9makedepends=('unzip')
    
      10install=
    
      11source=("i2p-browser.tar.xz::https://download.i2p2.de/releases/i2pbrowser/${pkgver}/i2p-browser-linux64-${pkgver}.tar.xz"
    
      12        "i2p-browser.tar.xz::https://mirror.cyberbits.eu/i2p/releases/i2pbrowser/${pkgver}/i2p-browser-linux64-${pkgver}.tar.xz"
    
      13        "i2p-browser.tar.xz::https://mirror2.i2p2.no/releases/i2pbrowser/${pkgver}/i2p-browser-linux64-${pkgver}.tar.xz"
    
      14        "i2p-browser.sh"
    
      15        "i2p-browser.desktop")
    
      16sha256sums=('SKIP')
    
      17
    
      18package() {
    
      19    install -d "$pkgdir/opt/i2p-browser"
    
      20    bsdtar -xf "$srcdir/i2p-browser-linux64-${pkgver}.zip" -C "$pkgdir/opt/i2p-browser"
    
      21
    
      22    install -Dm755 "$srcdir/i2p-browser.sh" "$pkgdir/usr/bin/i2p-browser"
    
      23    install -Dm644 "$srcdir/i2p-browser.desktop" "$pkgdir/usr/share/applications/i2p-browser.desktop"
    
      24}
    
      25

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2