ia-bin

MEDIUM

maintainer kleintux 3 votes scanned 2026-09-25 13:11:58.025550

View on AUR

Why flagged

The package downloads a prebuilt executable from a non-standard host (archive.org, used unconventionally for distribution), which is unverifiable and could be silently swapped, posing a supply-chain risk.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("${_pkgname}-${pkgver}::https://archive.org/download/ia-pex/ia")

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt executable from a non-standard host (archive.org, used unconventionally for distribution), which is unverifiable and could be silently swapped, posing a supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: kleintux <reg-archlinux AT klein DOT tuxli DOT ch> 
    
      2
    
      3_pkgname=ia
    
      4pkgname=${_pkgname}-bin
    
      5pkgver=5.11.1
    
      6pkgrel=1
    
      7pkgdesc="A Python and Command-Line Interface to Archive.org"
    
      8arch=('x86_64')
    
      9url="https://archive.org/download/ia-pex/"
    
      10license=('AGPL-3.0')
    
      11conflicts=(${pkgname})
    
      12source=("${_pkgname}-${pkgver}::https://archive.org/download/ia-pex/ia")
    
      13sha512sums=('e34ccd6744b5bc3ada163301f0bbff6f30169d54e6e307613b7a82ed20b2aaedb9d3e204e6852b48488e44777454ebc7114239a9d2d5e112a199458f734ab28d')
    
      14noextract=("${_pkgname}-${pkgver}")
    
      15
    
      16package() {
    
      17	install -Dm755 "${_pkgname}-${pkgver}" "${pkgdir}"/usr/bin/${_pkgname}
    
      18}
    
      19

Changes since previous scan

--- PKGBUILD @ 2026-06-19 19:07
+++ PKGBUILD @ 2026-09-25 13:11
@@ -2,7 +2,7 @@
 
 _pkgname=ia
 pkgname=${_pkgname}-bin
-pkgver=5.9.0
+pkgver=5.11.1
 pkgrel=1
 pkgdesc="A Python and Command-Line Interface to Archive.org"
 arch=('x86_64')
@@ -10,7 +10,7 @@
 license=('AGPL-3.0')
 conflicts=(${pkgname})
 source=("${_pkgname}-${pkgver}::https://archive.org/download/ia-pex/ia")
-sha512sums=('c62e78dd042873bd08e65b843ec60364886e703779d9d359185eaa3a602783c07b7200decf50bb30c6d8e2bdebac404c2db74549ff0c1353a5bcb9b0c33cec38')
+sha512sums=('e34ccd6744b5bc3ada163301f0bbff6f30169d54e6e307613b7a82ed20b2aaedb9d3e204e6852b48488e44777454ebc7114239a9d2d5e112a199458f734ab28d')
 noextract=("${_pkgname}-${pkgver}")
 
 package() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-25 13:11:58	Medium	2
2026-06-19 19:07:35	Clean	2
2026-06-18 18:55:24	Low	2
2026-06-18 16:11:54	Medium	1