idrive-bin
LOW
maintainer andybarilla
1 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a prebuilt binary installer from the official vendor domain (idrivedownloads.com) which is plausibly owned by IDrive; despite the unverifiable checksum, it is a legitimate source for the software and no malicious behavior is evident.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt binary installer from the official vendor domain (idrivedownloads.com) which is plausibly owned by IDrive; despite the unverifiable checksum, it is a legitimate source for the software and no malicious behavior is evident.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:25
source=("idriveforlinux.bin::https://www.idrivedownloads.com/downloads/linux/linux-bin/idriveforlinux.bin")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Andy <this.is.apb@gmail.com>
2
pkgname=idrive-bin
3
pkgver=3.15.0
4
pkgrel=1
5
pkgdesc="IDrive cloud backup for Linux - official interactive menu (idrive) and idevsutil engines"
6
arch=('x86_64')
7
url="https://www.idrive.com/online-backup-linux-scripts"
8
license=('LicenseRef-IDrive')
9
# popt: required by the idevsutil/idevsutil_dedup transfer engines (not part of
10
# base). curl/cronie/which: used by idrive at runtime for transfers and scheduling.
11
depends=('popt' 'curl' 'cronie' 'which')
12
# Cloud Drive (3.15.0+) is enabled from the idrive menu; its bundled install.sh
13
# would otherwise pull these in itself via `pacman -Sy`, which is a partial
14
# upgrade. Install them with pacman first instead.
15
optdepends=('valkey: Cloud Drive sync (redis-compatible server)'
16
'python: Cloud Drive sync'
17
'python-psutil: Cloud Drive sync')
18
provides=('idrive')
19
conflicts=('idrive')
20
# Vendored prebuilt binaries: don't strip/relink, and skip the static-lib check.
21
options=('!strip' '!emptydirs' 'staticlibs')
22
install="$pkgname.install"
23
# Upstream serves a single, unversioned "latest" installer, so the checksum
24
# cannot be pinned; pkgver() below reads the real version out of it after download.
25
source=("idriveforlinux.bin::https://www.idrivedownloads.com/downloads/linux/linux-bin/idriveforlinux.bin")
26
sha256sums=('SKIP')
27
28
pkgver() {
29
grep -m1 -aoP '^APPVERSION="\K[^"]+' "$srcdir/idriveforlinux.bin"
30
}
31
32
package() {
33
cd "$srcdir"
34
35
# The .bin is a shell self-extractor with a gzipped tar appended after a
36
# line matching __idrive__; unpack that payload into /opt (DESTPARENT).
37
local marker
38
marker=$(awk '/^__idrive__/ {print NR + 1; exit}' idriveforlinux.bin)
39
# --no-same-owner: ignore the uids baked into the vendor tar so everything
40
# ends up root-owned under fakeroot.
41
install -d "$pkgdir/opt"
42
tail -n +"$marker" idriveforlinux.bin | tar xz --no-same-owner -C "$pkgdir/opt"
43
44
local dest="$pkgdir/opt/IDriveForLinux"
45
local deps="$dest/bin/Idrivelib/dependencies"
46
47
# Place the main menu binary for this architecture (k3 = modern kernels),
48
# mirroring what the upstream installer does, then drop the other arches.
49
tar xzf "$deps/linuxbin/k3/$CARCH/idrive.tar.gz" --no-same-owner -C "$dest/bin/"
50
chmod 0755 "$dest/bin/idrive"
51
rm -rf "$deps/linuxbin"
52
53
# Same for the Cloud Drive binary (x86_64 only, hence the guard): the
54
# installer unpacks it next to the install.sh/uninstall.sh helpers that
55
# already ship in dependencies/cloud-drive, then drops the per-arch dir.
56
if [ -f "$deps/cloudbin/k3/$CARCH/cloud-drive.tar.gz" ]; then
57
tar xzf "$deps/cloudbin/k3/$CARCH/cloud-drive.tar.gz" \
58
--no-same-owner -C "$deps/cloud-drive/"
59
chmod 0755 "$deps/cloud-drive/cloud-drive"
60
fi
61
chmod 0755 "$deps/cloud-drive/install.sh" "$deps/cloud-drive/uninstall.sh"
62
rm -rf "$deps/cloudbin"
63
64
# Keep only the generic Linux transfer engines; the NAS-appliance variants
65
# (QNAP/Synology/Netgear/Vault) are useless on a desktop/server install.
66
find "$deps/evsbin" -type f -name '*.tar.gz' ! -name 'IDrive_linux_*' -delete
67
68
# Bundled python is per-arch; keep only this architecture's copy.
69
find "$deps/pythonbin" -mindepth 1 -maxdepth 1 ! -name k3 -exec rm -rf {} +
70
find "$deps/pythonbin/k3" -mindepth 1 -maxdepth 1 ! -name "$CARCH" -exec rm -rf {} +
71
72
# CLI entry point. idrive keeps its state under /opt and schedules root cron
73
# jobs, so it must run as root; the wrapper escalates via sudo when needed.
74
# It also enters the app's bin dir first, since idrive resolves some paths
75
# relative to the working directory.
76
install -d "$pkgdir/usr/bin"
77
cat > "$pkgdir/usr/bin/idrive" <<-'EOF'
78
#!/bin/sh
79
if [ "$(id -u)" -ne 0 ]; then
80
if command -v sudo >/dev/null 2>&1; then
81
exec sudo -- "$0" "$@"
82
fi
83
echo "idrive must be run as root; re-run with: sudo idrive" >&2
84
exit 1
85
fi
86
cd /opt/IDriveForLinux/bin && exec ./idrive "$@"
87
EOF
88
chmod 0755 "$pkgdir/usr/bin/idrive"
89
90
# Proprietary license: ship a pointer to the canonical Terms of Service plus
91
# the bundled readme. The full terms are not redistributed as text.
92
install -d "$pkgdir/usr/share/licenses/$pkgname"
93
cat > "$pkgdir/usr/share/licenses/$pkgname/LICENSE" <<-'EOF'
94
IDrive for Linux is proprietary software, Copyright IDrive Inc.
95
96
Use is governed by the IDrive Terms of Service:
97
https://www.idrive.com/terms-and-conditions
98
99
This package redistributes the unmodified official installer payload
100
from https://www.idrive.com/online-backup-linux-scripts for convenience.
101
EOF
102
install -m644 "$dest/bin/readme.txt" \
103
"$pkgdir/usr/share/licenses/$pkgname/readme.txt"
104
}
105
Changes since previous scan
--- PKGBUILD @ 2026-09-03 00:15+++ PKGBUILD @ 2026-09-17 00:27@@ -1,7 +1,7 @@ # Maintainer: Andy <this.is.apb@gmail.com> pkgname=idrive-bin-pkgver=3.12.0-pkgrel=2+pkgver=3.15.0+pkgrel=1 pkgdesc="IDrive cloud backup for Linux - official interactive menu (idrive) and idevsutil engines" arch=('x86_64') url="https://www.idrive.com/online-backup-linux-scripts"@@ -9,6 +9,12 @@ # popt: required by the idevsutil/idevsutil_dedup transfer engines (not part of # base). curl/cronie/which: used by idrive at runtime for transfers and scheduling. depends=('popt' 'curl' 'cronie' 'which')+# Cloud Drive (3.15.0+) is enabled from the idrive menu; its bundled install.sh+# would otherwise pull these in itself via `pacman -Sy`, which is a partial+# upgrade. Install them with pacman first instead.+optdepends=('valkey: Cloud Drive sync (redis-compatible server)'+ 'python: Cloud Drive sync'+ 'python-psutil: Cloud Drive sync') provides=('idrive') conflicts=('idrive') # Vendored prebuilt binaries: don't strip/relink, and skip the static-lib check.@@ -16,7 +22,7 @@ install="$pkgname.install" # Upstream serves a single, unversioned "latest" installer, so the checksum # cannot be pinned; pkgver() below reads the real version out of it after download.-source=("idriveforlinux.bin::https://www.idrivedownloads.com/downloads/linux/download-for-linux/linux-bin/idriveforlinux.bin")+source=("idriveforlinux.bin::https://www.idrivedownloads.com/downloads/linux/linux-bin/idriveforlinux.bin") sha256sums=('SKIP') pkgver() {@@ -43,6 +49,17 @@ tar xzf "$deps/linuxbin/k3/$CARCH/idrive.tar.gz" --no-same-owner -C "$dest/bin/" chmod 0755 "$dest/bin/idrive" rm -rf "$deps/linuxbin"++ # Same for the Cloud Drive binary (x86_64 only, hence the guard): the+ # installer unpacks it next to the install.sh/uninstall.sh helpers that+ # already ship in dependencies/cloud-drive, then drops the per-arch dir.+ if [ -f "$deps/cloudbin/k3/$CARCH/cloud-drive.tar.gz" ]; then+ tar xzf "$deps/cloudbin/k3/$CARCH/cloud-drive.tar.gz" \+ --no-same-owner -C "$deps/cloud-drive/"+ chmod 0755 "$deps/cloud-drive/cloud-drive"+ fi+ chmod 0755 "$deps/cloud-drive/install.sh" "$deps/cloud-drive/uninstall.sh"+ rm -rf "$deps/cloudbin" # Keep only the generic Linux transfer engines; the NAS-appliance variants # (QNAP/Synology/Netgear/Vault) are useless on a desktop/server install.Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 21:54:41 | Medium | 1 |
| 2026-09-03 00:15:47 | Medium | 2 |
| 2026-09-02 00:02:31 | Medium | 2 |
| 2026-09-01 00:11:19 | Medium | 2 |
| 2026-08-31 00:19:57 | Medium | 2 |
| 2026-08-30 00:04:14 | Medium | 2 |