imdone-bin

maintainer WarmConsidering · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary .deb from imdone.io (the official vendor domain) and installs it directly without building from source. While the host is the official vendor site and not a personal/unofficial host, this is still a prebuilt binary being executed on the user's system with no way to verify it was built from the published source. The sha512sum is provided for the .deb (though it appears truncated/odd length - 127 hex chars instead of 128, which could indicate a copy-paste error). The EULA is SKIPped for checksum. The pattern of installing a vendor-supplied binary .deb is standard for -bin AUR packages and the source host is legitimate, but the binary execution concern is real and the checksum appears malformed (127 characters instead of the expected 128 for sha512). This warrants medium rather than clean, primarily due to the prebuilt binary nature and the suspicious checksum length.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("https://imdone.io/downloads/${_pkgname}-${pkgver}.deb"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from imdone.io (the official vendor domain) and installs it directly without building from source. While the host is the official vendor site and not a personal/unofficial host, this is still a prebuilt binary being executed on the user's system with no way to verify it was built from the published source. The sha512sum is provided for the .deb (though it appears truncated/odd length - 127 hex chars instead of 128, which could indicate a copy-paste error). The EULA is SKIPped for checksum. The pattern of installing a vendor-supplied binary .deb is standard for -bin AUR packages and the source host is legitimate, but the binary execution concern is real and the checksum appears malformed (127 characters instead of the expected 128 for sha512). This warrants medium rather than clean, primarily due to the prebuilt binary nature and the suspicious checksum length.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  Al S <tei8ho.aur.al@ila5.info>
    
      2pkgname=imdone-bin
    
      3_pkgname=imdone
    
      4pkgver=1.54.1
    
      5pkgrel=1
    
      6pkgdesc="Simple and powerful kanban board that works on top of a local folder of plain text markdown files or code."
    
      7arch=('i686' 'x86_64')
    
      8provides=('imdone')
    
      9url="https://imdone.io/"
    
      10license=('custom:imdone')
    
      11groups=()
    
      12depends=('gtk3' 'nss')
    
      13replaces=()
    
      14backup=()
    
      15options=()
    
      16source=("https://imdone.io/downloads/${_pkgname}-${pkgver}.deb"
    
      17  'https://imdone.io/eula')
    
      18sha512sums=('30f78582f11a8ccd5494c9a95733666218c89876aa1fa4b47e820c51686da0cdfc1054f112f56070157760c857d9b673ae5099f264c779cad613058dcc7d2538'
    
      19  'SKIP')
    
      20package() {
    
      21  install -Dm644 eula "${pkgdir}/usr/share/licenses/${_pkgname}/eula.html"
    
      22  bsdtar -xf data.tar.xz -C "$pkgdir/"
    
      23  mkdir "${pkgdir}/usr/bin"
    
      24  ln -s "/opt/${_pkgname}/${_pkgname}" "${pkgdir}/usr/bin/${_pkgname}"
    
      25}
    
      26# vim:set ts=2 sw=2 et:
    
      27

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2