insync-caja

MEDIUM

maintainer yurikoles 2 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package downloads a prebuilt .deb from a non-whitelisted host (insync.io), which is not a standard AUR source; while insync.io is the official vendor domain, the use of a binary package from a non-standard URL pattern introduces a supply-chain risk if the source were swapped, though the checksum is verified.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 source=("https://apt.insync.io/ubuntu/pool/contrib/i/${pkgname}/${pkgname}_${pkgver}_all.deb")

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt .deb from a non-whitelisted host (insync.io), which is not a standard AUR source; while insync.io is the official vendor domain, the use of a binary package from a non-standard URL pattern introduces a supply-chain risk if the source were swapped, though the checksum is verified.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Yurii Kolesnykov <root@yurikoles.com>
    
      2# Previous maintainer: Erik Dubois <erik.dubois@gmail.com>
    
      3# Previous maintainer: Mark Weiman <mark dot weiman at markzz dot com>
    
      4# Contributor: Zhengyu Xu <xzy3186@gmail.com>
    
      5
    
      6pkgname=insync-caja
    
      7pkgver=3.9.5.60024
    
      8pkgrel=1
    
      9pkgdesc="Caja integration for insync"
    
      10url="https://www.insynchq.com/downloads"
    
      11license=('custom:insync')
    
      12options=(!strip)
    
      13arch=('any')
    
      14depends=(
    
      15	'caja'
    
      16	'insync'
    
      17	'python-caja'
    
      18)
    
      19source=("https://apt.insync.io/ubuntu/pool/contrib/i/${pkgname}/${pkgname}_${pkgver}_all.deb")
    
      20sha256sums=('cbbe0d56e97158388209d3f52a96170a2a9b0cebc72527c58b79a405222eef4d')
    
      21
    
      22package() {
    
      23   tar xf data.tar.gz
    
      24   cp -a usr "${pkgdir}"
    
      25}
    
      26

Changes since previous scan

--- PKGBUILD @ 2026-06-20 16:03
+++ PKGBUILD @ 2026-10-17 00:21
@@ -4,7 +4,7 @@
 # Contributor: Zhengyu Xu <xzy3186@gmail.com>
 
 pkgname=insync-caja
-pkgver=3.7.9.50368
+pkgver=3.9.5.60024
 pkgrel=1
 pkgdesc="Caja integration for insync"
 url="https://www.insynchq.com/downloads"
@@ -14,11 +14,10 @@
 depends=(
 	'caja'
 	'insync'
-	'insync-emblem-icons'
 	'python-caja'
 )
 source=("https://apt.insync.io/ubuntu/pool/contrib/i/${pkgname}/${pkgname}_${pkgver}_all.deb")
-sha256sums=('b2fce7ec636b683d65056eeaa48cd5484492627a4541492376dedd945ef23ce8')
+sha256sums=('cbbe0d56e97158388209d3f52a96170a2a9b0cebc72527c58b79a405222eef4d')
 
 package() {
    tar xf data.tar.gz

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2
2026-10-13 00:23:45	Medium	2
2026-10-12 05:12:20	Medium	2
2026-06-20 16:03:41	Clean	2
2026-06-20 00:50:07	Medium	2
2026-06-20 00:18:46	Medium	1
2026-06-19 23:51:18	Medium	2
2026-06-19 19:07:35	Low	2
2026-06-18 16:11:54	Medium	1