ishell-pro-desktop

maintainer lenn · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads and installs a prebuilt binary (ishell_pro, a Flutter-based SSH client) from down.ishell.cc, which is the vendor's own download subdomain matching the product's official URL (www.ishell.cc). The host appears to be the legitimate vendor distribution point rather than a random personal host, which reduces but does not eliminate supply-chain risk — there is no code-signing or GPG verification, only a sha256sum. The binary is an SSH client that handles credentials and connections, making any compromise particularly impactful. The sha256sum has only 63 hex characters (should be 64), which is a checksum integrity issue. The PKGBUILD also has shell syntax errors (missing spaces in `if [!` and `if [-f`), making it likely broken. Overall: a prebuilt closed-source binary from a vendor subdomain with a malformed checksum and no signature verification is a genuine medium supply-chain concern, not a false positive.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:34 source=("https://down.ishell.cc/ishell_linux_2.0.5.zip")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): This PKGBUILD downloads and installs a prebuilt binary (ishell_pro, a Flutter-based SSH client) from down.ishell.cc, which is the vendor's own download subdomain matching the product's official URL (www.ishell.cc). The host appears to be the legitimate vendor distribution point rather than a random personal host, which reduces but does not eliminate supply-chain risk — there is no code-signing or GPG verification, only a sha256sum. The binary is an SSH client that handles credentials and connections, making any compromise particularly impactful. The sha256sum has only 63 hex characters (should be 64), which is a checksum integrity issue. The PKGBUILD also has shell syntax errors (missing spaces in `if [!` and `if [-f`), making it likely broken. Overall: a prebuilt closed-source binary from a vendor subdomain with a malformed checksum and no signature verification is a genuine medium supply-chain concern, not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Lenn <huangyanjie@huangyanjie.com>
    
      2pkgname=ishell-pro-desktop
    
      3pkginstallname=ishell-pro
    
      4pkgver=2.0.5
    
      5pkgrel=1
    
      6pkgdesc="基于flutter的轻量级功能强大的SSH客户端"
    
      7arch=('x86_64')
    
      8url="https://www.ishell.cc/en"
    
      9license=('unknow')
    
      10depends=(
    
      11	'gtk3'
    
      12	'libayatana-appindicator'
    
      13	'glibc'
    
      14	'gcc-libs'
    
      15	'pango'
    
      16	'cairo'
    
      17	'glib2'
    
      18	'libx11'
    
      19	'libxcb'
    
      20	'zlib'
    
      21	'libpng'
    
      22	'freetype2'
    
      23	'harfbuzz'
    
      24	'atk'
    
      25	'libepoxy'
    
      26	
    
      27)
    
      28optdepends=(
    
      29	'xclip: 剪贴板支持'
    
      30	'libnotify: 桌面通知'
    
      31	'libappindicator-gtk3: 系统托盘支持'
    
      32	'libxtst: 屏幕截图增强'
    
      33)
    
      34source=("https://down.ishell.cc/ishell_linux_2.0.5.zip")
    
      35sha256sums=('3f98cf9af95200d647ee8f61a885bd800b360254141191f45cf8a0a7660b9215')
    
      36
    
      37prepare(){
    
      38
    
      39	if [! -f "$srcdir/ishell_pro"]; then
    
      40		error "Main executable ishell_pro not found in the source!"
    
      41		return 1
    
      42	fi
    
      43}
    
      44
    
      45package() {
    
      46  install -dm755 "$pkgdir/opt/$pkginstallname"
    
      47  #install -dm755 "$pkgdir/usr/bin"
    
      48
    
      49  # 复制全部文件到 /opt
    
      50  cp -r --no-preserve=ownership --preserve=mode \
    
      51	  "$srcdir"/bundle/{data,ishell_pro,lib} \
    
      52	  "$pkgdir/opt/$pkginstallname"
    
      53
    
      54  install -Dm755 /dev/null "$pkgdir/usr/bin/$pkginstallname"
    
      55  cat > "$pkgdir/usr/bin/$pkginstallname" <<EOF
    
      56#!/bin/sh
    
      57cd /opt/$pkginstallname
    
      58exec ./ishell_pro "\$@"
    
      59EOF
    
      60  chmod +x "$pkgdir/usr/bin/$pkginstallname"
    
      61
    
      62
    
      63  install -Dm644 /dev/null "$pkgdir/usr/share/applications/$pkginstallname.desktop"
    
      64  cat > "$pkgdir/usr/share/applications/$pkginstallname.desktop" <<EOF
    
      65[Desktop Entry]
    
      66Name=iShell Pro
    
      67Comment=Modern Flutter-based SSH client
    
      68Exec=$pkginstallname
    
      69Icon=/opt/$pkginstallname/data/flutter_assets/static/img/new_logo_black_512.png
    
      70Terminal=false
    
      71Type=Application
    
      72Categories=Utility;TerminalEmulator;
    
      73StartupWMClass=ishell_pro
    
      74EOF
    
      75	if [-f "$srcdir/data/flutter_assets/static/img/new_logo_black_512.png"]; then
    
      76		install -Dm644 "$srcdir/data/flutter_assets/static/img/new_logo_black_512.png $pkgdir/usr/share/pixmaps/$pkginstallname.png" 
    
      77	fi
    
      78}
    
      79

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2