itarmykit-bin

maintainer lapsus · 0 votes · scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged The package downloads a prebuilt .deb from a non-whitelisted host (download.itarmy.com.ua), which is not the project's main domain and hosts executable content; a compromised or swapped .deb could lead to arbitrary code execution during installation.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

  • PKGBUILD:27 curl -fsSL https://download.itarmy.com.ua/index.html |
MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:23 source=("itarmykit-${pkgver}-amd64.deb::https://download.itarmy.com.ua/releases/${pkgver}/itarmykit-linux-amd64.deb")
MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb from a non-whitelisted host (download.itarmy.com.ua), which is not the project's main domain and hosts executable content; a compromised or swapped .deb could lead to arbitrary code execution during installation.

PKGBUILD

2 offending line(s) highlighted
1pkgname=itarmykit-bin
2pkgver=2.3.3
3pkgrel=1
4pkgdesc="Desktop shell for BaseTool load-testing workflows"
5arch=('x86_64')
6url="https://itarmy.com.ua"
7license=('GPL-3.0-only')
8depends=(
9 'alsa-lib'
10 'at-spi2-core'
11 'gtk3'
12 'libnotify'
13 'nss'
14 'util-linux-libs'
15 'xdg-utils'
16)
17optdepends=(
18 'libayatana-appindicator: system tray icon support'
19)
20provides=('itarmykit')
21conflicts=('itarmykit')
22options=('!debug')
23source=("itarmykit-${pkgver}-amd64.deb::https://download.itarmy.com.ua/releases/${pkgver}/itarmykit-linux-amd64.deb")
24sha256sums=('c02edeed50fa9d5d11327b60fc59e690f14bd840c67acc3c3fe42b912fd3398b')
25
26latestver() {
27 curl -fsSL https://download.itarmy.com.ua/index.html |
28 grep -aoE 'data-release="[0-9]+(\.[0-9]+)*"' |
29 sed -nE 's#data-release="([0-9.]+)"#\1#p' | sort -V | tail -1
30}
31
32package() {
33 bsdtar -xf "${srcdir}/data.tar.xz" -C "${pkgdir}"
34
35 install -d "${pkgdir}/usr/bin"
36 ln -sf /opt/ITArmyKit/itarmykit "${pkgdir}/usr/bin/itarmykit"
37
38 rm -rf "${pkgdir}/usr/share/doc"
39}
40

Changes since previous scan

--- PKGBUILD @ 2026-07-28 00:07
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,5 +1,5 @@
pkgname=itarmykit-bin
-pkgver=2.3.2
+pkgver=2.3.3
pkgrel=1
pkgdesc="Desktop shell for BaseTool load-testing workflows"
arch=('x86_64')
@@ -21,7 +21,7 @@
conflicts=('itarmykit')
options=('!debug')
source=("itarmykit-${pkgver}-amd64.deb::https://download.itarmy.com.ua/releases/${pkgver}/itarmykit-linux-amd64.deb")
-sha256sums=('c6e36383610f06afa47bb16e7a3e8dff17761644be6a58775290cb567508d7d2')
+sha256sums=('c02edeed50fa9d5d11327b60fc59e690f14bd840c67acc3c3fe42b912fd3398b')
latestver() {
curl -fsSL https://download.itarmy.com.ua/index.html |

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 MEDIUM 3
2026-08-02 00:16:08 MEDIUM 3
2026-08-01 00:11:18 MEDIUM 3
2026-07-31 00:14:10 MEDIUM 3
2026-07-30 00:17:23 MEDIUM 3
2026-07-29 00:25:53 MEDIUM 3
2026-07-28 01:36:52 MEDIUM 3
2026-07-28 00:07:28 MEDIUM 3
2026-07-27 00:24:32 MEDIUM 3
2026-07-26 17:32:42 MEDIUM 3
2026-07-26 00:07:32 LOW 3
2026-07-25 00:13:44 LOW 3
2026-07-24 00:02:28 LOW 3
2026-07-23 00:14:47 LOW 3
2026-07-22 13:20:28 MEDIUM 2
2026-07-22 00:29:32 MEDIUM 3
2026-07-21 00:24:15 MEDIUM 3
2026-07-20 15:14:11 MEDIUM 3
2026-07-20 00:19:49 MEDIUM 3
2026-07-19 00:17:08 MEDIUM 3

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion