itarmykit-bin
maintainer lapsus
· 0 votes
· scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged
The package downloads a prebuilt .deb from a non-whitelisted host (download.itarmy.com.ua), which is not the project's main domain and hosts executable content; a compromised or swapped .deb could lead to arbitrary code execution during installation.
Triggered rules
MEDIUM
External download from an untrusted host, not in source=()
external_download_not_in_source
curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.
-
PKGBUILD:27
curl -fsSL https://download.itarmy.com.ua/index.html |
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:23
source=("itarmykit-${pkgver}-amd64.deb::https://download.itarmy.com.ua/releases/${pkgver}/itarmykit-linux-amd64.deb")
MEDIUM
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb from a non-whitelisted host (download.itarmy.com.ua), which is not the project's main domain and hosts executable content; a compromised or swapped .deb could lead to arbitrary code execution during installation.
PKGBUILD
2 offending line(s) highlighted
1
pkgname=itarmykit-bin
2
pkgver=2.3.3
3
pkgrel=1
4
pkgdesc="Desktop shell for BaseTool load-testing workflows"
5
arch=('x86_64')
6
url="https://itarmy.com.ua"
7
license=('GPL-3.0-only')
8
depends=(
9
'alsa-lib'
10
'at-spi2-core'
11
'gtk3'
12
'libnotify'
13
'nss'
14
'util-linux-libs'
15
'xdg-utils'
16
)
17
optdepends=(
18
'libayatana-appindicator: system tray icon support'
19
)
20
provides=('itarmykit')
21
conflicts=('itarmykit')
22
options=('!debug')
23
source=("itarmykit-${pkgver}-amd64.deb::https://download.itarmy.com.ua/releases/${pkgver}/itarmykit-linux-amd64.deb")
24
sha256sums=('c02edeed50fa9d5d11327b60fc59e690f14bd840c67acc3c3fe42b912fd3398b')
25
26
latestver() {
27
curl -fsSL https://download.itarmy.com.ua/index.html |
28
grep -aoE 'data-release="[0-9]+(\.[0-9]+)*"' |
29
sed -nE 's#data-release="([0-9.]+)"#\1#p' | sort -V | tail -1
30
}
31
32
package() {
33
bsdtar -xf "${srcdir}/data.tar.xz" -C "${pkgdir}"
34
35
install -d "${pkgdir}/usr/bin"
36
ln -sf /opt/ITArmyKit/itarmykit "${pkgdir}/usr/bin/itarmykit"
37
38
rm -rf "${pkgdir}/usr/share/doc"
39
}
40
Changes since previous scan
--- PKGBUILD @ 2026-07-28 00:07+++ PKGBUILD @ 2026-08-03 00:08@@ -1,5 +1,5 @@ pkgname=itarmykit-bin-pkgver=2.3.2+pkgver=2.3.3 pkgrel=1 pkgdesc="Desktop shell for BaseTool load-testing workflows" arch=('x86_64')@@ -21,7 +21,7 @@ conflicts=('itarmykit') options=('!debug') source=("itarmykit-${pkgver}-amd64.deb::https://download.itarmy.com.ua/releases/${pkgver}/itarmykit-linux-amd64.deb")-sha256sums=('c6e36383610f06afa47bb16e7a3e8dff17761644be6a58775290cb567508d7d2')+sha256sums=('c02edeed50fa9d5d11327b60fc59e690f14bd840c67acc3c3fe42b912fd3398b') latestver() { curl -fsSL https://download.itarmy.com.ua/index.html |Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | MEDIUM | 3 |
| 2026-08-02 00:16:08 | MEDIUM | 3 |
| 2026-08-01 00:11:18 | MEDIUM | 3 |
| 2026-07-31 00:14:10 | MEDIUM | 3 |
| 2026-07-30 00:17:23 | MEDIUM | 3 |
| 2026-07-29 00:25:53 | MEDIUM | 3 |
| 2026-07-28 01:36:52 | MEDIUM | 3 |
| 2026-07-28 00:07:28 | MEDIUM | 3 |
| 2026-07-27 00:24:32 | MEDIUM | 3 |
| 2026-07-26 17:32:42 | MEDIUM | 3 |
| 2026-07-26 00:07:32 | LOW | 3 |
| 2026-07-25 00:13:44 | LOW | 3 |
| 2026-07-24 00:02:28 | LOW | 3 |
| 2026-07-23 00:14:47 | LOW | 3 |
| 2026-07-22 13:20:28 | MEDIUM | 2 |
| 2026-07-22 00:29:32 | MEDIUM | 3 |
| 2026-07-21 00:24:15 | MEDIUM | 3 |
| 2026-07-20 15:14:11 | MEDIUM | 3 |
| 2026-07-20 00:19:49 | MEDIUM | 3 |
| 2026-07-19 00:17:08 | MEDIUM | 3 |