joxi

maintainer gyorgykocsis · 12 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt .run binary from dl.joxi.ru (the official Joxi download server, but not a well-known/audited host) and executes it via 'sh ... --noexec --target build' to extract its contents, then installs the extracted binary. The sha512sum provides integrity against accidental corruption but not against a compromised host silently replacing the file at the same URL (the source URL has no version in the path, just 'joxi.run', meaning a future fetch could pull a different binary while the checksum would catch it only if the file changes). The core concern is a closed-source proprietary binary installer from a vendor-controlled CDN with no reproducibility guarantees. This is a real supply-chain concern (executed binary from a non-standard host) but not evidence of active malice, placing it squarely in the medium category.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("${pkgname}-${pkgver}.run::http://dl.joxi.ru/linux/${pkgname}.run")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt .run binary from dl.joxi.ru (the official Joxi download server, but not a well-known/audited host) and executes it via 'sh ... --noexec --target build' to extract its contents, then installs the extracted binary. The sha512sum provides integrity against accidental corruption but not against a compromised host silently replacing the file at the same URL (the source URL has no version in the path, just 'joxi.run', meaning a future fetch could pull a different binary while the checksum would catch it only if the file changes). The core concern is a closed-source proprietary binary installer from a vendor-controlled CDN with no reproducibility guarantees. This is a real supply-chain concern (executed binary from a non-standard host) but not evidence of active malice, placing it squarely in the medium category.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: basigur
    
      2
    
      3pkgname=joxi
    
      4pkgver=3.0.15
    
      5pkgrel=2
    
      6pkgdesc="Free tool for screen capture"
    
      7arch=('x86_64')
    
      8url="http://joxi.net"
    
      9license=('custom')
    
      10depends=('qt5-svg' 'qt5-multimedia' 'qt5-x11extras' 'qt5-wayland' 'openssl-1.0' 'qt5-location' 'rtmpdump')
    
      11source=("${pkgname}-${pkgver}.run::http://dl.joxi.ru/linux/${pkgname}.run")
    
      12options=(!strip)
    
      13sha512sums=('2f6a18b84ca862f6612ecd612cf81ba934b11680ae0fcfd8184cfb8f0d61a11420ec69073e8b39ab06d2971e489e1f4c0c2b6e0720cc2a181021ed99a6770a06')
    
      14
    
      15
    
      16prepare() {
    
      17    sh "${pkgname}-${pkgver}".run --noexec --target build
    
      18
    
      19    cd build
    
      20
    
      21    rm -f install.sh
    
      22
    
      23    find . -type f -exec chmod 644 {} +
    
      24    find . -type d -exec chmod 755 {} +
    
      25    
    
      26    sed -i 's!$HOME!/opt!' joxi.sh
    
      27    sed -i 's! $HOME! /opt!' joxi.sh
    
      28    sed -i 's!Comment=!Comment=Joxi - Screenshots quickly and easily!' joxi.desktop
    
      29    echo "Comment[ru]=Joxi - Скриншоты быстро и легко" >> joxi.desktop
    
      30    echo "Categories=Application;Network;" >> joxi.desktop
    
      31    echo "MimeType=application/x-designer;" >> joxi.desktop
    
      32    echo "GenericName=Joxi - Screenshot tool" >> joxi.desktop
    
      33    echo "GenericName[ru]=Joxi - Создание скриншотов" >> joxi.desktop
    
      34    echo "Exec=joxi" >> joxi.desktop
    
      35    echo "Icon=joxi" >> joxi.desktop
    
      36}
    
      37
    
      38
    
      39package() {
    
      40    install -d "${pkgdir}/usr/bin"
    
      41    install -d "${pkgdir}/opt/${pkgname}"
    
      42    install -d "${pkgdir}"/usr/share/{pixmaps,applications}
    
      43
    
      44    cp -R -P build/* "${pkgdir}"/opt/${pkgname}/
    
      45
    
      46    ln -s ../../../opt/joxi/joxi.desktop "${pkgdir}"/usr/share/applications/"${pkgname}".desktop
    
      47    ln -s ../../../opt/joxi/icon.png "${pkgdir}"/usr/share/pixmaps/"${pkgname}".png
    
      48    ln -s ../../opt/joxi/joxi.sh "${pkgdir}/usr/bin/${pkgname}"
    
      49
    
      50    chmod 755 "${pkgdir}/opt/${pkgname}/joxi.sh"
    
      51    chmod 755 "${pkgdir}/opt/${pkgname}/joxi"
    
      52}
    
      53

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2