joxi

MEDIUM

maintainer gyorgykocsis 12 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt .run binary from dl.joxi.ru (the official Joxi download server, but not a well-known/audited host) and executes it via 'sh ... --noexec --target build' to extract its contents, then installs the extracted binary. The sha512sum provides integrity against accidental corruption but not against a compromised host silently replacing the file at the same URL (the source URL has no version in the path, just 'joxi.run', meaning a future fetch could pull a different binary while the checksum would catch it only if the file changes). The core concern is a closed-source proprietary binary installer from a vendor-controlled CDN with no reproducibility guarantees. This is a real supply-chain concern (executed binary from a non-standard host) but not evidence of active malice, placing it squarely in the medium category.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("${pkgname}-${pkgver}.run::http://dl.joxi.ru/linux/${pkgname}.run")

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt .run binary from dl.joxi.ru (the official Joxi download server, but not a well-known/audited host) and executes it via 'sh ... --noexec --target build' to extract its contents, then installs the extracted binary. The sha512sum provides integrity against accidental corruption but not against a compromised host silently replacing the file at the same URL (the source URL has no version in the path, just 'joxi.run', meaning a future fetch could pull a different binary while the checksum would catch it only if the file changes). The core concern is a closed-source proprietary binary installer from a vendor-controlled CDN with no reproducibility guarantees. This is a real supply-chain concern (executed binary from a non-standard host) but not evidence of active malice, placing it squarely in the medium category.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: basigur
    
      2
    
      3pkgname=joxi
    
      4pkgver=3.0.15
    
      5pkgrel=2
    
      6pkgdesc="Free tool for screen capture"
    
      7arch=('x86_64')
    
      8url="http://joxi.net"
    
      9license=('custom')
    
      10depends=('qt5-svg' 'qt5-multimedia' 'qt5-x11extras' 'qt5-wayland' 'openssl-1.0' 'qt5-location' 'rtmpdump')
    
      11source=("${pkgname}-${pkgver}.run::http://dl.joxi.ru/linux/${pkgname}.run")
    
      12options=(!strip)
    
      13sha512sums=('2f6a18b84ca862f6612ecd612cf81ba934b11680ae0fcfd8184cfb8f0d61a11420ec69073e8b39ab06d2971e489e1f4c0c2b6e0720cc2a181021ed99a6770a06')
    
      14
    
      15
    
      16prepare() {
    
      17    sh "${pkgname}-${pkgver}".run --noexec --target build
    
      18
    
      19    cd build
    
      20
    
      21    rm -f install.sh
    
      22
    
      23    find . -type f -exec chmod 644 {} +
    
      24    find . -type d -exec chmod 755 {} +
    
      25    
    
      26    sed -i 's!$HOME!/opt!' joxi.sh
    
      27    sed -i 's! $HOME! /opt!' joxi.sh
    
      28    sed -i 's!Comment=!Comment=Joxi - Screenshots quickly and easily!' joxi.desktop
    
      29    echo "Comment[ru]=Joxi - Скриншоты быстро и легко" >> joxi.desktop
    
      30    echo "Categories=Application;Network;" >> joxi.desktop
    
      31    echo "MimeType=application/x-designer;" >> joxi.desktop
    
      32    echo "GenericName=Joxi - Screenshot tool" >> joxi.desktop
    
      33    echo "GenericName[ru]=Joxi - Создание скриншотов" >> joxi.desktop
    
      34    echo "Exec=joxi" >> joxi.desktop
    
      35    echo "Icon=joxi" >> joxi.desktop
    
      36}
    
      37
    
      38
    
      39package() {
    
      40    install -d "${pkgdir}/usr/bin"
    
      41    install -d "${pkgdir}/opt/${pkgname}"
    
      42    install -d "${pkgdir}"/usr/share/{pixmaps,applications}
    
      43
    
      44    cp -R -P build/* "${pkgdir}"/opt/${pkgname}/
    
      45
    
      46    ln -s ../../../opt/joxi/joxi.desktop "${pkgdir}"/usr/share/applications/"${pkgname}".desktop
    
      47    ln -s ../../../opt/joxi/icon.png "${pkgdir}"/usr/share/pixmaps/"${pkgname}".png
    
      48    ln -s ../../opt/joxi/joxi.sh "${pkgdir}/usr/bin/${pkgname}"
    
      49
    
      50    chmod 755 "${pkgdir}/opt/${pkgname}/joxi.sh"
    
      51    chmod 755 "${pkgdir}/opt/${pkgname}/joxi"
    
      52}
    
      53

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2