keeex

maintainer keeex · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary zip (keeex.linux64.zip) from downloads.keeex.io, which is the vendor's own download host (keeex.me is the official site, downloads.keeex.io is their CDN/download subdomain). The binary is checksummed with sha512. However, the URL uses 'latest' in the path rather than a versioned path, meaning the checksum could become stale or mismatched if the upstream updates the file without changing the URL — though the sha512 provides integrity verification at build time. The main concern is that this is a closed-source prebuilt binary being installed to /opt and symlinked into /usr/bin, with no source build. This is a legitimate medium-risk supply-chain concern: if downloads.keeex.io is compromised or the binary is replaced, users get arbitrary code execution. The host appears to be the official vendor host rather than a personal/unofficial mirror, which reduces (but does not eliminate) the risk. The 'latest' URL pattern is also concerning as it could serve different content over time despite the pinned checksum protecting individual builds.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source=("https://downloads.keeex.io/latest/keeex.linux64.zip"
PKGBUILD:19 "https://keeex.me/pkgfiles/icon.png"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary zip (keeex.linux64.zip) from downloads.keeex.io, which is the vendor's own download host (keeex.me is the official site, downloads.keeex.io is their CDN/download subdomain). The binary is checksummed with sha512. However, the URL uses 'latest' in the path rather than a versioned path, meaning the checksum could become stale or mismatched if the upstream updates the file without changing the URL — though the sha512 provides integrity verification at build time. The main concern is that this is a closed-source prebuilt binary being installed to /opt and symlinked into /usr/bin, with no source build. This is a legitimate medium-risk supply-chain concern: if downloads.keeex.io is compromised or the binary is replaced, users get arbitrary code execution. The host appears to be the official vendor host rather than a personal/unofficial mirror, which reduces (but does not eliminate) the risk. The 'latest' URL pattern is also concerning as it could serve different content over time despite the pinned checksum protecting individual builds.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Alexandre Pujol <alexandre@pujol.io>
    
      2# Contributor: Maxence Mohr <maxence@keeex.net>
    
      3
    
      4pkgname='keeex'
    
      5pkgver=4.0.0
    
      6pkgrel=1
    
      7pkgdesc='Fully operational blockchain solutions for securing, chaining, sharing, signing and timestamping any kind of document, data or process with no alteration.'
    
      8arch=('x86_64')
    
      9url='https://keeex.me/'
    
      10license=('custom')
    
      11depends=('hidapi'
    
      12         'libxtst'
    
      13         'gtk2'
    
      14         'nss'
    
      15         'alsa-lib'
    
      16         'gconf'
    
      17         'libnotify')
    
      18source=("https://downloads.keeex.io/latest/keeex.linux64.zip"
    
      19        "https://keeex.me/pkgfiles/icon.png"
    
      20        "keeex.desktop"
    
      21        "https://keeex.me/pkgfiles/LICENSE")
    
      22sha512sums=('f7a2f908d75028c0b094e8ba869da9bdaf7c77eda7b0d1401d53fcf85bdbab80068eb770d4f84055f0acd4008f2c2e47ab7e15b60ca713320266d66bb877dc38'
    
      23            'a0dd5edb226531602db1e5796327f0674fcc944ab4868e1b96d9028f6c6756b08cb71654cac6249f87700427a4c9057c1f36389b53055ca3714628a2930f6da7'
    
      24            '9417f1ca69983735407e76eb308e4bd7de3129dca7d92ed4d23569e11afad5611387fdf2148006fcb870b052635c2e646e4e8a4d761119884ead32d4c7fc6930'
    
      25            'ed5e531303fefc75b839a5778fd4e83166d0263bc1aa68672919dee013eda391b61b34600c580ed7ab5f94e70523ce64e0679bac18dc25a25230c032b00d5b56')
    
      26_execname="KeeeX"
    
      27_target_dir="/opt"
    
      28options=("!strip")
    
      29
    
      30prepare() {
    
      31  cd "${srcdir}"
    
      32  chmod +x "${_execname}"
    
      33}
    
      34
    
      35package() {
    
      36  OPT_PATH="${pkgdir}${_target_dir}/${pkgname}"
    
      37
    
      38  # create folder
    
      39  install -dm755 "${OPT_PATH}"
    
      40  install -dm755 "${pkgdir}/usr/bin"
    
      41
    
      42  # Program
    
      43  cp -r * "${OPT_PATH}/"
    
      44
    
      45  # Remove symlink (zip should have a folder on top level to prevent that crappy solution)
    
      46  rm ${OPT_PATH}/{icon.png,keeex.desktop,keeex.linux64.zip,LICENSE}
    
      47
    
      48  # Link to program
    
      49  ln -s "${_target_dir}/${pkgname}/${_execname}" "${pkgdir}/usr/bin/${_execname,,}"
    
      50
    
      51  # Desktop file
    
      52  install -Dm644 "keeex.desktop" "${pkgdir}/usr/share/applications/keeex.desktop"
    
      53
    
      54  # Copy license
    
      55  install -Dm644 "LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      56}
    
      57

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2