keymanager

maintainer fansuregrin · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged A prebuilt, closed-source AppImage is downloaded from keymanager.trustasia.com and executed directly during the build (--appimage-extract runs the binary). TrustAsia is a well-known Chinese CA/PKI vendor and keymanager.org is their certificate management product, so this is plausibly the legitimate vendor host rather than a random third party. However, the download host (keymanager.trustasia.com) differs from the project's stated URL (keymanager.org), there is no PGP signature verification, and the package installs an opaque proprietary binary with no source. The sha256sum provides some integrity guarantee against accidental corruption but not against a compromised vendor host serving a malicious binary. This is a genuine medium-severity supply-chain concern: an executed binary from a host that cannot be independently verified as the canonical upstream release location.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:23 source=("https://keymanager.trustasia.com/release/${_pkgname}.AppImage")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): A prebuilt, closed-source AppImage is downloaded from keymanager.trustasia.com and executed directly during the build (--appimage-extract runs the binary). TrustAsia is a well-known Chinese CA/PKI vendor and keymanager.org is their certificate management product, so this is plausibly the legitimate vendor host rather than a random third party. However, the download host (keymanager.trustasia.com) differs from the project's stated URL (keymanager.org), there is no PGP signature verification, and the package installs an opaque proprietary binary with no source. The sha256sum provides some integrity guarantee against accidental corruption but not against a compromised vendor host serving a malicious binary. This is a genuine medium-severity supply-chain concern: an executed binary from a host that cannot be independently verified as the canonical upstream release location.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Fansure Grin <quarlong@qq.com>
    
      2pkgname='keymanager'
    
      3pkgver=4.4.19
    
      4_pkgname="KeyManager-${pkgver}"
    
      5pkgrel=1
    
      6epoch=
    
      7pkgdesc="Provide safe and convenient certificate application and management"
    
      8arch=('x86_64')
    
      9url="https://keymanager.org/"
    
      10license=('unknown')
    
      11groups=()
    
      12depends=('hicolor-icon-theme')
    
      13makedepends=()
    
      14checkdepends=()
    
      15optdepends=()
    
      16provides=()
    
      17conflicts=()
    
      18replaces=()
    
      19backup=()
    
      20options=(!strip)
    
      21install=
    
      22changelog=
    
      23source=("https://keymanager.trustasia.com/release/${_pkgname}.AppImage")
    
      24sha256sums=('a7f1d262762024412819ea7ed9be7a73bf129b80c1ef3a66c9ae12cf72ddb012')
    
      25noextract=("${_pakname}.AppImage")
    
      26md5sums=()
    
      27validpgpkeys=()
    
      28
    
      29prepare() {
    
      30	cd "${srcdir}" 	
    
      31	chmod a+x "${_pkgname}.AppImage"
    
      32	${srcdir}/${_pkgname}.AppImage --appimage-extract
    
      33	find "squashfs-root/usr/share/icons/hicolor" -type d -exec chmod 755 {} \;
    
      34	sed -i "/^Exec=/c\Exec=/opt/${pkgname}/${_pkgname}.AppImage" "squashfs-root/${pkgname}.desktop"
    
      35}
    
      36
    
      37package() {
    
      38	install -dvm 755 "${pkgdir}/usr/share/icons"
    
      39	install -dvm 755 "${pkgdir}/usr/bin"
    
      40	install -Dvm 755 "${_pkgname}.AppImage" "${pkgdir}/opt/${pkgname}/${_pkgname}.AppImage"
    
      41	ln -sf "/opt/${pkgname}/${_pkgname}.AppImage" "${pkgdir}/usr/bin/${pkgname}"
    
      42	install -Dvm 644 "squashfs-root/${pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      43	cp -R "squashfs-root/usr/share/icons/hicolor" "${pkgdir}/usr/share/icons"
    
      44	rm -rf "squashfs-root"
    
      45}
    
      46

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2