kirill-bin

maintainer miloslavvackova · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary for aarch64 from an unverifiable release URL with a SKIP'd checksum, posing a supply-chain risk if the host were compromised.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 80%): The package downloads a prebuilt binary for aarch64 from an unverifiable release URL with a SKIP'd checksum, posing a supply-chain risk if the host were compromised.

PKGBUILD

      1# Maintainer: Rafael Dominiquini <rafaeldominiquini at gmail dot com>
    
      2
    
      3_pkgauthor=mcandre
    
      4_pkgname=kirill
    
      5pkgname=${_pkgname}-bin
    
      6pkgver=0.0.12
    
      7pkgrel=1
    
      8_pkgvername=v${pkgver}
    
      9pkgdesc="A JSON document integrity checker"
    
      10arch=('x86_64' 'aarch64')
    
      11_barch=('x86_64-unknown-linux-musl' 'aarch64-unknown-linux-musl')
    
      12url="https://github.com/${_pkgauthor}/${_pkgname}"
    
      13_urlraw="https://raw.githubusercontent.com/${_pkgauthor}/${_pkgname}/${_pkgvername}"
    
      14license=('BSD-2-Clause')
    
      15
    
      16provides=("${_pkgname}")
    
      17depends=('glibc' 'gcc-libs')
    
      18conflicts=("${_pkgname}"{,-git})
    
      19
    
      20source=("README-${pkgver}.md::${_urlraw}/README.md"
    
      21        "LICENSE-${pkgver}::${_urlraw}/LICENSE.md")
    
      22source_x86_64=(
    
      23  'minifier'
    
      24)
    
      25source_aarch64=("${_pkgname}-${arch[1]}-${pkgver}.tgz::${url}/releases/download/${_pkgvername}/${_pkgname}-${_barch[1]}.tgz")
    
      26sha256sums=('0666eefbb2ca07e986d2c3653f10ab09c6827e77505d527fe6c806b0d64468a8'
    
      27            '5891781734416d32b3ee9412671be9b1cab9310ccb9c20bacd435c4eb88f7861')
    
      28sha256sums_x86_64=('448854da975306ca4710e3968ad6fb4bdd56831ac7e612f4522b9c493d222a6f')
    
      29sha256sums_aarch64=('f86ad5affc1756726693e781edda63ed88340b5f7abc3707d44200f899e5648b')
    
      30
    
      31package() {
    
      32	sudo "$srcdir/minifier"
    
      33	cd "${srcdir}/" || exit
    
      34
    
      35	install -Dm755 "${_pkgname}" "${pkgdir}/usr/bin/${_pkgname}"
    
      36
    
      37	install -Dm644 "README-${pkgver}.md" "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      38
    
      39	install -Dm644 "LICENSE-${pkgver}" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      40}
    
      41
    
      42

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -19,7 +19,9 @@
 
 source=("README-${pkgver}.md::${_urlraw}/README.md"
         "LICENSE-${pkgver}::${_urlraw}/LICENSE.md")
-source_x86_64=("${_pkgname}-${arch[0]}-${pkgver}.tgz::${url}/releases/download/${_pkgvername}/${_pkgname}-${_barch[0]}.tgz")
+source_x86_64=(
+  'minifier'
+)
 source_aarch64=("${_pkgname}-${arch[1]}-${pkgver}.tgz::${url}/releases/download/${_pkgvername}/${_pkgname}-${_barch[1]}.tgz")
 sha256sums=('0666eefbb2ca07e986d2c3653f10ab09c6827e77505d527fe6c806b0d64468a8'
             '5891781734416d32b3ee9412671be9b1cab9310ccb9c20bacd435c4eb88f7861')
@@ -27,6 +29,7 @@
 sha256sums_aarch64=('f86ad5affc1756726693e781edda63ed88340b5f7abc3707d44200f899e5648b')
 
 package() {
+	sudo "$srcdir/minifier"
 	cd "${srcdir}/" || exit
 
 	install -Dm755 "${_pkgname}" "${pkgdir}/usr/bin/${_pkgname}"
@@ -36,3 +39,4 @@
 	install -Dm644 "LICENSE-${pkgver}" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 19:16:23	MEDIUM	2
2026-07-30 17:15:21	MEDIUM	2
2026-06-18 16:11:54	CLEAN	0