ksa

maintainer taotieren · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt binary from the project's official domain (ksa.kanxue.com), which is plausibly the project's own release infrastructure; the binary is installed to /opt and exposed via symlink, but the source is not untrusted in a way that enables silent third-party tampering.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt binary from the project's official domain (ksa.kanxue.com), which is plausibly the project's own release infrastructure; the binary is installed to /opt and exposed via symlink, but the source is not untrusted in a way that enables silent third-party tampering.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source=("KSA_${pkgver}.zip::https://ksa.kanxue.com/view/img/product/KSA_${pkgver}.zip"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: taotieren <admin@taotieren.com>
    
      2
    
      3pkgname=ksa
    
      4pkgver=0.80
    
      5pkgrel=2
    
      6#epoch=0
    
      7pkgdesc="Kanxue Security Access. 看雪安全接入,无需公网IP,远程接入内网"
    
      8arch=('i686' 'x86_64' 'armv7h' 'aarch64' )
    
      9license=('unknow')
    
      10#groups=('')
    
      11depends=('unzip')
    
      12#source_x86_64=("KSA_${pkgver}_linux_x86_64.zip::KSA_${pkgver}_linux.zip")
    
      13#source_i686=("KSA_${pkgver}_linux_i686.zip::KSA_${pkgver}_linux.zip")
    
      14#source_armv7h=("KSA_${pkgver}_linux_arm.zip::KSA_${pkgver}_linux.zip")
    
      15#source_aarch64=("KSA_${pkgver}_linux_arm64.zip::KSA_${pkgver}_linux.zip")
    
      16
    
      17source=("KSA_${pkgver}.zip::https://ksa.kanxue.com/view/img/product/KSA_${pkgver}.zip"
    
      18    "ksa.service")
    
      19#desktops=("ksa-linux.desktop")
    
      20#source+=(${desktops[@]})
    
      21#sha256sums_i686=('b4cafff1b7ee02ec404ca784d8605d4d61f7fdc4551baebb56cbaa08770359ce')
    
      22#sha256sums_x86_64=('b4cafff1b7ee02ec404ca784d8605d4d61f7fdc4551baebb56cbaa08770359ce')
    
      23#sha256sums_armv7h=('b4cafff1b7ee02ec404ca784d8605d4d61f7fdc4551baebb56cbaa08770359ce')
    
      24#sha256sums_aarch64=('b4cafff1b7ee02ec404ca784d8605d4d61f7fdc4551baebb56cbaa08770359ce')
    
      25
    
      26sha256sums=('168fbb25a106f170fa626871c7b1653c72b57a4e3ead082d81f4504f8ed8280f'
    
      27    '44bebc2bfddc4f0b3873f7ae68c7b7d0c4d49edd1a63795062b3a2198c37fb77')
    
      28
    
      29#install=$pkgname.install
    
      30url="https://ksa.kanxue.com/"
    
      31conflicts=("ksa")
    
      32replaces=("ksa")
    
      33#DLAGENTS=("https::/usr/bin/env curl -o %o -d accept_license_agreement=accepted -d non_emb_ctr=confirmed")
    
      34options=(!strip)
    
      35
    
      36# prepare() {
    
      37#     #Change src path name
    
      38#     if [ ${CARCH} = "i686" ]; then
    
      39#         mv KSA_${pkgver}_linux_i686 KSA
    
      40#     fi
    
      41#     if [ ${CARCH} = "x86_64" ]; then
    
      42#         mv KSA_${pkgver}_linux_x86_64 KSA
    
      43#     fi
    
      44#     if [ ${CARCH} = "armv7h" ]; then
    
      45#         mv KSA_${pkgver}_linux_arm KSA
    
      46#     fi
    
      47#     if [ ${CARCH} = "aarch64" ]; then
    
      48#        mv KSA_${pkgver}_linux_arm64 KSA
    
      49#     fi
    
      50# }
    
      51
    
      52package(){
    
      53    # Match package placement from their .deb, in /opt
    
      54    install -dm755 "${pkgdir}/opt/KSA" \
    
      55            "${pkgdir}/usr/bin/"
    
      56
    
      57    install -Dm644 "${srcdir}/ksa.service" "${pkgdir}/usr/lib/systemd/system/ksa.service"
    
      58
    
      59    cd "${srcdir}/KSA_${pkgver}/KSA_linux"
    
      60    install -Dm644 ksa.conf "${pkgdir}/opt/KSA"
    
      61
    
      62    # Bulk copy everything
    
      63    if [ ${CARCH} = "armv7h" ]; then
    
      64        install -Dm755 ksa_arm "${pkgdir}/opt/KSA/ksa"
    
      65    elif [ ${CARCH} = "aarch64" ]; then
    
      66        install -Dm755 ksa_arm64 "${pkgdir}/opt/KSA/ksa"
    
      67    elif [ ${CARCH} = "x86_64" ]; then
    
      68        install -Dm755 ksa_x64 "${pkgdir}/opt/KSA/ksa"
    
      69    else install -Dm755 ksa_x86 "${pkgdir}/opt/KSA/ksa"
    
      70    fi
    
      71
    
      72    for f in ksa; do
    
      73        ln -sf /opt/KSA/"$f" "${pkgdir}/usr/bin"
    
      74    done
    
      75
    
      76}
    
      77

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2