late-sh-cli-bin

maintainer WinnerWind · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary from cli.late.sh (a non-GitHub, non-standard host operated by the upstream project) and installs it directly as an executable. Two compounding concerns: (1) sha256sums='SKIP' means no integrity verification whatsoever — any content served by that host is installed without validation; (2) the pkgver() function fetches the latest release tag from GitHub but the binary is pulled from a separate host (cli.late.sh/latest/...) with no version pinning in the URL — the binary served could change at any time independently of the version reported. While cli.late.sh appears to be the official distribution endpoint for the Late.sh project (matching the upstream GitHub repo mpiorowski/late-sh), the combination of an executed binary + SKIP checksum + mutable 'latest' URL constitutes a genuine supply-chain risk: a compromise of cli.late.sh or a MITM would result in arbitrary code execution with no integrity check to catch it. This is a real medium-severity concern, not a false positive.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:9 source=("late::https://cli.late.sh/latest/x86_64-unknown-linux-gnu/late")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): This PKGBUILD downloads a prebuilt binary from cli.late.sh (a non-GitHub, non-standard host operated by the upstream project) and installs it directly as an executable. Two compounding concerns: (1) sha256sums='SKIP' means no integrity verification whatsoever — any content served by that host is installed without validation; (2) the pkgver() function fetches the latest release tag from GitHub but the binary is pulled from a separate host (cli.late.sh/latest/...) with no version pinning in the URL — the binary served could change at any time independently of the version reported. While cli.late.sh appears to be the official distribution endpoint for the Late.sh project (matching the upstream GitHub repo mpiorowski/late-sh), the combination of an executed binary + SKIP checksum + mutable 'latest' URL constitutes a genuine supply-chain risk: a compromise of cli.late.sh or a MITM would result in arbitrary code execution with no integrity check to catch it. This is a real medium-severity concern, not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: WinnerWind <archaur543258@winnerwind.in>
    
      2pkgrel=1
    
      3pkgver=0.29.10
    
      4pkgname=late-sh-cli-bin
    
      5pkgdesc='Companion CLI for the Late.sh terminal clubhouse (prebuilt version)'
    
      6arch=(x86_64)
    
      7url='https://late.sh'
    
      8groups=('late.sh')
    
      9source=("late::https://cli.late.sh/latest/x86_64-unknown-linux-gnu/late")
    
      10sha256sums=('SKIP')
    
      11makedepends=('jq')
    
      12
    
      13pkgver() {
    
      14	# trick to get the latest release number from github
    
      15	curl -s "https://api.github.com/repos/mpiorowski/late-sh/releases/latest" | jq -r '.tag_name' | sed 's/[^0-9.]//g'
    
      16}
    
      17
    
      18package() {
    
      19	install -Dm755 "${srcdir}/late" "${pkgdir}/usr/bin/late"
    
      20}
    
      21
    
      22

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2