litecoin-bin

LOW

maintainer a821 14 votes scanned 2026-10-02 00:00:32.890515

View on AUR

Why flagged

The package downloads official prebuilt binaries from the project's own release domain (download.litecoin.org), which is a standard and expected source for binary packages; the non-whitelisted host is plausibly legitimate and the worst case of a supply-chain compromise is limited to running untrusted code from the official vendor.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads official prebuilt binaries from the project's own release domain (download.litecoin.org), which is a standard and expected source for binary packages; the non-whitelisted host is plausibly legitimate and the worst case of a supply-chain compromise is limited to running untrusted code from the official vendor.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source_x86_64=("https://download.litecoin.org/litecoin-${pkgver}/linux/litecoin-${pkgver}-x86_64-linux-gnu.tar.gz"{,.asc})

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: a821 at mail de
    
      2
    
      3pkgname=litecoin-bin
    
      4pkgver=0.21.5.8
    
      5pkgrel=1
    
      6arch=('x86_64')
    
      7url="https://www.litecoin.org/"
    
      8license=('MIT')
    
      9pkgdesc="Peer-to-peer digital currency, official binary release (includes litecoin-qt and litecoind)"
    
      10source=(
    
      11  litecoin-bin.desktop
    
      12  litecoin128.png
    
      13  LICENSE
    
      14)
    
      15source_x86_64=("https://download.litecoin.org/litecoin-${pkgver}/linux/litecoin-${pkgver}-x86_64-linux-gnu.tar.gz"{,.asc})
    
      16sha256sums=('512d0d7de9be2736e4a2d7bf948d16b61319b2c402c032be7c4d3acc06febe16'
    
      17            'fc2fa6b980a34762a8135168a4446887223ae60b24da54253893ff517992ad94'
    
      18            'c71857544b2ea7371b4b70035a0a23ffe9691d0a07e7c9206b94be22983f5382')
    
      19sha256sums_x86_64=('43200c9f9d65ebc126ea5833ca9429e144c4b3273da6bb9f4e89fd7450ab1be9'
    
      20                   'SKIP')
    
      21validpgpkeys=(
    
      22  'D35621D53A1CC6A3456758D03620E9D387E55666'  # David Burkett
    
      23)
    
      24options=(!strip !debug)
    
      25depends=(
    
      26  fontconfig
    
      27  freetype2
    
      28  glibc
    
      29  libgcc
    
      30  libxcb
    
      31)
    
      32provides=(${pkgname%-bin})
    
      33conflicts=(${pkgname%-bin} 'litecoin-qt')
    
      34
    
      35package() {
    
      36  install -Dm755 litecoin-$pkgver/bin/*litecoin* -t "$pkgdir/usr/bin"
    
      37  install -Dm644 litecoin-$pkgver/share/man/man1/litecoin* -t "$pkgdir/usr/share/man/man1"
    
      38  install -Dm644 litecoin-$pkgver/README.md -t "$pkgdir/usr/share/doc/$pkgname"
    
      39  install -Dm644 litecoin-bin.desktop "$pkgdir"/usr/share/applications/litecoin-bin.desktop
    
      40  install -Dm644 litecoin128.png "$pkgdir"/usr/share/pixmaps/litecoin128.png
    
      41  install -Dm644 LICENSE "$pkgdir"/usr/share/licenses/$pkgname/LICENSE
    
      42}
    
      43

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-02 00:00:32	Low	2
2026-10-01 00:02:06	Low	2
2026-09-30 00:20:07	Low	2
2026-09-29 00:07:46	Low	2
2026-09-28 00:28:32	Low	2
2026-09-27 00:07:07	Low	2
2026-09-26 00:12:15	Low	2
2026-09-25 00:03:36	Low	2
2026-09-24 00:24:14	Low	2
2026-09-23 00:28:13	Low	2
2026-09-22 00:15:14	Low	2
2026-09-21 00:26:32	Low	2
2026-09-20 00:25:31	Low	2
2026-09-19 00:25:36	Low	2
2026-09-18 00:17:11	Low	2
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2