litecoin-bin

maintainer a821 · 14 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The package downloads a prebuilt binary from the official project's download domain, which is a standard and expected practice for -bin packages; the host is not on the whitelist but is plausibly legitimate and the checksums are provided and verified, reducing supply-chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt binary from the official project's download domain, which is a standard and expected practice for -bin packages; the host is not on the whitelist but is plausibly legitimate and the checksums are provided and verified, reducing supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source_x86_64=("https://download.litecoin.org/litecoin-${pkgver}/linux/litecoin-${pkgver}-x86_64-linux-gnu.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: a821 at mail de
    
      2
    
      3pkgname=litecoin-bin
    
      4pkgver=0.21.5.6
    
      5pkgrel=1
    
      6arch=('x86_64')
    
      7url="https://www.litecoin.org/"
    
      8license=('MIT')
    
      9pkgdesc="Peer-to-peer digital currency, official binary release (includes litecoin-qt and litecoind)"
    
      10source=(
    
      11  litecoin-bin.desktop
    
      12  litecoin128.png
    
      13  LICENSE
    
      14)
    
      15source_x86_64=("https://download.litecoin.org/litecoin-${pkgver}/linux/litecoin-${pkgver}-x86_64-linux-gnu.tar.gz")
    
      16sha256sums=('512d0d7de9be2736e4a2d7bf948d16b61319b2c402c032be7c4d3acc06febe16'
    
      17            'fc2fa6b980a34762a8135168a4446887223ae60b24da54253893ff517992ad94'
    
      18            'c71857544b2ea7371b4b70035a0a23ffe9691d0a07e7c9206b94be22983f5382')
    
      19sha256sums_x86_64=('3c0a217651a431ef446641669a0b74ce7dbcd9b9ed1a118fc830b8f6779ee83f')
    
      20validpgpkeys=(
    
      21  'D35621D53A1CC6A3456758D03620E9D387E55666'  # David Burkett
    
      22)
    
      23options=(!strip !debug)
    
      24depends=(
    
      25  fontconfig
    
      26  freetype2
    
      27  glibc
    
      28  libgcc
    
      29  libxcb
    
      30)
    
      31provides=(${pkgname%-bin})
    
      32conflicts=(${pkgname%-bin} 'litecoin-qt')
    
      33
    
      34package() {
    
      35  install -Dm755 litecoin-$pkgver/bin/*litecoin* -t "$pkgdir/usr/bin"
    
      36  install -Dm644 litecoin-$pkgver/share/man/man1/litecoin* -t "$pkgdir/usr/share/man/man1"
    
      37  install -Dm644 litecoin-$pkgver/README.md -t "$pkgdir/usr/share/doc/$pkgname"
    
      38  install -Dm644 litecoin-bin.desktop "$pkgdir"/usr/share/applications/litecoin-bin.desktop
    
      39  install -Dm644 litecoin128.png "$pkgdir"/usr/share/pixmaps/litecoin128.png
    
      40  install -Dm644 LICENSE "$pkgdir"/usr/share/licenses/$pkgname/LICENSE
    
      41}
    
      42

Changes since previous scan

--- PKGBUILD @ 2026-06-19 19:07
+++ PKGBUILD @ 2026-08-18 00:03
@@ -1,7 +1,7 @@
 # Maintainer: a821 at mail de
 
 pkgname=litecoin-bin
-pkgver=0.21.5.5
+pkgver=0.21.5.6
 pkgrel=1
 arch=('x86_64')
 url="https://www.litecoin.org/"
@@ -16,24 +16,17 @@
 sha256sums=('512d0d7de9be2736e4a2d7bf948d16b61319b2c402c032be7c4d3acc06febe16'
             'fc2fa6b980a34762a8135168a4446887223ae60b24da54253893ff517992ad94'
             'c71857544b2ea7371b4b70035a0a23ffe9691d0a07e7c9206b94be22983f5382')
-sha256sums_x86_64=('623410d4f2695a68aa71332ae0672fee19276f41c1c63a531f97e24a50edde14')
+sha256sums_x86_64=('3c0a217651a431ef446641669a0b74ce7dbcd9b9ed1a118fc830b8f6779ee83f')
 validpgpkeys=(
   'D35621D53A1CC6A3456758D03620E9D387E55666'  # David Burkett
 )
-options=(!strip !emptydirs)
+options=(!strip !debug)
 depends=(
-  brotli
-  bzip2
-  expat
   fontconfig
   freetype2
   glibc
   libgcc
-  libpng
-  libxau
   libxcb
-  libxdmcp
-  zlib
 )
 provides=(${pkgname%-bin})
 conflicts=(${pkgname%-bin} 'litecoin-qt')

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 00:26:13	LOW	2
2026-08-14 00:03:41	LOW	2
2026-08-13 00:17:07	LOW	2
2026-08-12 00:27:08	LOW	2
2026-08-11 13:21:13	MEDIUM	1
2026-06-19 19:07:35	CLEAN	2
2026-06-18 16:11:54	MEDIUM	1