localxpose-cli

MEDIUM

maintainer orphaned 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

This PKGBUILD downloads and installs a prebuilt binary from an AWS S3 bucket (loclx-client.s3.amazonaws.com) which is the vendor's own distribution channel for LocalXpose, not a random personal host. The checksums are pinned, which mitigates casual tampering. However, two real concerns remain: (1) pkgver='latest' means the version string is static while the actual binary content can change silently — the S3 URLs are not versioned, so the vendor could push a new binary without changing the URL, and the sha256sums would then fail (or if someone updates the sums without review, a new binary slips in unvetted); (2) a prebuilt closed-source binary is being installed directly to /usr/bin, and the S3 bucket is controlled solely by the vendor with no reproducibility guarantee. The sha256 pinning provides some protection against third-party substitution but not against the vendor themselves pushing a new artifact to the same URL. This is a genuine medium-severity supply-chain concern: executed binary from a non-official-release-page host (S3 bucket) with a mutable 'latest' versioning scheme.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source_x86_64=("${pkgname}-${pkgver}-amd64.zst::https://loclx-client.s3.amazonaws.com/loclx-linux-amd64.pkg.tar.zst")

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): This PKGBUILD downloads and installs a prebuilt binary from an AWS S3 bucket (loclx-client.s3.amazonaws.com) which is the vendor's own distribution channel for LocalXpose, not a random personal host. The checksums are pinned, which mitigates casual tampering. However, two real concerns remain: (1) pkgver='latest' means the version string is static while the actual binary content can change silently — the S3 URLs are not versioned, so the vendor could push a new binary without changing the URL, and the sha256sums would then fail (or if someone updates the sums without review, a new binary slips in unvetted); (2) a prebuilt closed-source binary is being installed directly to /usr/bin, and the S3 bucket is controlled solely by the vendor with no reproducibility guarantee. The sha256 pinning provides some protection against third-party substitution but not against the vendor themselves pushing a new artifact to the same URL. This is a genuine medium-severity supply-chain concern: executed binary from a non-official-release-page host (S3 bucket) with a mutable 'latest' versioning scheme.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Daringcuteseal <daringcuteseal@gmail.com>
    
      2# Contributor:  Dimitris Kiziridis <ragouel at outlook dot com>
    
      3
    
      4pkgname=localxpose-cli
    
      5pkgver=latest
    
      6pkgrel=2
    
      7pkgdesc="A reverse proxy that enables you to expose your localhost to the internet (CLI)"
    
      8arch=('x86_64' 'i386' 'aarch64' 'armv7h')
    
      9url='https://localxpose.io'
    
      10license=("custom:${pkgname}")
    
      11provides=('localxpose')
    
      12depends=('glibc')
    
      13source=('LICENSE')
    
      14source_x86_64=("${pkgname}-${pkgver}-amd64.zst::https://loclx-client.s3.amazonaws.com/loclx-linux-amd64.pkg.tar.zst")
    
      15source_i386=("${pkgname}-${pkgver}-i368.zst::https://loclx-client.s3.amazonaws.com/loclx-linux-386.pkg.tar.zst")
    
      16source_aarch64=("${pkgname}-${pkgver}-aarch64.zst::https://loclx-client.s3.amazonaws.com/loclx-linux-arm64.pkg.tar.zst")
    
      17source_armv7h=("${pkgname}-${pkgver}-armv7h.zst::https://loclx-client.s3.amazonaws.com/loclx-linux-arm.pkg.tar.zst")
    
      18
    
      19sha256sums=('e2143fb751ce3e99d2f7e57edee8791fcba7011e2a685f29caac67c0cf5974ee')
    
      20sha256sums_x86_64=('03c6d1d35dfd0acb673473314c1384156ed2bfcb96e581b3e0bb398fef45fb88')
    
      21sha256sums_i386=('2534e0056ba5c1e4d55322b2b975a4945104604be15bef9df01c933ad4352804')
    
      22sha256sums_aarch64=('a423e0ce90fcab7044b4f0244fb8483fe12acf30361fff0e37d5abc2dae2da91')
    
      23sha256sums_armv7h=('83e5484169ea28f05fe221056374bbdaac129850b607bdc243326a06c22575e4')
    
      24
    
      25package() {
    
      26  install -Dm755 "${srcdir}/usr/bin/loclx" -t "${pkgdir}/usr/bin"
    
      27  install -Dm644 LICENSE -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      28}
    
      29

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2