localxpose-cli

maintainer orphaned · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads and installs a prebuilt binary from an AWS S3 bucket (loclx-client.s3.amazonaws.com) which is the vendor's own distribution channel for LocalXpose, not a random personal host. The checksums are pinned, which mitigates casual tampering. However, two real concerns remain: (1) pkgver='latest' means the version string is static while the actual binary content can change silently — the S3 URLs are not versioned, so the vendor could push a new binary without changing the URL, and the sha256sums would then fail (or if someone updates the sums without review, a new binary slips in unvetted); (2) a prebuilt closed-source binary is being installed directly to /usr/bin, and the S3 bucket is controlled solely by the vendor with no reproducibility guarantee. The sha256 pinning provides some protection against third-party substitution but not against the vendor themselves pushing a new artifact to the same URL. This is a genuine medium-severity supply-chain concern: executed binary from a non-official-release-page host (S3 bucket) with a mutable 'latest' versioning scheme.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source_x86_64=("${pkgname}-${pkgver}-amd64.zst::https://loclx-client.s3.amazonaws.com/loclx-linux-amd64.pkg.tar.zst")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): This PKGBUILD downloads and installs a prebuilt binary from an AWS S3 bucket (loclx-client.s3.amazonaws.com) which is the vendor's own distribution channel for LocalXpose, not a random personal host. The checksums are pinned, which mitigates casual tampering. However, two real concerns remain: (1) pkgver='latest' means the version string is static while the actual binary content can change silently — the S3 URLs are not versioned, so the vendor could push a new binary without changing the URL, and the sha256sums would then fail (or if someone updates the sums without review, a new binary slips in unvetted); (2) a prebuilt closed-source binary is being installed directly to /usr/bin, and the S3 bucket is controlled solely by the vendor with no reproducibility guarantee. The sha256 pinning provides some protection against third-party substitution but not against the vendor themselves pushing a new artifact to the same URL. This is a genuine medium-severity supply-chain concern: executed binary from a non-official-release-page host (S3 bucket) with a mutable 'latest' versioning scheme.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Daringcuteseal <daringcuteseal@gmail.com>
    
      2# Contributor:  Dimitris Kiziridis <ragouel at outlook dot com>
    
      3
    
      4pkgname=localxpose-cli
    
      5pkgver=latest
    
      6pkgrel=2
    
      7pkgdesc="A reverse proxy that enables you to expose your localhost to the internet (CLI)"
    
      8arch=('x86_64' 'i386' 'aarch64' 'armv7h')
    
      9url='https://localxpose.io'
    
      10license=("custom:${pkgname}")
    
      11provides=('localxpose')
    
      12depends=('glibc')
    
      13source=('LICENSE')
    
      14source_x86_64=("${pkgname}-${pkgver}-amd64.zst::https://loclx-client.s3.amazonaws.com/loclx-linux-amd64.pkg.tar.zst")
    
      15source_i386=("${pkgname}-${pkgver}-i368.zst::https://loclx-client.s3.amazonaws.com/loclx-linux-386.pkg.tar.zst")
    
      16source_aarch64=("${pkgname}-${pkgver}-aarch64.zst::https://loclx-client.s3.amazonaws.com/loclx-linux-arm64.pkg.tar.zst")
    
      17source_armv7h=("${pkgname}-${pkgver}-armv7h.zst::https://loclx-client.s3.amazonaws.com/loclx-linux-arm.pkg.tar.zst")
    
      18
    
      19sha256sums=('e2143fb751ce3e99d2f7e57edee8791fcba7011e2a685f29caac67c0cf5974ee')
    
      20sha256sums_x86_64=('03c6d1d35dfd0acb673473314c1384156ed2bfcb96e581b3e0bb398fef45fb88')
    
      21sha256sums_i386=('2534e0056ba5c1e4d55322b2b975a4945104604be15bef9df01c933ad4352804')
    
      22sha256sums_aarch64=('a423e0ce90fcab7044b4f0244fb8483fe12acf30361fff0e37d5abc2dae2da91')
    
      23sha256sums_armv7h=('83e5484169ea28f05fe221056374bbdaac129850b607bdc243326a06c22575e4')
    
      24
    
      25package() {
    
      26  install -Dm755 "${srcdir}/usr/bin/loclx" -t "${pkgdir}/usr/bin"
    
      27  install -Dm644 LICENSE -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      28}
    
      29

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2