lucidlink-bin

MEDIUM

maintainer vho 1 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt .deb from the project's official release domain, but the source is a binary blob not built from auditable source code, creating a supply-chain risk if the release server is compromised.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:26 source=("https://releases.lucidlink.com/prod/linux-deb/lucidlink_${pkgver}_amd64.deb")

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb from the project's official release domain, but the source is a binary blob not built from auditable source code, creating a supply-chain risk if the release server is compromised.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: vho <v_h@me.com>
    
      2
    
      3pkgname=lucidlink-bin
    
      4pkgver=3.9.8998
    
      5pkgrel=1
    
      6pkgdesc="Your private filespace in the cloud"
    
      7arch=('x86_64')
    
      8url="https://www.lucidlink.com/"
    
      9license=('custom')
    
      10depends=(
    
      11  'alsa-lib'
    
      12  'bash-completion'
    
      13  'fuse3'
    
      14  'gtk3'
    
      15  'libappindicator-gtk3'
    
      16  'libnotify'
    
      17  'libxss'
    
      18  'libxtst'
    
      19  'nss'
    
      20  'xdg-utils'
    
      21)
    
      22provides=('lucidlink')
    
      23conflicts=('lucidlink')
    
      24options=('!strip' '!debug')
    
      25install="${pkgname}.install"
    
      26source=("https://releases.lucidlink.com/prod/linux-deb/lucidlink_${pkgver}_amd64.deb")
    
      27sha256sums=('19f2010048be99937007f0a86d1e37236d81499e345f7a71491d44e897b7b7df')
    
      28
    
      29package() {
    
      30  bsdtar -xf "${srcdir}/lucidlink_${pkgver}_amd64.deb" -C "${srcdir}"
    
      31
    
      32  # Upstream has shipped data.tar.xz and data.tar.zst at different times, so
    
      33  # don't hardcode the compression -- take whichever member the .deb contains.
    
      34  local data
    
      35  data="$(find "${srcdir}" -maxdepth 1 -type f -name 'data.tar.*' -print -quit)"
    
      36  [[ -n "${data}" ]] || { echo "no data.tar.* inside the .deb" >&2; return 1; }
    
      37  bsdtar -xf "${data}" -C "${pkgdir}"
    
      38
    
      39  install -d "${pkgdir}/usr/bin"
    
      40  if [[ -e "${pkgdir}/usr/local/bin/lucidlink" ]]; then
    
      41    mv "${pkgdir}/usr/local/bin/lucidlink" "${pkgdir}/usr/bin/lucidlink"
    
      42  elif [[ -e "${pkgdir}/usr/local/bin/LucidLink" ]]; then
    
      43    mv "${pkgdir}/usr/local/bin/LucidLink" "${pkgdir}/usr/bin/lucidlink"
    
      44  fi
    
      45
    
      46  if [[ -e "${pkgdir}/usr/local/bin/lucid" ]]; then
    
      47    mv "${pkgdir}/usr/local/bin/lucid" "${pkgdir}/usr/bin/lucid"
    
      48  fi
    
      49
    
      50  if [[ -e "${pkgdir}/usr/local/bin/lucid3" ]]; then
    
      51    mv "${pkgdir}/usr/local/bin/lucid3" "${pkgdir}/usr/bin/lucid3"
    
      52  fi
    
      53
    
      54  rmdir "${pkgdir}/usr/local/bin" 2>/dev/null || true
    
      55  rmdir "${pkgdir}/usr/local" 2>/dev/null || true
    
      56}
    
      57

Changes since previous scan

--- PKGBUILD @ 2026-10-21 00:12
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,7 +1,7 @@
 # Maintainer: vho <v_h@me.com>
 
 pkgname=lucidlink-bin
-pkgver=3.9.8961
+pkgver=3.9.8998
 pkgrel=1
 pkgdesc="Your private filespace in the cloud"
 arch=('x86_64')
@@ -24,7 +24,7 @@
 options=('!strip' '!debug')
 install="${pkgname}.install"
 source=("https://releases.lucidlink.com/prod/linux-deb/lucidlink_${pkgver}_amd64.deb")
-sha256sums=('f8743ae4fedbc26f45bde7040578b60e0cbb4a4d839f98e30fbeb02965137108')
+sha256sums=('19f2010048be99937007f0a86d1e37236d81499e345f7a71491d44e897b7b7df')
 
 package() {
   bsdtar -xf "${srcdir}/lucidlink_${pkgver}_amd64.deb" -C "${srcdir}"

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 11:31:16	Medium	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2