max-bin

maintainer kuhtoxo · 21 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt RPM from a non-whitelisted host (download.max.ru), which is not a standard code or package hosting platform, creating a supply-chain risk if the host were compromised or the download redirected.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:23 source_x86_64=("https://download.max.ru/linux/rpm/el/9/${arch}/${_filename}")

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt RPM from a non-whitelisted host (download.max.ru), which is not a standard code or package hosting platform, creating a supply-chain risk if the host were compromised or the download redirected.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: KUHTOXO https://aur.archlinux.org/account/kuhtoxo
    
      2
    
      3pkgname=max-bin
    
      4pkgver=26.23.0.74904
    
      5pkgrel=1
    
      6
    
      7pkgdesc="MAX messenger."
    
      8arch=("x86_64")
    
      9url='https://max.ru'
    
      10license=("custom:max")
    
      11categories=("network")
    
      12
    
      13depends=("libxcb" "libxinerama" "libxcomposite" "xcb-util-wm" "xcb-util-cursor" "libva" "libxaw"  "libvdpau" "libnotify" "desktop-file-utils" "libxres")
    
      14optdepends=('gnome-keyring: Fixses startup in Gmome. Store passwords and encryption keys.' 'hicolor-icon-theme')
    
      15options=('!strip' '!debug')
    
      16
    
      17_app_name="MAX"
    
      18_filename="${_app_name}-${pkgver}.rpm"
    
      19
    
      20provides=("${pkgname%-bin}")
    
      21conflicts=("${pkgname%-bin}")
    
      22
    
      23source_x86_64=("https://download.max.ru/linux/rpm/el/9/${arch}/${_filename}")
    
      24
    
      25sha256sums_x86_64=('4f6d824a4339eb50cb16dfaefca6fc6a361e754f420321c7198f6d5228d46f74')
    
      26
    
      27package() {
    
      28    cp -a "${srcdir}/usr/"  "${pkgdir}/usr/"
    
      29    mkdir -p "${pkgdir}/usr/bin/"
    
      30    ln -sf "/usr/share/max/bin/max" "${pkgdir}/usr/bin/max"
    
      31}
    
      32

Changes since previous scan

--- PKGBUILD @ 2026-07-19 00:17
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,7 +1,7 @@
 # Maintainer: KUHTOXO https://aur.archlinux.org/account/kuhtoxo
 
 pkgname=max-bin
-pkgver=26.22.0.74124
+pkgver=26.23.0.74904
 pkgrel=1
 
 pkgdesc="MAX messenger."
@@ -22,7 +22,7 @@
 
 source_x86_64=("https://download.max.ru/linux/rpm/el/9/${arch}/${_filename}")
 
-sha256sums_x86_64=('0184ab93786362a77e6668255cffb136549f625adfa37c1ded7fcd6fef769cf7')
+sha256sums_x86_64=('4f6d824a4339eb50cb16dfaefca6fc6a361e754f420321c7198f6d5228d46f74')
 
 package() {
     cp -a "${srcdir}/usr/"  "${pkgdir}/usr/"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 17:11:42	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2