molotov-deb

MEDIUM

maintainer Xaap 0 votes scanned 2026-10-17 19:19:13.554222

View on AUR

Why flagged

The package downloads a prebuilt .deb from a non-standard host, which contains unverifiable executable code that could be tampered with if the source is compromised.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:10 source=("https://desktop-app.molotov.tv/stable/linux/x64/Molotov-x64-$pkgver.deb")

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt .deb from a non-standard host, which contains unverifiable executable code that could be tampered with if the source is compromised.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=molotov-deb
    
      2pkgver=8.1.2
    
      3pkgrel=1
    
      4pkgdesc="Molotov TV client"
    
      5arch=('x86_64')
    
      6url="https://www.molotov.tv/"
    
      7license=('unknown')
    
      8conflicts=('molotov')
    
      9depends=('at-spi2-core' 'libcups' 'gtk3' 'pango' 'alsa-lib')
    
      10source=("https://desktop-app.molotov.tv/stable/linux/x64/Molotov-x64-$pkgver.deb")
    
      11sha256sums=('ba0aba5015048388a1f189e6b8c2095babb73774767b677fef7c60497e7b5a75')
    
      12
    
      13package() {
    
      14    tar -xf data.tar.zst -C "$pkgdir"
    
      15}
    
      16

Changes since previous scan

--- PKGBUILD @ 2026-06-19 19:07
+++ PKGBUILD @ 2026-10-17 19:19
@@ -1,5 +1,5 @@
 pkgname=molotov-deb
-pkgver=7.5.2
+pkgver=8.1.2
 pkgrel=1
 pkgdesc="Molotov TV client"
 arch=('x86_64')
@@ -8,7 +8,7 @@
 conflicts=('molotov')
 depends=('at-spi2-core' 'libcups' 'gtk3' 'pango' 'alsa-lib')
 source=("https://desktop-app.molotov.tv/stable/linux/x64/Molotov-x64-$pkgver.deb")
-sha256sums=('0a24387fb8cdcc31e048c06fc83e5e01b041cb1528963aee7857eef6625446d6')
+sha256sums=('ba0aba5015048388a1f189e6b8c2095babb73774767b677fef7c60497e7b5a75')
 
 package() {
     tar -xf data.tar.zst -C "$pkgdir"

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 19:19:13	Medium	2
2026-06-19 19:07:35	Clean	2
2026-06-18 16:11:54	Medium	1