mqttx-clean-bin

maintainer rubengees · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary .deb from emqx.com, which is the official vendor site for the MQTTX/EMQ project (mqttx.app is their product page, emqx.com is the company behind it). This is a legitimate official source, not a personal or unofficial host. However, the package installs a prebuilt Electron binary directly into /opt and /usr/bin without any signature verification beyond a weak MD5 checksum (no SHA256, no GPG signature). The use of MD5 alone is insufficient for integrity verification of an executed binary. The binary runs with full user privileges as an Electron app. This is a standard 'bin' AUR package pattern (fetching official vendor binaries), but the weak checksum and lack of GPG verification represent a real, if modest, supply-chain concern. The cheaper model's assessment is essentially correct: this is medium risk due to executed prebuilt binary from a vendor host with only MD5 verification, though the host itself is the legitimate official vendor.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=('https://www.emqx.com/en/downloads/MQTTX/v1.13.0/MQTTX_1.13.0_amd64.deb')

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from emqx.com, which is the official vendor site for the MQTTX/EMQ project (mqttx.app is their product page, emqx.com is the company behind it). This is a legitimate official source, not a personal or unofficial host. However, the package installs a prebuilt Electron binary directly into /opt and /usr/bin without any signature verification beyond a weak MD5 checksum (no SHA256, no GPG signature). The use of MD5 alone is insufficient for integrity verification of an executed binary. The binary runs with full user privileges as an Electron app. This is a standard 'bin' AUR package pattern (fetching official vendor binaries), but the weak checksum and lack of GPG verification represent a real, if modest, supply-chain concern. The cheaper model's assessment is essentially correct: this is medium risk due to executed prebuilt binary from a vendor host with only MD5 verification, though the host itself is the legitimate official vendor.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Ruben Gees <rubengees7@gmail.com>
    
      2
    
      3pkgname=mqttx-clean-bin
    
      4pkgver=1.13.0
    
      5pkgrel=1
    
      6pkgdesc="A Powerful and All-in-One MQTT 5.0 client toolbox for Desktop, CLI and WebSocket."
    
      7arch=('x86_64')
    
      8url="https://mqttx.app"
    
      9license=('Apache')
    
      10depends=()
    
      11source=('https://www.emqx.com/en/downloads/MQTTX/v1.13.0/MQTTX_1.13.0_amd64.deb')
    
      12md5sums=('76d3fb227102b3f52d23b7699e58477c')
    
      13
    
      14package() {
    
      15    tar -xf data.tar.xz -C "${pkgdir}"
    
      16
    
      17    # Move icon to correct path.
    
      18    mkdir --parents "${pkgdir}/usr/share/icons/hicolor/512x512/apps"
    
      19    mv "${pkgdir}/usr/share/icons/hicolor/0x0/apps/mqttx.png" "${pkgdir}/usr/share/icons/hicolor/512x512/apps/mqttx.png"
    
      20
    
      21    mkdir --parents "${pkgdir}/usr/bin"
    
      22    ln -s /opt/MQTTX/mqttx "${pkgdir}/usr/bin/mqttx"
    
      23}
    
      24

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2