nav

maintainer Connor · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary package from software.concise.cc, a personal domain belonging to the maintainer (same domain as their email). While the maintainer is self-consistent and a PGP key is listed for validation, the source is not the official GitLab project (gitlab.com/a4to/nav) but rather a personal hosting server. The binary is installed as an executable (install -Dm755). There is no source build from the upstream GitLab repo — only a prebuilt binary tarball. This is a genuine supply-chain concern: if the personal server is compromised or the maintainer acts maliciously, users receive and execute an arbitrary binary. The sha512sum and PGP key provide some integrity guarantee, but the trust anchor is entirely the maintainer's own infrastructure rather than an independent upstream release. This pattern is a textbook medium-severity supply-chain risk.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 "https://software.concise.cc/x86_64/${pkgname}-${pkgver}-${pkgrel}-$arch.pkg.tar.xz"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt binary package from software.concise.cc, a personal domain belonging to the maintainer (same domain as their email). While the maintainer is self-consistent and a PGP key is listed for validation, the source is not the official GitLab project (gitlab.com/a4to/nav) but rather a personal hosting server. The binary is installed as an executable (install -Dm755). There is no source build from the upstream GitLab repo — only a prebuilt binary tarball. This is a genuine supply-chain concern: if the personal server is compromised or the maintainer acts maliciously, users receive and execute an arbitrary binary. The sha512sum and PGP key provide some integrity guarantee, but the trust anchor is entirely the maintainer's own infrastructure rather than an independent upstream release. This pattern is a textbook medium-severity supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Connor Etherington <connor@concise.cc>
    
      2# ---
    
      3pkgname=nav
    
      4pkgver=1.3
    
      5pkgrel=1
    
      6pkgdesc="A means of quick navigation through directories in the CLI"
    
      7arch=(any)
    
      8url="https://gitlab.com/a4to/${pkgname}"
    
      9license=('MIT')
    
      10depends=(dialog fzf)
    
      11source=(
    
      12  "https://software.concise.cc/x86_64/${pkgname}-${pkgver}-${pkgrel}-$arch.pkg.tar.xz"
    
      13)
    
      14sha512sums=(
    
      15  '6ac4ad1059ab6e0bacb4fd2d2f15979ca40bcd49f5715a4804c9bfefbb641ffbccd0682cd8732e4b3c911846a4878870c0a1919783953f76d0b10c3b15550a68'
    
      16)
    
      17md5sums=(
    
      18  'f72e4fc28024db98bfddeb66bc402af3'
    
      19)
    
      20validpgpkeys=(
    
      21  '81BACEEBC3EA26E127166E4A819BB92A9A48160E'
    
      22)
    
      23
    
      24package() {
    
      25
    
      26  cd "$srcdir/${pkgname}-${pkgver}-${pkgrel}-${arch}" ||
    
      27  cd "$srcdir/${pkgname}"
    
      28
    
      29  install -Dm644 usr/share/licenses/${pkgname}/LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      30  install -Dm755 usr/bin/${pkgname} "${pkgdir}/usr/bin/${pkgname}"
    
      31
    
      32}
    
      33

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2