obinskit

maintainer ScoopNewsworthy · 24 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD installs a prebuilt Electron binary (ObinsKit) downloaded from a Cloudflare R2 bucket (pub-0ff293aefb644607ac910219d9762b50.r2.dev) rather than from the official project's GitHub releases or the vendor's own domain. The official ObinsKit project (hexcore.xyz/obinskit) historically distributed via GitHub releases; this R2 bucket has no verifiable link to the upstream project. A prebuilt, executed binary from an unverifiable third-party host is a genuine supply-chain concern regardless of the sha256 checksums (which only verify integrity, not authenticity). The second source 'deb_extra_files_obins.tar.gz' is also a local/relative path with no URL, meaning it must be a separately maintained file whose provenance is unclear. These factors together constitute a real medium-severity supply-chain risk: executed code from an unofficial host with no cryptographic signing or clear chain of custody to the upstream vendor.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source_x86_64=("https://pub-0ff293aefb644607ac910219d9762b50.r2.dev/ObinsKit_${pkgver}_x64.tar.gz"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD installs a prebuilt Electron binary (ObinsKit) downloaded from a Cloudflare R2 bucket (pub-0ff293aefb644607ac910219d9762b50.r2.dev) rather than from the official project's GitHub releases or the vendor's own domain. The official ObinsKit project (hexcore.xyz/obinskit) historically distributed via GitHub releases; this R2 bucket has no verifiable link to the upstream project. A prebuilt, executed binary from an unverifiable third-party host is a genuine supply-chain concern regardless of the sha256 checksums (which only verify integrity, not authenticity). The second source 'deb_extra_files_obins.tar.gz' is also a local/relative path with no URL, meaning it must be a separately maintained file whose provenance is unclear. These factors together constitute a real medium-severity supply-chain risk: executed code from an unofficial host with no cryptographic signing or clear chain of custody to the upstream vendor.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Nick Haghiri <nshaghiri+aur [at] gmail [dot] com>
    
      2pkgname=obinskit
    
      3pkgver=1.2.11
    
      4pkgrel=4
    
      5pkgdesc="ObinsKit for Anne Pro and Anne Pro 2"
    
      6arch=('x86_64')
    
      7url="https://www.hexcore.xyz/obinskit"
    
      8license=('custom')
    
      9depends=('desktop-file-utils' 'hicolor-icon-theme' 'libappindicator-gtk3' 'libnotify' 'libxss' 'libxtst' 'nss' 'libxkbcommon-x11')
    
      10options=('!strip' '!emptydirs')
    
      11install=${pkgname}.install
    
      12
    
      13source_x86_64=("https://pub-0ff293aefb644607ac910219d9762b50.r2.dev/ObinsKit_${pkgver}_x64.tar.gz"
    
      14               "deb_extra_files_obins.tar.gz"
    
      15				"70-obinskit.rules")
    
      16sha256sums_x86_64=('2a10aed5366c2667174525924da60e323b7e200e2aa9abc1c1a6335e792096cd'
    
      17                   '137296d606b8127dfda7626421fd17fbee06712678b7ae25793e51d78221fab5'
    
      18                   '34619caa538ac790d22139c2a870b050630c8d9b68ac5b7d210d7dcd0c4d838b')
    
      19
    
      20package() {
    
      21    # 1. Install main files
    
      22    install -d "${pkgdir}/opt/${pkgname}"
    
      23    cp -rt "${pkgdir}/opt/${pkgname}" "${srcdir}/ObinsKit_${pkgver}_x64/"*
    
      24
    
      25    # 2. Install extra files (icons/desktop)
    
      26    if [ -d "${srcdir}/usr" ]; then
    
      27        install -d "${pkgdir}/usr" 
    
      28        cp -rt "${pkgdir}/usr" "${srcdir}/usr/"*
    
      29    fi
    
      30
    
      31    # 3. Fix the Desktop Entry Exec path (The user's requested fix)
    
      32    if [ -f "${pkgdir}/usr/share/applications/${pkgname}.desktop" ]; then
    
      33        sed -i "s|Exec=.*|Exec=/opt/${pkgname}/${pkgname} %U|" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      34    fi
    
      35
    
      36    # 4. Create the symlink for terminal usage
    
      37    install -d "${pkgdir}/usr/bin"
    
      38    ln -sf "/opt/${pkgname}/${pkgname}" "${pkgdir}/usr/bin/${pkgname}"
    
      39
    
      40    # 5. Install Udev Rules
    
      41    install -Dm644 "${srcdir}/70-obinskit.rules" "${pkgdir}/usr/lib/udev/rules.d/70-${pkgname}.rules"
    
      42
    
      43    # 6. Set execution bit on the binary
    
      44    chmod 755 "${pkgdir}/opt/${pkgname}/${pkgname}"
    
      45
    
      46    # 7. Licenses
    
      47    install -Dm644 "${pkgdir}/opt/${pkgname}/LICENSES.chromium.html" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE-CHROMIUM"
    
      48    install -Dm644 "${pkgdir}/opt/${pkgname}/LICENSE.electron.txt" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE-ELECTRON"
    
      49}
    
      50

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2