ollaman-bin

maintainer Pakrohk · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt proprietary binary (.deb) from dl.ollaman.com — a non-official, non-ecosystem host — and installs it directly. The sha256sums is explicitly set to 'SKIP' (with a comment in Persian saying 'replace later'), meaning there is zero integrity verification. This is a real supply-chain concern: the binary is executed code (an Electron-based desktop app given the dependency list), sourced from a personal/vendor CDN with no checksum, so any compromise or substitution of the remote file would go undetected. The host dl.ollaman.com appears to be the vendor's own distribution server, which is marginally better than a random personal host, but the missing checksum is the critical issue here. This meets the definition of medium: an executed binary from an unofficial host with no integrity check.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:21 source=("https://dl.ollaman.com/updates/v${pkgver}/linux/x86_64/OllaMan_${pkgver}_amd64.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 85%): The PKGBUILD downloads a prebuilt proprietary binary (.deb) from dl.ollaman.com — a non-official, non-ecosystem host — and installs it directly. The sha256sums is explicitly set to 'SKIP' (with a comment in Persian saying 'replace later'), meaning there is zero integrity verification. This is a real supply-chain concern: the binary is executed code (an Electron-based desktop app given the dependency list), sourced from a personal/vendor CDN with no checksum, so any compromise or substitution of the remote file would go undetected. The host dl.ollaman.com appears to be the vendor's own distribution server, which is marginally better than a random personal host, but the missing checksum is the critical issue here. This meets the definition of medium: an executed binary from an unofficial host with no integrity check.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: pakrohk <pakrohk@gmail.com>
    
      2pkgname=ollaman-bin
    
      3pkgver=2.9.1
    
      4pkgrel=2
    
      5pkgdesc="A modern desktop GUI for managing and interacting with Ollama AI models"
    
      6arch=('x86_64')
    
      7url="https://ollaman.com"
    
      8license=('proprietary')
    
      9depends=(
    
      10  'gtk3'
    
      11  'libnotify'
    
      12  'libxss'
    
      13  'libxtst'
    
      14  'nss'
    
      15  'libxcomposite'
    
      16  'libxdamage'
    
      17  'libxrandr'
    
      18  'mesa'
    
      19  'alsa-lib'
    
      20)
    
      21source=("https://dl.ollaman.com/updates/v${pkgver}/linux/x86_64/OllaMan_${pkgver}_amd64.deb")
    
      22sha256sums=('SKIP')  # بعداً عوض کن
    
      23
    
      24package() {
    
      25  cd "$srcdir"
    
      26  ar x "OllaMan_${pkgver}_amd64.deb"
    
      27  tar -xf data.tar.* -C "$pkgdir"
    
      28}
    
      29

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2