onescript

maintainer avkonarev · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary .deb from oscript.io (the project's own official domain) and extracts/installs it directly. While oscript.io is the legitimate upstream host for the OneScript project, installing a prebuilt binary blob (Mono assemblies and executables) rather than building from source is a genuine supply-chain concern: if the host or the binary were compromised, arbitrary code would be executed on the user's system. The md5sum check provides minimal integrity assurance (MD5 is cryptographically broken). The 'latest' path component in the URL is also a concern since it could serve different content over time, though here the version is pinned in the filename. The cheaper model's MEDIUM rating is correct: this is a real supply-chain concern (executed binary from a host that, while official, is not a major trusted mirror), not a false positive, but there is no evidence of active malice.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 "source.deb::https://oscript.io/downloads/latest/x64/onescript-engine_${pkgver}_all.deb"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from oscript.io (the project's own official domain) and extracts/installs it directly. While oscript.io is the legitimate upstream host for the OneScript project, installing a prebuilt binary blob (Mono assemblies and executables) rather than building from source is a genuine supply-chain concern: if the host or the binary were compromised, arbitrary code would be executed on the user's system. The md5sum check provides minimal integrity assurance (MD5 is cryptographically broken). The 'latest' path component in the URL is also a concern since it could serve different content over time, though here the version is pinned in the filename. The cheaper model's MEDIUM rating is correct: this is a real supply-chain concern (executed binary from a host that, while official, is not a major trusted mirror), not a false positive, but there is no evidence of active malice.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Alexander Konarev  <avkonarev@gmail.com>
    
      2# Author: Andrey Ovsankin aka EvilBeaver
    
      3
    
      4pkgname=onescript
    
      5pkgver=1.8.3
    
      6pkgrel=1
    
      7pkgdesc="This project is an alternative implementation of the virtual machine, execute scripts in the language of the 1C:Enterprise"
    
      8arch=("x86_64")
    
      9license=('GPL3' 'LGPL3')
    
      10url="http://oscript.io/"
    
      11depends=('mono')
    
      12makedepens=('tar ar xz')
    
      13
    
      14source=(
    
      15        "source.deb::https://oscript.io/downloads/latest/x64/onescript-engine_${pkgver}_all.deb"
    
      16        )
    
      17
    
      18md5sums=('214f15edbf5c2d7c92172b0a56d55a09')
    
      19
    
      20
    
      21prepare() {
    
      22  cd $srcdir
    
      23  for f in *.deb
    
      24  do
    
      25      ar p $f data.tar.xz | tar -Jx
    
      26      rm $f
    
      27  done
    
      28  rm control.tar.gz data.tar.xz debian-binary
    
      29}
    
      30
    
      31package() {
    
      32  cd $srcdir
    
      33  cp -r .  $pkgdir
    
      34}
    
      35

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2