open-jardin-bin

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads and installs a prebuilt binary .deb package from openjardin.eu, which is the official project website (the url= field matches the download host). This is a common AUR pattern for 'bin' packages that repackage upstream-provided binaries. The host is the upstream vendor's own site, not a random personal host, so the supply-chain risk is the same as any other binary repackaging: if the upstream site is compromised or the maintainer pushes a new binary without updating the sha256sum, malicious code could be executed. The sha256sums are present and pin the binary, which mitigates substitution attacks. The risk is real but typical for binary AUR packages — not elevated beyond the standard medium concern for executed binaries from a non-major-platform host.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("https://openjardin.eu/download/openjardin_${pkgver}_amd64.deb"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads and installs a prebuilt binary .deb package from openjardin.eu, which is the official project website (the url= field matches the download host). This is a common AUR pattern for 'bin' packages that repackage upstream-provided binaries. The host is the upstream vendor's own site, not a random personal host, so the supply-chain risk is the same as any other binary repackaging: if the upstream site is compromised or the maintainer pushes a new binary without updating the sha256sum, malicious code could be executed. The sha256sums are present and pin the binary, which mitigates substitution attacks. The risk is real but typical for binary AUR packages — not elevated beyond the standard medium concern for executed binaries from a non-major-platform host.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Frederic Bezies <fredbezies at gmail dot com>
    
      2# Contributor: liberodark
    
      3
    
      4pkgname=open-jardin-bin
    
      5pkgver=1.07
    
      6pkgrel=1
    
      7pkgdesc="A garden management"
    
      8arch=('x86_64')
    
      9url="https://openjardin.eu/"
    
      10license=('GPL3')
    
      11depends=('xdg-utils')
    
      12source=("https://openjardin.eu/download/openjardin_${pkgver}_amd64.deb"
    
      13	$pkgname.desktop
    
      14        $pkgname.png)
    
      15
    
      16package() {
    
      17  cd $srcdir
    
      18  tar xvf data.tar.xz
    
      19  cp -r usr $pkgdir
    
      20  rm $pkgdir/usr/share/openjardin/champ.png
    
      21  rm $pkgdir/usr/share/applications/*.desktop
    
      22  install -vDm644 $srcdir/$pkgname.desktop $pkgdir/usr/share/applications/$pkgname.desktop
    
      23  install -vDm644 $srcdir/$pkgname.png $pkgdir/usr/share/pixmaps/$pkgname.png
    
      24}
    
      25sha256sums=('029198c6843ad868556c67a2812e296295215e06e05644757f18e984283bd107'
    
      26            'c042b43e1853e149a29bd046e5955da44c493377f0639e9e402958762615072e'
    
      27            '3045e5b350c7bf1510eaab2993bbf21e011cb0876ae0dda3e8e28f0528f0bd3f')
    
      28

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2