opencom-bin

maintainer donskyblock · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary tarball (an Electron/Chromium-based desktop app given the dependency list) directly from opencom.online, which is the vendor's own site but not a well-known, audited distribution channel. All three checksums are SKIP'd, meaning there is no integrity verification whatsoever — the tarball could be silently replaced at any time without detection. The binary is then installed to /opt and symlinked into /usr/bin for execution. This is a genuine supply-chain concern: a prebuilt, unverified executable from a personal/small-vendor host with no checksum pinning. It is not clearly malicious, but the combination of (1) executed binary, (2) unofficial host, and (3) SKIP on all checksums meets the medium threshold. The maintainer email matches the domain, suggesting it is the actual vendor self-publishing, which slightly reduces but does not eliminate the risk.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:48 'OpenCom.tar.gz::https://opencom.online/downloads/OpenCom.tar.gz'

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 80%): This PKGBUILD downloads a prebuilt binary tarball (an Electron/Chromium-based desktop app given the dependency list) directly from opencom.online, which is the vendor's own site but not a well-known, audited distribution channel. All three checksums are SKIP'd, meaning there is no integrity verification whatsoever — the tarball could be silently replaced at any time without detection. The binary is then installed to /opt and symlinked into /usr/bin for execution. This is a genuine supply-chain concern: a prebuilt, unverified executable from a personal/small-vendor host with no checksum pinning. It is not clearly malicious, but the combination of (1) executed binary, (2) unofficial host, and (3) SKIP on all checksums meets the medium threshold. The maintainer email matches the domain, suggesting it is the actual vendor self-publishing, which slightly reduces but does not eliminate the risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: OpenCom Release Automation <don@opencom.online>
    
      2# Generated by client/scripts/stage-aur.mjs
    
      3pkgname=opencom-bin
    
      4pkgver=0.2.4
    
      5pkgrel=1
    
      6pkgdesc='Desktop wrapper for OpenCom frontend'
    
      7arch=(
    
      8  'x86_64'
    
      9)
    
      10url='https://opencom.online'
    
      11license=(
    
      12  'GPL3'
    
      13)
    
      14depends=(
    
      15  'alsa-lib'
    
      16  'at-spi2-core'
    
      17  'cairo'
    
      18  'cups'
    
      19  'dbus'
    
      20  'gcc-libs'
    
      21  'glib2'
    
      22  'gtk3'
    
      23  'libdrm'
    
      24  'libx11'
    
      25  'libxcomposite'
    
      26  'libxdamage'
    
      27  'libxext'
    
      28  'libxfixes'
    
      29  'libxkbcommon'
    
      30  'libxrandr'
    
      31  'mesa'
    
      32  'nspr'
    
      33  'nss'
    
      34  'pango'
    
      35  'systemd-libs'
    
      36  'xdg-utils'
    
      37)
    
      38optdepends=(
    
      39  'pipewire: Wayland screen sharing support'
    
      40)
    
      41provides=(
    
      42  'opencom'
    
      43)
    
      44conflicts=(
    
      45  'opencom'
    
      46)
    
      47source=(
    
      48  'OpenCom.tar.gz::https://opencom.online/downloads/OpenCom.tar.gz'
    
      49  'opencom.desktop'
    
      50  'opencom.png'
    
      51)
    
      52sha256sums=('SKIP'
    
      53            'SKIP'
    
      54            'SKIP')
    
      55
    
      56package() {
    
      57  install -dm755 "$pkgdir/opt/opencom"
    
      58  cp -a "$srcdir/OpenCom/." "$pkgdir/opt/opencom/"
    
      59  install -dm755 "$pkgdir/usr/bin"
    
      60  ln -sf "/opt/opencom/opencom-client" "$pkgdir/usr/bin/opencom"
    
      61  install -Dm644 "$srcdir/opencom.desktop" "$pkgdir/usr/share/applications/opencom.desktop"
    
      62  install -Dm644 "$srcdir/opencom.png" "$pkgdir/usr/share/pixmaps/opencom.png"
    
      63}
    
      64

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2