pak-bin

maintainer Arsen6331 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads prebuilt binaries from minio.arsenm.dev, which is a personal MinIO object storage instance operated by the maintainer (Arsen Musayelyan). The binaries are executed directly (chmod +x, install -Dm755 to /usr/bin/pak). While the maintainer appears to be the upstream author (gitea.arsenm.dev/Arsen6331/pak), this is still a personal/unofficial host rather than a canonical release infrastructure like GitHub releases. The sha256sums are pinned, which mitigates substitution attacks somewhat, but if the host is compromised or the maintainer's storage is hijacked, malicious binaries could be served with matching checksums only if the attacker also updates the PKGBUILD. The real concern is that there is no way to verify these binaries were built from the published source without reproducible builds. This is a genuine supply-chain concern: executed binaries from a personal host with no independent verification path. The cheaper model's MEDIUM rating is correct.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("https://gitea.arsenm.dev/Arsen6331/pak/raw/branch/master/pak.toml")
PKGBUILD:13 source_x86_64=("https://minio.arsenm.dev/pak/$pkgver/pak-linux-x86_64")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads prebuilt binaries from minio.arsenm.dev, which is a personal MinIO object storage instance operated by the maintainer (Arsen Musayelyan). The binaries are executed directly (chmod +x, install -Dm755 to /usr/bin/pak). While the maintainer appears to be the upstream author (gitea.arsenm.dev/Arsen6331/pak), this is still a personal/unofficial host rather than a canonical release infrastructure like GitHub releases. The sha256sums are pinned, which mitigates substitution attacks somewhat, but if the host is compromised or the maintainer's storage is hijacked, malicious binaries could be served with matching checksums only if the attacker also updates the PKGBUILD. The real concern is that there is no way to verify these binaries were built from the published source without reproducible builds. This is a genuine supply-chain concern: executed binaries from a personal host with no independent verification path. The cheaper model's MEDIUM rating is correct.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Arsen Musayelyan <moussaelianarsen@gmail.com>
    
      2pkgname=pak-bin
    
      3pkgver=1.1.0
    
      4pkgrel=1
    
      5pkgdesc="Changes pacman syntax to be more like APT"
    
      6arch=('x86_64' 'aarch64' 'i686')
    
      7license=('GPLv3')
    
      8depends=('yay')
    
      9provides=('pak')
    
      10conflicts=('pak')
    
      11#_arch="$(uname -m)"
    
      12source=("https://gitea.arsenm.dev/Arsen6331/pak/raw/branch/master/pak.toml")
    
      13source_x86_64=("https://minio.arsenm.dev/pak/$pkgver/pak-linux-x86_64")
    
      14source_i686=("https://minio.arsenm.dev/pak/$pkgver/pak-linux-386")
    
      15source_aarch64=("https://minio.arsenm.dev/pak/$pkgver/pak-linux-aarch64")
    
      16sha256sums=('fabc2ed995a9293db8636fdb5bef9de673d9f8b58341d7184ee8faf6bdcaab5a')
    
      17sha256sums_x86_64=('3829666922ac7669ce7cb18a751b50a70633f768dc5c78068ca4358ac317c963')
    
      18sha256sums_i686=('0f69740b7cef8d873ef8f7009861ede85a3f4529a04cea30bab977a243ce3045')
    
      19sha256sums_aarch64=('84c6e75c005ce4e8a85fc85db033272ef112657858f7930ae72f7d1c9ebf4721')
    
      20backup=('etc/pak.toml')
    
      21
    
      22package() {
    
      23	mv pak-linux-* pak
    
      24	chmod +x pak
    
      25	install -Dm755 pak $pkgdir/usr/bin/pak
    
      26	sed -i 's/activeManager = ""/activeManager = "yay"/' pak.toml
    
      27	install -Dm755 pak.toml $pkgdir/etc/pak.toml
    
      28}
    
      29

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2