panabit-iwan

MEDIUM

maintainer silvertuanzi 0 votes scanned 2026-11-04 14:09:30.396318

View on AUR

Why flagged

Installs a prebuilt binary .deb from a non-standard, non-project-official host (download.gsase.com) that cannot be independently verified as the project's own infrastructure; checksums are present but the host is a personal/unknown domain where the binary could be silently swapped.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:9 source_x86_64=("${pkgname}-${pkgver}-x86_64.deb::https://download.gsase.com/app/linux/iwan_2.4.3_amd64.deb")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Installs a prebuilt binary .deb from a non-standard, non-project-official host (download.gsase.com) that cannot be independently verified as the project's own infrastructure; checksums are present but the host is a personal/unknown domain where the binary could be silently swapped.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: silvertuanzi <126318157+silvertuanzi@users.noreply.github.com>
    
      2
    
      3pkgname="panabit-iwan"
    
      4pkgver=2.4.3
    
      5pkgrel=1
    
      6pkgdesc='iWAN desktop VPN client. Unprivileged Flutter desktop UI and system-managed VPN backend.'
    
      7arch=("x86_64" "aarch64")
    
      8license=("unknown")
    
      9source_x86_64=("${pkgname}-${pkgver}-x86_64.deb::https://download.gsase.com/app/linux/iwan_2.4.3_amd64.deb")
    
      10source_aarch64=("${pkgname}-${pkgver}-aarch64.deb::https://download.gsase.com/app/linux/iwan_2.4.3_arm64.deb")
    
      11sha256sums_x86_64=('0c63f2da8c657d5ea3e6c1a761dc668a0d42921be2522fdf47022cdd5d5cf013')
    
      12sha256sums_aarch64=('dcbeb86c9a9289f12a5e88dbeed24ec41a534cb488adab76b2f26268764479fd')
    
      13options=(!strip !debug)
    
      14
    
      15package() {
    
      16    depends=('at-spi2-core' 'libayatana-appindicator' 'libepoxy' 'glibc' 'fontconfig' 'gtk3' 'pango' 'libsecret' 'systemd' 'desktop-file-utils' 'util-linux' 'polkit' 'hicolor-icon-theme')
    
      17    backup=('etc/iwan/config.yaml')
    
      18
    
      19	bsdtar -xf data.tar.xz -C "$pkgdir/"
    
      20    find "$pkgdir/lib" -mindepth 1 -maxdepth 1 -exec mv -t "$pkgdir/usr/lib" -- {} +
    
      21    rm -rf "$pkgdir/lib"
    
      22}
    
      23

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-04 14:09:30	Medium	3
2026-11-04 14:07:06	Medium	3