pandepth

maintainer fc-ibb105 · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The source is a prebuilt binary (not source code) fetched from a personal/unofficial GitLab mirror at mirrors.sustech.edu.cn (a SUSTech university mirror hosting a personal 'fc-ibb105' AUR repository), not from the official upstream GitHub releases page (https://github.com/HuiyangYu/PanDepth/releases). This is a real supply-chain concern: the binary is not fetched from the canonical upstream source, meaning it could be a modified or malicious binary substituted by whoever controls that mirror path. The sha512 checksum provides some integrity guarantee against tampering after the fact, but does not verify that the binary matches what the upstream author actually published. A prebuilt executable installed to /usr/bin from a non-official, personal mirror host is a genuine medium-severity supply-chain risk regardless of the checksum.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 "https://mirrors.sustech.edu.cn/git/fc-ibb105/aur/-/raw/main/${pkgname}-${pkgver}.xz"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 85%): The source is a prebuilt binary (not source code) fetched from a personal/unofficial GitLab mirror at mirrors.sustech.edu.cn (a SUSTech university mirror hosting a personal 'fc-ibb105' AUR repository), not from the official upstream GitHub releases page (https://github.com/HuiyangYu/PanDepth/releases). This is a real supply-chain concern: the binary is not fetched from the canonical upstream source, meaning it could be a modified or malicious binary substituted by whoever controls that mirror path. The sha512 checksum provides some integrity guarantee against tampering after the fact, but does not verify that the binary matches what the upstream author actually published. A prebuilt executable installed to /usr/bin from a non-official, personal mirror host is a genuine medium-severity supply-chain risk regardless of the checksum.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=pandepth
    
      2pkgver=2.26
    
      3pkgrel=1
    
      4pkgdesc="PanDepth, an ultrafast and efficient genomic tool for coverage calculation"
    
      5arch=('x86_64')
    
      6license=('MIT')
    
      7url="https://github.com/HuiyangYu/PanDepth"
    
      8depends=()
    
      9provides=("$pkgname")
    
      10conflicts=("$pkgname")
    
      11optdepends=()
    
      12
    
      13file_name=${pkgname}-${pkgver}
    
      14xz_name=$file_name.xz
    
      15
    
      16source=(
    
      17	"https://mirrors.sustech.edu.cn/git/fc-ibb105/aur/-/raw/main/${pkgname}-${pkgver}.xz"
    
      18)
    
      19
    
      20pandepth_sum=126907e912abc6d2f37931502f2599af2174addae8dddbdb26573909da797c85b3c8587ee4da5bebb1b5a7b4ac13c2ac7c9fb46e3c44fae9d81b2690a34104e7
    
      21sha512sums=(
    
      22	$pandepth_sum
    
      23)
    
      24
    
      25package() {
    
      26	export LC_ALL=en_US.UTF-8
    
      27
    
      28	mkdir -p $pkgdir/usr/bin
    
      29	#xz -d $xz_name
    
      30	mv $file_name $pkgdir/usr/bin/$pkgname
    
      31	chmod 755 $pkgdir/usr/bin/$pkgname
    
      32}
    
      33

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2