password-gorilla

maintainer holgerob · 7 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD installs a prebuilt x86_64 binary (gorilla1537_64.bin) directly from gorilla.dp100.com, a non-official third-party host unrelated to the upstream GitHub repository (github.com/zdia/gorilla). The binary is executed as the installed application. While sha256sums are present (providing integrity at the time of packaging), the host is not the upstream GitHub releases page, meaning the binary provenance is unverifiable and the host could be compromised or the binary swapped without a PKGBUILD update. The '!strip' option and .bin extension confirm this is a prebuilt executable. This is a classic supply-chain concern: an unofficial host serving an executed binary. The medium rating from the cheaper model is correct.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 "http://gorilla.dp100.com/downloads/${_realpkgname}1537_64.bin"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD installs a prebuilt x86_64 binary (gorilla1537_64.bin) directly from gorilla.dp100.com, a non-official third-party host unrelated to the upstream GitHub repository (github.com/zdia/gorilla). The binary is executed as the installed application. While sha256sums are present (providing integrity at the time of packaging), the host is not the upstream GitHub releases page, meaning the binary provenance is unverifiable and the host could be compromised or the binary swapped without a PKGBUILD update. The '!strip' option and .bin extension confirm this is a prebuilt executable. This is a classic supply-chain concern: an unofficial host serving an executed binary. The medium rating from the cheaper model is correct.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Holger Obermaier
    
      2pkgname="password-gorilla"
    
      3_realpkgname="gorilla"
    
      4pkgver="1.5.3.7"
    
      5pkgrel=7
    
      6pkgdesc="A cross-platform password manager."
    
      7arch=('x86_64')
    
      8url="https://github.com/zdia/gorilla/wiki/"
    
      9license=('GPL2')
    
      10depends=(
    
      11    'glibc'
    
      12    'hicolor-icon-theme'
    
      13)
    
      14source=(
    
      15    "http://gorilla.dp100.com/downloads/${_realpkgname}1537_64.bin"
    
      16    "http://gorilla.dp100.com/downloads/${_realpkgname}-1.5.3.7.zip"
    
      17)
    
      18sha256sums=(
    
      19    '19f4cfa9f76a04d6c5427b0049f8e2d5833367676b71d12f2c0205c0483739a6'
    
      20    '747483e3d9cc7dfac48be0445c5f606e8d18a01dd91edbcee9d361c39bfec951'
    
      21)
    
      22options=( '!strip' )
    
      23
    
      24package() {
    
      25    # target directory structur
    
      26    local bin_dir="${pkgdir}/usr/bin"
    
      27    local icon_dir="${pkgdir}/usr/share/icons/hicolor"
    
      28    local icon48x48_dir="${icon_dir}/48x48/apps"
    
      29    local icon32x32_dir="${icon_dir}/32x32/apps"
    
      30    local icon16x16_dir="${icon_dir}/16x16/apps"
    
      31    local pixmaps_dir="${pkgdir}/usr/share/pixmaps"
    
      32    local desktop_dir="${pkgdir}/usr/share/applications"
    
      33    local menu_dir="${pkgdir}/usr/share/menu"
    
      34    local man_dir="${pkgdir}/usr/share/man/man1"
    
      35
    
      36    # source directory structure
    
      37    local srcdir_deb="${srcdir}/${_realpkgname}-${pkgver}/utilities/make-deb.data"
    
      38
    
      39    # binary
    
      40    install -D --preserve-timestamps --verbose --mode=u=rwx,go=rx "${srcdir}/gorilla1537_64.bin" "${bin_dir}/password-gorilla"
    
      41
    
      42    # icons
    
      43    install -D --preserve-timestamps --verbose "${srcdir_deb}/16x16.password-gorilla.png" "${icon16x16_dir}/password-gorilla.png"
    
      44    install -D --preserve-timestamps --verbose "${srcdir_deb}/32x32.password-gorilla.png" "${icon32x32_dir}/password-gorilla.png"
    
      45    install -D --preserve-timestamps --verbose "${srcdir_deb}/48x48.password-gorilla.png" "${icon48x48_dir}/password-gorilla.png"
    
      46    install -D --preserve-timestamps --verbose "${srcdir_deb}/password-gorilla.xpm" "${pixmaps_dir}/password-gorilla.xpm"
    
      47
    
      48    # desktop file
    
      49    install -D --preserve-timestamps --verbose "${srcdir_deb}/password-gorilla.desktop" "${desktop_dir}/password-gorilla.desktop"
    
      50
    
      51    # menu file
    
      52    install -D --preserve-timestamps --verbose "${srcdir_deb}/password-gorilla.menu" "${menu_dir}/password-gorilla.menu"
    
      53
    
      54    # man file
    
      55    install -D --preserve-timestamps --verbose "${srcdir_deb}/password-gorilla.1" "${man_dir}/password-gorilla.1"
    
      56}
    
      57

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2