pgyvisitor

maintainer ShoreNinth · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads prebuilt binary .deb packages from pgy.oray.com (the official Oray/Pgy vendor site) and extracts+installs them directly. The host is the upstream vendor's own domain, not a random personal host, which reduces but does not eliminate supply-chain risk. The binaries are checksummed (sha256sums provided for all arch variants), which is the primary mitigation. The LICENSE file has SKIP for its checksum, but that is a cosmetic/data file and not a security concern. The main concern is that prebuilt closed-source binaries are being installed system-wide (including a systemd service, sbin binaries, and executable scripts), and there is no way to verify the build provenance beyond the sha256 of the downloaded .deb. This is a standard pattern for proprietary software AUR packages and is not unusual or malicious, but it does represent a real supply-chain dependency on the vendor's download infrastructure. Rating remains MEDIUM due to executed prebuilt binaries from a vendor host with no source build, which is the standard AUR risk category for such packages.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=('LICENSE::https://service.oray.com/question/1820.htm')

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads prebuilt binary .deb packages from pgy.oray.com (the official Oray/Pgy vendor site) and extracts+installs them directly. The host is the upstream vendor's own domain, not a random personal host, which reduces but does not eliminate supply-chain risk. The binaries are checksummed (sha256sums provided for all arch variants), which is the primary mitigation. The LICENSE file has SKIP for its checksum, but that is a cosmetic/data file and not a security concern. The main concern is that prebuilt closed-source binaries are being installed system-wide (including a systemd service, sbin binaries, and executable scripts), and there is no way to verify the build provenance beyond the sha256 of the downloaded .deb. This is a standard pattern for proprietary software AUR packages and is not unusual or malicious, but it does represent a real supply-chain dependency on the vendor's download infrastructure. Rating remains MEDIUM due to executed prebuilt binaries from a vendor host with no source build, which is the standard AUR risk category for such packages.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: ShoreNinth <shoreninth@outlook.com>
    
      2
    
      3pkgname=pgyvisitor
    
      4_pkgname=PgyVisitor
    
      5pkgver=6.9.0
    
      6pkgrel=1
    
      7pkgdesc="贝锐蒲公英客户端 Oray Pgy Visitor"
    
      8arch=("x86_64" "i686" "aarch64" "armv7h")
    
      9url="https://pgy.oray.com"
    
      10license=('custom')
    
      11options=("!strip" "!debug")
    
      12
    
      13source=('LICENSE::https://service.oray.com/question/1820.htm')
    
      14source_x86_64=("$_pkgname-$pkgver.deb::${url}/softwares/153/download/2549/$_pkgname-$pkgver-amd64.deb")
    
      15source_i686=("$_pkgname-$pkgver.deb::${url}/softwares/153/download/2549/$_pkgname-$pkgver-i386.deb")
    
      16source_aarch64=("$_pkgname-$pkgver.deb::${url}/softwares/153/download/2549/$_pkgname-$pkgver-arm64.deb")
    
      17source_armv7h=("$_pkgname-$pkgver.deb::${url}/softwares/153/download/2549/$_pkgname-$pkgver-arm32.deb")
    
      18
    
      19sha256sums=('SKIP')
    
      20sha256sums_x86_64=('3a53e1b36266f5031c9b4d35c02df18583437fedb384a58e897dde7c2ac8b60d')
    
      21sha256sums_i686=('ea36cb6ada55c8dc01438cbc4a3df33465bceecd74f1c6f7ff21809cf1a2834d')
    
      22sha256sums_aarch64=('ff29a02dc9d2c19e1978288cd43904ce1d6066dd5ce237196deb800066a0c659')
    
      23sha256sums_armv7h=('bda082aad45c929f5019e9bb0605246f5d9eeffa9df0bb93afa12d674e4782f0')
    
      24
    
      25prepare() {
    
      26	cd "${srcdir}"
    
      27	bsdtar -xpf $_pkgname-$pkgver.deb
    
      28}
    
      29
    
      30package() {
    
      31
    
      32	install -Dm644 LICENSE ${pkgdir}/usr/share/licenses/${pkgname}/LICENSE
    
      33	tar -xf data.tar.xz -C ${pkgdir}
    
      34	mv ${pkgdir}/usr/sbin ${pkgdir}/usr/bin
    
      35
    
      36	rm -d ${pkgdir}/etc/init.d
    
      37	chmod 755 ${pkgdir}/{etc,usr}
    
      38
    
      39#   chmod +x ${pkgdir}/usr/share/pgyvpn/script/pgyvpn_monitor
    
      40	chmod +x ${pkgdir}/usr/share/pgyvpn/script/pgyvpn_track
    
      41
    
      42	cd ${pkgdir}/usr/share/pgyvpn/script/
    
      43	install -Dm755 pgyvpn_sh_prompt ${pkgdir}/usr/share/bash-completion/completions/pgyvpn_sh_prompt
    
      44	install -Dm644 pgyvpn.service -t ${pkgdir}/usr/lib/systemd/system/
    
      45	install=$pkgname.install
    
      46}
    
      47

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2