pingendo-4

maintainer orphaned · 3 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary application (an Electron/AppImage-style Linux x64 zip) from Firebase Storage (firebasestorage.googleapis.com), which is a Google-hosted cloud storage bucket controlled by the app developer's Firebase project ('pingendoauth.appspot.com'). While Firebase Storage is a legitimate hosting platform, it is not the project's canonical release host (pingendo.com) and the bucket is under the developer's control rather than a well-known release infrastructure. The downloaded zip is extracted and installed as a runnable application under /opt/pingendo — this is executed code, not mere data. The sha512 checksum provides integrity verification against tampering in transit, but does not protect against the upstream bucket owner replacing the file. This is a genuine medium-severity supply-chain concern: a prebuilt binary from a non-canonical, developer-controlled cloud storage bucket is installed and executed. It is not clearly malicious, but it is not the same as fetching from an official GitHub releases page or the vendor's primary domain.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source_x86_64=("https://firebasestorage.googleapis.com/v0/b/pingendoauth.appspot.com/o/Pingendo%20${pkgver}-linux64.zip?alt=media")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt binary application (an Electron/AppImage-style Linux x64 zip) from Firebase Storage (firebasestorage.googleapis.com), which is a Google-hosted cloud storage bucket controlled by the app developer's Firebase project ('pingendoauth.appspot.com'). While Firebase Storage is a legitimate hosting platform, it is not the project's canonical release host (pingendo.com) and the bucket is under the developer's control rather than a well-known release infrastructure. The downloaded zip is extracted and installed as a runnable application under /opt/pingendo — this is executed code, not mere data. The sha512 checksum provides integrity verification against tampering in transit, but does not protect against the upstream bucket owner replacing the file. This is a genuine medium-severity supply-chain concern: a prebuilt binary from a non-canonical, developer-controlled cloud storage bucket is installed and executed. It is not clearly malicious, but it is not the same as fetching from an official GitHub releases page or the vendor's primary domain.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: liberodark
    
      2
    
      3pkgname=pingendo-4
    
      4pkgver=4.0
    
      5pkgrel=4
    
      6pkgdesc="The ultimate Bootstrap 4 builder"
    
      7arch=('x86_64')
    
      8url="https://pingendo.com/"
    
      9license=('Custom')
    
      10depends=('xdg-utils')
    
      11source_x86_64=("https://firebasestorage.googleapis.com/v0/b/pingendoauth.appspot.com/o/Pingendo%20${pkgver}-linux64.zip?alt=media")
    
      12source=($pkgname.desktop
    
      13        $pkgname.png)
    
      14sha512sums=('bad5e3d74d5dec98b54a7fb2188ff7aff805d560256995addf0b4d6b1048d23af39299a4ad932ece3d032e2059f7c08615fe003ec587f46344316929c143dd3a'
    
      15         '93cf8eb2d6965f8047a287b4ac81d16fb755a1d85e333364ab5c7725e08bfd6084ab714a5b8b55212e5f29316df149e21c6123b2ffcbc2fff668f01481c877d5')
    
      16sha512sums_x86_64=('ec0cdcb5b8af3ffa18241b77c104c72a30cb7ce974a2ba33e7d2da3a46885c15f5553b24dbd0ea9e75e4a70ee8f24b603fd7ab95b71bb683eac35112c47d7d1d')
    
      17        
    
      18package() {
    
      19  cd $srcdir
    
      20  mkdir -p "${pkgdir}/opt/pingendo"
    
      21  cp -r Pingendo\ 4.0-linux-x64/. "${pkgdir}/opt/pingendo"
    
      22  install -vDm644 $srcdir/$pkgname.desktop $pkgdir/usr/share/applications/$pkgname.desktop
    
      23  install -vDm644 $srcdir/$pkgname.png $pkgdir/usr/share/pixmaps/$pkgname.png
    
      24}
    
      25

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2