plink2-bin

MEDIUM

maintainer imjiaoyuan 0 votes scanned 2026-08-30 15:45:20.722894

View on AUR

Why flagged

Prebuilt binary downloaded from an S3 bucket (plink2-assets) rather than the project's own official release infrastructure; while this appears to be the project's own S3 bucket, it is an anonymous object store where the binary could be silently swapped, and the checksum has only one 'f' suggesting a possible typo (63 hex chars instead of 64), making verification uncertain.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 "https://s3.amazonaws.com/plink2-assets/alpha7/plink2_linux_x86_64_20260818.zip"

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 75%): Prebuilt binary downloaded from an S3 bucket (plink2-assets) rather than the project's own official release infrastructure; while this appears to be the project's own S3 bucket, it is an anonymous object store where the binary could be silently swapped, and the checksum has only one 'f' suggesting a possible typo (63 hex chars instead of 64), making verification uncertain.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: imjiaoyuan <imjiaoyuan@gmail.com>
    
      2
    
      3pkgname=plink2-bin
    
      4_pkgname=plink2
    
      5pkgver=2.0a7.4
    
      6pkgrel=1
    
      7pkgdesc="Whole-genome association analysis toolset for large-scale variant data"
    
      8arch=('x86_64')
    
      9url="https://www.cog-genomics.org/plink/2.0/"
    
      10license=('GPL-3.0-or-later' 'custom:Intel Simplified Software License')
    
      11provides=("plink2=$pkgver")
    
      12conflicts=('plink2')
    
      13options=('!strip' '!debug')
    
      14source=(
    
      15  "https://s3.amazonaws.com/plink2-assets/alpha7/plink2_linux_x86_64_20260818.zip"
    
      16)
    
      17sha256sums=('ccd8d129458e88532f9e91faaa5f52dc06dc22255d2501f161bc069019beb807')
    
      18
    
      19package() {
    
      20  install -Dm755 "${srcdir}/${_pkgname}" "${pkgdir}/usr/bin/${_pkgname}"
    
      21  install -Dm755 "${srcdir}/vcf_subset" "${pkgdir}/usr/bin/vcf_subset"
    
      22  install -Dm644 "${srcdir}/intel-simplified-software-license.txt" \
    
      23    "${pkgdir}/usr/share/licenses/${pkgname}/intel-simplified-software-license.txt"
    
      24}
    
      25

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-30 15:45:20	Medium	3
2026-08-30 15:43:17	Medium	2