plink2-bin

MEDIUM

maintainer imjiaoyuan 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package downloads a prebuilt binary from an unverifiable S3 bucket URL, which is not the project's official domain, posing a supply-chain risk if the source were silently swapped.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 "https://s3.amazonaws.com/plink2-assets/alpha7/plink2_linux_x86_64_20261015.zip"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt binary from an unverifiable S3 bucket URL, which is not the project's official domain, posing a supply-chain risk if the source were silently swapped.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: imjiaoyuan <imjiaoyuan@gmail.com>
    
      2
    
      3pkgname=plink2-bin
    
      4_pkgname=plink2
    
      5pkgver=2.0a7.13
    
      6pkgrel=1
    
      7pkgdesc="Whole-genome association analysis toolset for large-scale variant data"
    
      8arch=('x86_64')
    
      9url="https://www.cog-genomics.org/plink/2.0/"
    
      10license=('GPL-3.0-or-later' 'LicenseRef-Intel-Simplified-Software-License')
    
      11provides=("plink2=$pkgver")
    
      12conflicts=('plink2')
    
      13options=('!strip' '!debug')
    
      14source=(
    
      15  "https://s3.amazonaws.com/plink2-assets/alpha7/plink2_linux_x86_64_20261015.zip"
    
      16)
    
      17sha256sums=('c91851a41a53d42c79781c580a99be3a752dcd7e6ab891baf411a02e4815e700')
    
      18
    
      19package() {
    
      20  install -Dm755 "${srcdir}/${_pkgname}" "${pkgdir}/usr/bin/${_pkgname}"
    
      21  install -Dm755 "${srcdir}/vcf_subset" "${pkgdir}/usr/bin/vcf_subset"
    
      22  install -Dm644 "${srcdir}/intel-simplified-software-license.txt" \
    
      23    "${pkgdir}/usr/share/licenses/${pkgname}/intel-simplified-software-license.txt"
    
      24}
    
      25

Changes since previous scan

--- PKGBUILD @ 2026-10-15 00:28
+++ PKGBUILD @ 2026-10-17 00:21
@@ -2,7 +2,7 @@
 
 pkgname=plink2-bin
 _pkgname=plink2
-pkgver=2.0a7.12
+pkgver=2.0a7.13
 pkgrel=1
 pkgdesc="Whole-genome association analysis toolset for large-scale variant data"
 arch=('x86_64')
@@ -12,9 +12,9 @@
 conflicts=('plink2')
 options=('!strip' '!debug')
 source=(
-  "https://s3.amazonaws.com/plink2-assets/alpha7/plink2_linux_x86_64_20261012.zip"
+  "https://s3.amazonaws.com/plink2-assets/alpha7/plink2_linux_x86_64_20261015.zip"
 )
-sha256sums=('cdc6da540594e98a40d4a24376cd7f00ba1497ac2632c4cf36182a72fee9241d')
+sha256sums=('c91851a41a53d42c79781c580a99be3a752dcd7e6ab891baf411a02e4815e700')
 
 package() {
   install -Dm755 "${srcdir}/${_pkgname}" "${pkgdir}/usr/bin/${_pkgname}"

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 15:12:23	Medium	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 03:15:27	Medium	1
2026-10-13 00:23:45	Low	2
2026-10-12 00:18:51	Low	2
2026-10-11 00:26:05	Low	2
2026-10-10 00:11:52	Low	2
2026-10-09 08:10:33	Medium	1
2026-10-09 00:05:33	Low	2
2026-10-08 00:28:03	Low	2
2026-10-07 00:21:34	Low	2
2026-10-06 00:13:36	Low	2
2026-10-05 00:08:03	Low	2
2026-10-04 00:18:08	Low	2
2026-10-03 00:23:04	Low	2
2026-10-02 00:00:32	Low	2
2026-10-01 00:02:06	Low	2