pman

maintainer Connor · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged A prebuilt executable binary is fetched from a personal domain (concise.cc) controlled by the maintainer rather than built from the upstream GitLab source. While PGP signature verification and checksums are present, both the signing key and the hosting infrastructure are controlled by the same individual, providing no independent supply-chain guarantee. If the personal domain or key is compromised, users receive a malicious executable. This is a textbook medium-severity supply-chain risk: an executed binary from an unofficial/personal host with no independent verification path.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 "https://concise.cc/pkg/${pkgname}-${pkgver}-${pkgrel}-$arch.pkg.tar.zst"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): A prebuilt executable binary is fetched from a personal domain (concise.cc) controlled by the maintainer rather than built from the upstream GitLab source. While PGP signature verification and checksums are present, both the signing key and the hosting infrastructure are controlled by the same individual, providing no independent supply-chain guarantee. If the personal domain or key is compromised, users receive a malicious executable. This is a textbook medium-severity supply-chain risk: an executed binary from an unofficial/personal host with no independent verification path.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Connor Etherington <connor@concise.cc>
    
      2# ---
    
      3pkgname=pman
    
      4pkgver=1.3
    
      5pkgrel=1
    
      6pkgdesc="A minimal CLI download manager for all major package managers and URLs/Torrents"
    
      7arch=(any)
    
      8url="https://gitlab.com/a4to/${pkgname}"
    
      9license=('MIT')
    
      10depends=(dialog)
    
      11optdepends=(
    
      12  "git: To clone git repositories"
    
      13  "npm: To download npm packages."
    
      14  "snapd: To download and install snap packages."
    
      15  "flatpak: To download and install flatpak packages."
    
      16  "python-pip: To download python packages."
    
      17  "aria2: To download files or torrents from URLs."
    
      18  )
    
      19source=(
    
      20  "https://concise.cc/pkg/${pkgname}-${pkgver}-${pkgrel}-$arch.pkg.tar.zst"
    
      21  "https://concise.cc/pkg/${pkgname}-${pkgver}-${pkgrel}-$arch.pkg.tar.zst.sig"
    
      22  )
    
      23sha512sums=(
    
      24  'f803ef1d3f74469e8d59e5c2386ec67cddd5466bd2855e9e66d641f18b81be4a3a8c3c2d9a9d8095f3a478eeadda45bb4a9b6a8424a550932ef7ddcf1e961313'
    
      25  'a3b047773ce84b66ffae13b1db07ccec1462c3ac96dd8385e341479ae6a919c45c54a2f2e0fb7c0de33318469cfbe7fc133dd2d54fa270fac254b5a69e8cc655'
    
      26  )
    
      27md5sums=(
    
      28  'f4457232351917c8b9c3f4c6424ecbb4'
    
      29  '33c4ba2906b796fba05ae40d30dac03e'
    
      30  )
    
      31validpgpkeys=('9A1F3F41DDA55A60331CB8DD3714CB0967D15980')
    
      32
    
      33package() {
    
      34    install -Dm644 usr/share/licenses/${pkgname}/LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      35    install -Dm644 usr/share/man/man1/${pkgname}.1.gz "${pkgdir}/usr/share/man/man1/${pkgname}.1.gz"
    
      36    install -Dm644 usr/share/doc/${pkgname}/README.md "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      37    install -Dm755 usr/bin/${pkgname} "${pkgdir}/usr/bin/${pkgname}"
    
      38}
    
      39
    
      40

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2