proton-drive-cli-bin

maintainer imnaK · 9 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a precompiled binary from a non-whitelisted host (proton.me), which is not inherently malicious but presents a supply-chain risk if the source were swapped; however, the URL is plausibly official and the binary is checksum-verified, mitigating but not eliminating risk.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source_aarch64=("proton-drive-${pkgver}-aarch64::https://proton.me/download/drive/cli/${pkgver}/linux-arm64/proton-drive")

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a precompiled binary from a non-whitelisted host (proton.me), which is not inherently malicious but presents a supply-chain risk if the source were swapped; however, the URL is plausibly official and the binary is checksum-verified, mitigating but not eliminating risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: imnaK <yama@tyrem-envalura.de>
    
      2pkgname=proton-drive-cli-bin
    
      3pkgver=0.6.0
    
      4pkgrel=1
    
      5pkgdesc="Official Proton Drive command-line client (precompiled binary)"
    
      6arch=('aarch64' 'x86_64')
    
      7url="https://proton.me/download/drive/cli/index.html"
    
      8license=('LicenseRef-proprietary')
    
      9depends=('libsecret' 'org.freedesktop.secrets')
    
      10provides=("proton-drive-cli=${pkgver}" 'proton-drive')
    
      11conflicts=('proton-drive-cli')
    
      12options=('!strip' '!debug' '!lto')
    
      13source_aarch64=("proton-drive-${pkgver}-aarch64::https://proton.me/download/drive/cli/${pkgver}/linux-arm64/proton-drive")
    
      14source_x86_64=("proton-drive-${pkgver}-x86_64::https://proton.me/download/drive/cli/${pkgver}/linux-x64/proton-drive")
    
      15sha512sums_aarch64=('4651d7b23d111a940d5a0d308a62aaf7d39f0d6a8ceba4c6faa2bcd69624557e0eb19f5a528e8d759fb1fcd96c9e094777fabdd218372dee563c6712bd13cdde')
    
      16sha512sums_x86_64=('e77f5b27a51a81063c23c15ac0a9f07e0ec5c868e78670f34b45b3c3c2e679ed769e6225796b900d0d02735a0c52a21eba72356f3ad617de076c405532e698dc')
    
      17
    
      18package() {
    
      19    install -Dm755 "${srcdir}/proton-drive-${pkgver}-${CARCH}" "${pkgdir}/usr/bin/proton-drive"
    
      20}
    
      21

Changes since previous scan

--- PKGBUILD @ 2026-07-21 00:24
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,6 +1,6 @@
 # Maintainer: imnaK <yama@tyrem-envalura.de>
 pkgname=proton-drive-cli-bin
-pkgver=0.4.6
+pkgver=0.6.0
 pkgrel=1
 pkgdesc="Official Proton Drive command-line client (precompiled binary)"
 arch=('aarch64' 'x86_64')
@@ -12,8 +12,8 @@
 options=('!strip' '!debug' '!lto')
 source_aarch64=("proton-drive-${pkgver}-aarch64::https://proton.me/download/drive/cli/${pkgver}/linux-arm64/proton-drive")
 source_x86_64=("proton-drive-${pkgver}-x86_64::https://proton.me/download/drive/cli/${pkgver}/linux-x64/proton-drive")
-sha512sums_aarch64=('92b48ccb82f6480759aba1021546ab487c2baef93c985a2fd362d5a5766933268cd039c546786efc641b5c2cdb600c1211e1d92f343059676b8461bb21d47117')
-sha512sums_x86_64=('d187409932742e6fdc6aae2995998f4c89ea51999283395bc8d0bdc5343a79d31bf5a485d5af9adf3b7909fc92f2d2ef0b133edc4939d5faf1d096eb744425bb')
+sha512sums_aarch64=('4651d7b23d111a940d5a0d308a62aaf7d39f0d6a8ceba4c6faa2bcd69624557e0eb19f5a528e8d759fb1fcd96c9e094777fabdd218372dee563c6712bd13cdde')
+sha512sums_x86_64=('e77f5b27a51a81063c23c15ac0a9f07e0ec5c868e78670f34b45b3c3c2e679ed769e6225796b900d0d02735a0c52a21eba72356f3ad617de076c405532e698dc')
 
 package() {
     install -Dm755 "${srcdir}/proton-drive-${pkgver}-${CARCH}" "${pkgdir}/usr/bin/proton-drive"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 23:19:22	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 01:15:36	MEDIUM	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2