ptrack

maintainer Connor · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary package (.pkg.tar.xz) from a personal domain (software.concise.cc) rather than from the upstream GitLab repository listed in the url field. The sha512sum provided is only 127 hex characters (should be 128), which is suspicious and may indicate a truncated/corrupted checksum. Additionally, the package() function runs 'pip3 install --user --upgrade --force-reinstall --no-deps' which installs Python code from the extracted package contents — this means whatever Python code is in that personal-hosted tarball gets executed/installed. The combination of: (1) prebuilt binary from a personal host not matching the upstream source, (2) a potentially malformed checksum, and (3) direct pip installation of the contents constitutes a genuine supply-chain risk. The validpgpkeys field is present but there is no explicit pgp signature source listed, so signature verification may not actually occur. This is a real medium-severity concern.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 "https://software.concise.cc/x86_64/${pkgname}-${pkgver}-${pkgrel}-$arch.pkg.tar.xz"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): This PKGBUILD downloads a prebuilt binary package (.pkg.tar.xz) from a personal domain (software.concise.cc) rather than from the upstream GitLab repository listed in the url field. The sha512sum provided is only 127 hex characters (should be 128), which is suspicious and may indicate a truncated/corrupted checksum. Additionally, the package() function runs 'pip3 install --user --upgrade --force-reinstall --no-deps' which installs Python code from the extracted package contents — this means whatever Python code is in that personal-hosted tarball gets executed/installed. The combination of: (1) prebuilt binary from a personal host not matching the upstream source, (2) a potentially malformed checksum, and (3) direct pip installation of the contents constitutes a genuine supply-chain risk. The validpgpkeys field is present but there is no explicit pgp signature source listed, so signature verification may not actually occur. This is a real medium-severity concern.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Connor Etherington <connor@concise.cc>
    
      2# ---
    
      3pkgname=ptrack
    
      4pkgver=2.0.3
    
      5pkgrel=1
    
      6pkgdesc="A simple CLI utility for asthetically tracking progress when copying, moving or downloading files."
    
      7arch=(x86_64)
    
      8url="https://gitlab.com/a4to/${pkgname}"
    
      9license=('MIT')
    
      10depends=("python3")
    
      11source=(
    
      12  "https://software.concise.cc/x86_64/${pkgname}-${pkgver}-${pkgrel}-$arch.pkg.tar.xz"
    
      13)
    
      14sha512sums=(
    
      15  'f96d140c3d816bd192b717d4c86d4743cce58a0ad697e9f4bba363ac4e53454e6e5aceaf8b5fb2bc74ae084b69f99b17e935552d89fb4da4d146d07d764c9fff'
    
      16)
    
      17md5sums=(
    
      18  '28b2a62914d951eec70703ec57f6969f'
    
      19)
    
      20validpgpkeys=(
    
      21  '81BACEEBC3EA26E127166E4A819BB92A9A48160E'
    
      22)
    
      23
    
      24package() {
    
      25
    
      26  cd "$srcdir/${pkgname}-${pkgver}-${pkgrel}-${arch}" 2>/dev/null ||
    
      27  cd "$srcdir/${pkgname}" 2>/dev/null
    
      28
    
      29  pip3 install --user --upgrade --force-reinstall --no-deps  ${pkgname}
    
      30
    
      31  install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      32  install -Dm644 README.md "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      33  install -Dm644 ptrack.1.gz "${pkgdir}/usr/share/man1/ptrack.1.gz"
    
      34
    
      35}
    
      36

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2