puffin-internet-terminal-bin

maintainer ZhymabekRoman · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads prebuilt .deb files from the official vendor's domain (download.puffinbrowser.com), which is plausibly controlled by the software vendor; the files are verified with fixed, matching checksums, and the installation extracts and sets up the official binaries without executing remote code or introducing untrusted dependencies.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt .deb files from the official vendor's domain (download.puffinbrowser.com), which is plausibly controlled by the software vendor; the files are verified with fixed, matching checksums, and the installation extracts and sets up the official binaries without executing remote code or introducing untrusted dependencies.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 source_x86_64=("https://download.puffinbrowser.com/repo/pool/stable/amd64/puffin-internet-terminal_${pkgver}_amd64.deb")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Zhymabek Roman
    
      2pkgname=puffin-internet-terminal-bin
    
      3pkgver=8.2.4.705
    
      4pkgrel=2
    
      5pkgdesc="The wicked fast web browser from CloudMosa Inc."
    
      6arch=('x86_64' 'i686' 'aarch64')
    
      7url="https://www.puffin.com/"
    
      8license=('custom')
    
      9groups=()
    
      10depends=()
    
      11makedepends=()
    
      12checkdepends=()
    
      13optdepends=()
    
      14provides=()
    
      15conflicts=()
    
      16replaces=()
    
      17backup=()
    
      18options=()
    
      19install=
    
      20changelog=
    
      21noextract=()
    
      22source_x86_64=("https://download.puffinbrowser.com/repo/pool/stable/amd64/puffin-internet-terminal_${pkgver}_amd64.deb")
    
      23source_i686=("https://download.puffinbrowser.com/repo/pool/stable/i386/puffin-internet-terminal_${pkgver}_i386.deb")
    
      24source_aarch64=("https://download.puffinbrowser.com/repo/pool/stable/arm64/puffin-internet-terminal_${pkgver}_arm64.deb")
    
      25sha256sums_x86_64=('14dfad4dc78c7c1e700bee8b02eef7721416417b06b6886b2bb71134b9fd4714')
    
      26sha256sums_i686=('54cf2d978bec057b33c56ba9de0a6ab0d8e81127386b1ba97540b701073e0d4e')
    
      27sha256sums_aarch64=('02539bd1d062d357aaa8969b08778eaf8c9dffa3ebf5b46d5c64cf94e640e6e1')
    
      28validpgpkeys=()
    
      29
    
      30package() {
    
      31  cd "$srcdir"
    
      32  tar xf data.tar.xz -C "${pkgdir}"
    
      33  chmod 755 "${pkgdir}/opt/" "${pkgdir}/usr" "${pkgdir}/usr/bin/" "${pkgdir}/usr/share/" "${pkgdir}/usr/share/applications" "${pkgdir}/usr/share/appdata"
    
      34  rm "${pkgdir}/opt/cloudmosa/puffin/upgrade" "${pkgdir}/opt/cloudmosa/puffin/upgrade_agent"
    
      35  ln -s "${pkgdit}"/opt/cloudmosa/puffin/puffin "${pkgdir}"/usr/bin/puffin
    
      36}
    
      37

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2