pureref

maintainer meepzh · 24 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The PKGBUILD fetches a .deb from the official PureRef website (www.pureref.com), which is the legitimate upstream vendor. The dynamic key fetch is unusual but is simply how PureRef gates downloads (a download key from their own site). The b2sum is hardcoded and will verify the downloaded .deb against a known-good hash, which is the critical integrity control. The AppImage is the official vendor-distributed binary, not from a personal/unofficial host. The main concern is that the key is fetched at build time outside of source=(), meaning the URL is constructed dynamically — but since the b2sum is pinned, any tampered file would fail verification. This is sloppy packaging (the key fetch happens at parse time, not in a function), but not a security risk given the checksum. Rating: low (non-standard pattern, official vendor host, integrity check present).

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 82%): The PKGBUILD fetches a .deb from the official PureRef website (www.pureref.com), which is the legitimate upstream vendor. The dynamic key fetch is unusual but is simply how PureRef gates downloads (a download key from their own site). The b2sum is hardcoded and will verify the downloaded .deb against a known-good hash, which is the critical integrity control. The AppImage is the official vendor-distributed binary, not from a personal/unofficial host. The main concern is that the key is fetched at build time outside of source=(), meaning the URL is constructed dynamically — but since the b2sum is pinned, any tampered file would fail verification. This is sloppy packaging (the key fetch happens at parse time, not in a function), but not a security risk given the checksum. Rating: low (non-standard pattern, official vendor host, integrity check present).

2 higher static findings superseded - not the current verdict (shown for transparency)

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:18 key=$(curl -A 'AUR PKGBUILD/Please contact maintainer if there is an issue' -s https://www.pureref.com/download.php | awk '/setupPaymentSystem/,/);/' | grep -zoP '\s+"\K[A-z0-9%]+?",' | sed 's/...$//')

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 source=("${pkgname}-${pkgver}.deb::https://www.pureref.com/files/build.php?build=LINUX64.deb&version=${pkgver}&downloadKey=$key")

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Robert Zhou <meep (dot) aur (at) meepzh (dot) com>
    
      2# Contributor: FailSpy <failspy at exonull dot com>
    
      3# Contributor: GrbavaCigla <alexa.ognjanovic at gmail dot com>
    
      4# Contributor: hawerner
    
      5# Contributor: tryst
    
      6# Contributor: gangelop
    
      7pkgname=pureref
    
      8_pkgname=PureRef
    
      9pkgver=2.1.3
    
      10pkgrel=1
    
      11pkgdesc="Reference Image Viewer"
    
      12arch=('x86_64')
    
      13url="http://www.pureref.com"
    
      14license=('LicenseRef-PureRef')
    
      15depends=('fuse2')
    
      16options=(!debug !strip)
    
      17
    
      18key=$(curl -A 'AUR PKGBUILD/Please contact maintainer if there is an issue' -s https://www.pureref.com/download.php | awk '/setupPaymentSystem/,/);/' | grep -zoP '\s+"\K[A-z0-9%]+?",' | sed 's/...$//')
    
      19source=("${pkgname}-${pkgver}.deb::https://www.pureref.com/files/build.php?build=LINUX64.deb&version=${pkgver}&downloadKey=$key")
    
      20b2sums=('5b9cae3255f96df682d2bd528b38e05e76ea38e947e57a5d2245555abb0917eac79231fdb8e04830d95a66736ad7aa811c1f16a49a86e56505a9aee9e172604c')
    
      21
    
      22prepare(){
    
      23  ar x "${pkgname}-${pkgver}.deb"
    
      24}
    
      25
    
      26package(){
    
      27  tar xf data.tar.xz -C "${pkgdir}"
    
      28  chmod -R 755 "${pkgdir}"
    
      29
    
      30  bin="${pkgdir}/usr/bin/${_pkgname}"
    
      31  install -D "${bin}" "${pkgdir}/opt/${pkgname}/${_pkgname}.AppImage"
    
      32  rm "${bin}"
    
      33  ln -s "/opt/${pkgname}/${_pkgname}.AppImage" "${bin}"
    
      34
    
      35  install -Dm644 "${pkgdir}/usr/share/doc/${_pkgname}/LICENSE.txt" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      36}
    
      37

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 00:17:08	LOW	3
2026-07-18 00:14:48	LOW	3
2026-07-17 00:06:16	LOW	3
2026-07-16 00:05:41	LOW	3
2026-07-15 00:09:25	LOW	3