pyrefly-bin

maintainer minhnbnt · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads prebuilt .vsix binaries from open-vsx.org, a third-party registry not directly controlled by the project's official source (GitHub), creating a supply-chain risk if the artifact is swapped, despite valid checksums.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source_aarch64=("https://open-vsx.org/api/meta/pyrefly/linux-arm64/${pkgver}/file/meta.pyrefly-${pkgver}@linux-arm64.vsix")

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads prebuilt .vsix binaries from open-vsx.org, a third-party registry not directly controlled by the project's official source (GitHub), creating a supply-chain risk if the artifact is swapped, despite valid checksums.

PKGBUILD

1 offending line(s) highlighted

      1# Contributor: Nguyễn Quang Minh <minhnbnt at gmail dot com>
    
      2
    
      3pkgname=pyrefly-bin
    
      4pkgver=1.2.0 # datasource=github-tags depName=facebook/pyrefly
    
      5pkgrel=1
    
      6pkgdesc='A faster Python type checker written in Rust'
    
      7provides=('pyrefly')
    
      8conflicts=('pyrefly')
    
      9arch=('aarch64' 'armv7h' 'x86_64')
    
      10url='https://pyrefly.org/'
    
      11license=('MIT')
    
      12
    
      13source_aarch64=("https://open-vsx.org/api/meta/pyrefly/linux-arm64/${pkgver}/file/meta.pyrefly-${pkgver}@linux-arm64.vsix")
    
      14source_armv7h=("https://open-vsx.org/api/meta/pyrefly/linux-armhf/${pkgver}/file/meta.pyrefly-${pkgver}@linux-armhf.vsix")
    
      15source_x86_64=("https://open-vsx.org/api/meta/pyrefly/linux-x64/${pkgver}/file/meta.pyrefly-${pkgver}@linux-x64.vsix")
    
      16
    
      17sha256sums_aarch64=('2aa1078a744161f576f0dcae7a7020a488d193d09fe0a4e5049e4ab8ea31e536')
    
      18sha256sums_armv7h=('b007fa8212dd62377b0e282959dd5c4f56bba794db818d2c74d7c3853c9a2b69')
    
      19sha256sums_x86_64=('13c6918fa25f68961eed098486b12aedec63f92978ca71d3774b08e4c35ece07')
    
      20
    
      21package() {
    
      22
    
      23	cd "${srcdir}/extension"
    
      24
    
      25	install -Dm755 "bin/pyrefly" "${pkgdir}/usr/bin/pyrefly"
    
      26	install -Dm644 "LICENSE.txt" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      27}
    
      28

Changes since previous scan

--- PKGBUILD @ 2026-08-01 00:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,9 +1,11 @@
 # Contributor: Nguyễn Quang Minh <minhnbnt at gmail dot com>
 
 pkgname=pyrefly-bin
-pkgver=1.0.0 # datasource=github-tags depName=facebook/pyrefly
+pkgver=1.2.0 # datasource=github-tags depName=facebook/pyrefly
 pkgrel=1
 pkgdesc='A faster Python type checker written in Rust'
+provides=('pyrefly')
+conflicts=('pyrefly')
 arch=('aarch64' 'armv7h' 'x86_64')
 url='https://pyrefly.org/'
 license=('MIT')
@@ -12,9 +14,9 @@
 source_armv7h=("https://open-vsx.org/api/meta/pyrefly/linux-armhf/${pkgver}/file/meta.pyrefly-${pkgver}@linux-armhf.vsix")
 source_x86_64=("https://open-vsx.org/api/meta/pyrefly/linux-x64/${pkgver}/file/meta.pyrefly-${pkgver}@linux-x64.vsix")
 
-sha256sums_aarch64=('d0731b1d6da91584d78491f9709e8925848d597b77b764b13c111ad49f138578')
-sha256sums_armv7h=('fe81584e0f79184c4eeff53684c071bae0a7ff87c8476a75ea5f23e797e2a96e')
-sha256sums_x86_64=('3e33ad0c170f9f54cadaa551099cc7ba68c42661fc213bf7eb6ed8d388bc2849')
+sha256sums_aarch64=('2aa1078a744161f576f0dcae7a7020a488d193d09fe0a4e5049e4ab8ea31e536')
+sha256sums_armv7h=('b007fa8212dd62377b0e282959dd5c4f56bba794db818d2c74d7c3853c9a2b69')
+sha256sums_x86_64=('13c6918fa25f68961eed098486b12aedec63f92978ca71d3774b08e4c35ece07')
 
 package() {
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 07:20:18	MEDIUM	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2