qed

maintainer Connor · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary package (.pkg.tar.zst) from a personal domain (concise.cc) rather than from the project's official GitLab release infrastructure. While the package is signed (validpgpkeys is set and a .sig file is fetched), the signing key belongs to the maintainer themselves, and the binary is hosted on their personal domain rather than GitLab releases. The arch=(any) combined with a prebuilt binary is also suspicious — a shell script tool depending only on 'dialog' should be architecture-independent source, not a prebuilt binary. The PKGBUILD installs the binary directly from the downloaded package rather than building from source. This is a genuine supply-chain concern: if concise.cc is compromised, a malicious binary could be served. The PGP signature provides some mitigation but the trust anchor is the maintainer's own key on their own server. This warrants medium severity.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 "https://concise.cc/pkg/${pkgname}-${pkgver}-${pkgrel}-$arch.pkg.tar.zst"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt binary package (.pkg.tar.zst) from a personal domain (concise.cc) rather than from the project's official GitLab release infrastructure. While the package is signed (validpgpkeys is set and a .sig file is fetched), the signing key belongs to the maintainer themselves, and the binary is hosted on their personal domain rather than GitLab releases. The arch=(any) combined with a prebuilt binary is also suspicious — a shell script tool depending only on 'dialog' should be architecture-independent source, not a prebuilt binary. The PKGBUILD installs the binary directly from the downloaded package rather than building from source. This is a genuine supply-chain concern: if concise.cc is compromised, a malicious binary could be served. The PGP signature provides some mitigation but the trust anchor is the maintainer's own key on their own server. This warrants medium severity.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Connor Etherington <connor@concise.cc>
    
      2# ---
    
      3pkgname=qed
    
      4pkgver=0.1.1
    
      5pkgrel=1
    
      6arch=(any)
    
      7pkgdesc="Quick Edit - A CLI tool to quickly edit and save files saved slots 1-10"
    
      8url="https://gitlab.com/a4to/${pkgname}"
    
      9install="qed.install"
    
      10license=('MIT')
    
      11depends=(dialog)
    
      12source=(
    
      13  "https://concise.cc/pkg/${pkgname}-${pkgver}-${pkgrel}-$arch.pkg.tar.zst"
    
      14  "https://concise.cc/pkg/${pkgname}-${pkgver}-${pkgrel}-$arch.pkg.tar.zst.sig"
    
      15  )
    
      16sha512sums=(
    
      17  'ed98ae6153d019089bed247dcf9e97bc200937e8b7a3a2cb31a53404e7f55f9c433819a9445c01b06f4fc4f9e32f797dfe606ae9a21b2731c2693794be549b23'
    
      18  '69f316a7f012109ae382dd4a076b438e4e91ef434ca5615a24df4fbdc9f87cd7fa1cb110bc570c9298d0eb560e653f96f1d877e28d66c85b8a439dc6dae961d9'
    
      19  )
    
      20md5sums=(
    
      21  'cc3a704c6f950c8442ef55e0d38a6057'
    
      22  'e7f64624eb51f3a49a667f50aafa18e9'
    
      23  )
    
      24validpgpkeys=('9A1F3F41DDA55A60331CB8DD3714CB0967D15980')
    
      25
    
      26package() {
    
      27    install -Dm644 usr/share/licenses/${pkgname}/LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      28    install -Dm755 usr/bin/${pkgname} "${pkgdir}/usr/bin/${pkgname}"
    
      29}
    
      30

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2