qteasytier-bin

maintainer myqfeng · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs a prebuilt binary from a non-standard host (Gitee release asset) with no upstream source build, creating a supply-chain risk if the host or release is compromised.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("https://gitee.com/qteasytier/qt-easy-tier/releases/download/${pkgver}/qteasytier_v${pkgver}_linux_amd64.deb")

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package installs a prebuilt binary from a non-standard host (Gitee release asset) with no upstream source build, creating a supply-chain risk if the host or release is compromised.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Myqfeng <viagrahuang@outlook.com>
    
      2
    
      3pkgname=qteasytier-bin
    
      4pkgver=3.0.2
    
      5pkgrel=2
    
      6pkgdesc="基于 EasyTier, 一款美观实用的远程联机工具!"
    
      7arch=('x86_64')
    
      8options=('!debug')
    
      9url="https://gitee.com/qteasytier/qt-easy-tier"
    
      10license=('LGPL3')
    
      11depends=('qt6-base' 'qt6-declarative' 'qt6-svg' 'polkit')
    
      12makedepends=('binutils')
    
      13provides=('qteasytier')
    
      14conflicts=('qteasytier')
    
      15install=qteasytier.install
    
      16source=("https://gitee.com/qteasytier/qt-easy-tier/releases/download/${pkgver}/qteasytier_v${pkgver}_linux_amd64.deb")
    
      17sha256sums=('1be6dfe5cfda9c40b8df576e4b80ffb27731f1cb95cf8ce99afbd5cfda782aad')
    
      18
    
      19package() {
    
      20    cd "${srcdir}"
    
      21    ar x "qteasytier_v${pkgver}_linux_amd64.deb"
    
      22    tar -xf data.tar.* -C "${pkgdir}"
    
      23}
    
      24

Changes since previous scan

--- PKGBUILD @ 2026-07-21 00:24
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,8 +1,8 @@
 # Maintainer: Myqfeng <viagrahuang@outlook.com>
 
 pkgname=qteasytier-bin
-pkgver=3.0.1
-pkgrel=1
+pkgver=3.0.2
+pkgrel=2
 pkgdesc="基于 EasyTier, 一款美观实用的远程联机工具!"
 arch=('x86_64')
 options=('!debug')
@@ -14,7 +14,7 @@
 conflicts=('qteasytier')
 install=qteasytier.install
 source=("https://gitee.com/qteasytier/qt-easy-tier/releases/download/${pkgver}/qteasytier_v${pkgver}_linux_amd64.deb")
-sha256sums=('9cd157870cc44efcd356717abb453fef62df3dcaaed5b45751118cba8d2521aa')
+sha256sums=('1be6dfe5cfda9c40b8df576e4b80ffb27731f1cb95cf8ce99afbd5cfda782aad')
 
 package() {
     cd "${srcdir}"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 00:29:32	MEDIUM	3
2026-07-21 05:16:02	MEDIUM	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 00:17:08	LOW	3
2026-07-18 07:59:17	LOW	3
2026-07-18 07:57:03	MEDIUM	3