quick-ssh

maintainer CCE-Li · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary from a GitHub release with 'SKIP' checksum, preventing verification and creating a supply-chain risk if the source were compromised.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package downloads a prebuilt binary from a GitHub release with 'SKIP' checksum, preventing verification and creating a supply-chain risk if the source were compromised.

PKGBUILD

      1# Maintainer: CCE-Li <2766503189@qq.com>
    
      2# PKGBUILD for Quick-SSH (Arch Linux)
    
      3# Rust 原生二进制版本 - 无需 Node.js 依赖
    
      4#
    
      5# Quick-SSH 使用 Rust 编译为原生二进制，无运行时依赖。
    
      6#
    
      7# 更新步骤:
    
      8#   1. 更新 pkgver 到新版本号
    
      9#   2. 从 GitHub Release 的 SHA256SUMS 中获取 qssh-x86_64-linux.tar.gz 的哈希值
    
      10#   3. 运行: makepkg --printsrcinfo > .SRCINFO
    
      11#   4. git commit && git push
    
      12
    
      13pkgname=quick-ssh
    
      14pkgver=2.0.4
    
      15pkgrel=1
    
      16pkgdesc="🚀 Quick-SSH - Docker-style SSH connection manager with TUI (Rust native binary)"
    
      17arch=('x86_64')
    
      18url="https://github.com/CCE-Li/Quick-SSH"
    
      19license=('MIT')
    
      20depends=('glibc' 'openssh')
    
      21provides=('quick-ssh')
    
      22conflicts=('quick-ssh')
    
      23source=("$url/releases/download/v$pkgver/qssh-x86_64-linux.tar.gz")
    
      24sha256sums=('SKIP')
    
      25# 注: 发布前请从 Release 的 SHA256SUMS 中获取真实哈希值替换 SKIP
    
      26
    
      27package() {
    
      28  tar xzf "$srcdir/qssh-x86_64-linux.tar.gz" -C "$srcdir"
    
      29  install -dm755 "$pkgdir/usr/bin"
    
      30  install -m755 "$srcdir/qssh-x86_64-linux/qssh" "$pkgdir/usr/bin/qssh"
    
      31  install -m755 "$srcdir/qssh-x86_64-linux/qssh-uploader" "$pkgdir/usr/bin/qssh-uploader"
    
      32}
    
      33
    
      34

Changes since previous scan

--- PKGBUILD @ 2026-07-31 00:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -11,7 +11,7 @@
 #   4. git commit && git push
 
 pkgname=quick-ssh
-pkgver=2.0.2
+pkgver=2.0.4
 pkgrel=1
 pkgdesc="🚀 Quick-SSH - Docker-style SSH connection manager with TUI (Rust native binary)"
 arch=('x86_64')
@@ -21,7 +21,7 @@
 provides=('quick-ssh')
 conflicts=('quick-ssh')
 source=("$url/releases/download/v$pkgver/qssh-x86_64-linux.tar.gz")
-sha256sums=('4794d11f18a96101d1e50eb55ccb7518435a9d0d9afa32a1ce250e5ef6aef488')
+sha256sums=('SKIP')
 # 注: 发布前请从 Release 的 SHA256SUMS 中获取真实哈希值替换 SKIP
 
 package() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 13:18:10	MEDIUM	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 15:20:42	LOW	2