r7draw-desktop-bin

MEDIUM

maintainer xpltt 0 votes scanned 2026-08-21 07:16:00.881847

View on AUR

Why flagged

Installs a prebuilt proprietary binary .deb from download.r7-office.ru, which is the vendor's own domain but is a non-whitelisted Russian office suite vendor; the binary is unverifiable beyond the provided sha256sum, and the package has few votes/is recently uploaded, making it a moderate supply-chain risk if the host were compromised or swapped, though no obfuscation or exfiltration is present.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("https://download.r7-office.ru/r7graph/r7draw-desktop-amd64-${pkgver}.deb")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Installs a prebuilt proprietary binary .deb from download.r7-office.ru, which is the vendor's own domain but is a non-whitelisted Russian office suite vendor; the binary is unverifiable beyond the provided sha256sum, and the package has few votes/is recently uploaded, making it a moderate supply-chain risk if the host were compromised or swapped, though no obfuscation or exfiltration is present.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jahongir Ahmadaliev jahamarsi@gmail.com
    
      2pkgname=r7draw-desktop-bin
    
      3pkgver=26.1.2
    
      4pkgrel=1
    
      5pkgdesc="R7 Draw — diagram and flowchart editor by R7-Office"
    
      6arch=('x86_64')
    
      7url="https://gitlab.r7-office.ru/draw/r7draw-desktop"
    
      8license=('LicenseRef-Proprietary')
    
      9depends=('gtk3' 'libnotify' 'nss' 'libxss' 'libxtst' 'xdg-utils'
    
      10         'at-spi2-core' 'util-linux-libs' 'libsecret' 'alsa-lib')
    
      11optdepends=('libappindicator-gtk3: system tray icon')
    
      12provides=('r7draw-desktop')
    
      13conflicts=('r7draw-desktop')
    
      14options=('!strip')
    
      15source=("https://download.r7-office.ru/r7graph/r7draw-desktop-amd64-${pkgver}.deb")
    
      16sha256sums=('dfa1b1a838e98261f4cb9495560a7c399e671e114de0a8161f6e10b973990514')
    
      17
    
      18package() {
    
      19    tar xf data.tar.xz -C "${pkgdir}"
    
      20
    
      21    chmod 4755 "${pkgdir}/opt/Р7-Графика/chrome-sandbox"
    
      22
    
      23    install -d "${pkgdir}/usr/bin"
    
      24    ln -s "/opt/Р7-Графика/r7draw-desktop" "${pkgdir}/usr/bin/r7draw-desktop"
    
      25
    
      26    sed -i \
    
      27        -e 's/^Name=.*/Name=R7 Draw/' \
    
      28        -e 's/^Comment=.*/Comment=Create flowcharts and diagrams/' \
    
      29        "${pkgdir}/usr/share/applications/r7draw-desktop.desktop"
    
      30}
    
      31

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-21 07:16:00	Medium	3
2026-08-21 07:14:31	Medium	3