raylink

maintainer suzakuwcx · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary .deb from download.raylink.live, which is the official vendor download host for the RayLink remote desktop application (matching the official product URL raylink.live). This is a common AUR pattern for proprietary software distributed as .deb packages. The sha256sum is pinned, providing integrity verification. However, the host is a vendor-controlled CDN rather than a well-known neutral platform, and the package installs a closed-source remote desktop binary (with all the elevated trust that implies) directly from /opt. The build() function extracts the .deb's data.tar.xz and installs the binary tree wholesale. There is no signature verification beyond the sha256sum. The risk is real but typical for proprietary AUR packages: if the vendor's download server is compromised or the maintainer updates the sum to a malicious binary, arbitrary code runs on the user's machine. This is a legitimate medium-severity supply-chain concern, not a false positive, but also not evidence of active malice.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("https://download.raylink.live/web2.0/RayLink/RayLink_${pkgver}.deb"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary .deb from download.raylink.live, which is the official vendor download host for the RayLink remote desktop application (matching the official product URL raylink.live). This is a common AUR pattern for proprietary software distributed as .deb packages. The sha256sum is pinned, providing integrity verification. However, the host is a vendor-controlled CDN rather than a well-known neutral platform, and the package installs a closed-source remote desktop binary (with all the elevated trust that implies) directly from /opt. The build() function extracts the .deb's data.tar.xz and installs the binary tree wholesale. There is no signature verification beyond the sha256sum. The risk is real but typical for proprietary AUR packages: if the vendor's download server is compromised or the maintainer updates the sum to a malicious binary, arbitrary code runs on the user's machine. This is a legitimate medium-severity supply-chain concern, not a false positive, but also not evidence of active malice.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: suzakuwcx <suzakuwcx@gmail.com>
    
      2pkgname=raylink
    
      3pkgver=8.0.4.9
    
      4pkgrel=1
    
      5pkgdesc="Remote desktop software"
    
      6arch=('x86_64')
    
      7url="https://www.raylink.live/"
    
      8license=('custom')
    
      9depends=(
    
      10  'libxext' 'libxcb' 'libx11' 'libxi' 'libxrender' 'freetype2' 'fontconfig' 'dbus'
    
      11  'glib2' 'libxkbcommon' 'libxcb' 'libsm' 'libice' 'gcc-libs' 'libxau' 'libxtst'
    
      12  'libxrandr' 'libxinerama' 'libxfixes'
    
      13)
    
      14source=("https://download.raylink.live/web2.0/RayLink/RayLink_${pkgver}.deb"
    
      15        "raylink")
    
      16sha256sums=('7b6b64c91746cfb5e06357d335fc1f8b26f9320396bba91a71a6bc038f343c15'
    
      17            '92ae584ea900015d7f8bf92214533742711e0a24aa2bd67a5291331aee023d9f')
    
      18
    
      19build() {
    
      20    tar -Jxvf data.tar.xz
    
      21    tar -zxvf control.tar.gz
    
      22}
    
      23
    
      24package() {
    
      25    cp --no-preserve=ownership -fR opt/ "${pkgdir}/opt/"
    
      26    install -Dm755 "${srcdir}/raylink" "${pkgdir}/usr/bin/raylink"
    
      27    install -Dm644 "${srcdir}/usr/share/applications/raylink.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      28}
    
      29

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2