rbfeeder

maintainer gomasy · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads prebuilt .deb binaries from a non-whitelisted but project-related host (apt.rb24.com), which is plausibly official; however, the lack of verifiable upstream source and use of binary-only packages from a non-standard domain creates a supply-chain risk if the host were compromised.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source_armv6h=("https://apt.rb24.com/pool/main/r/rbfeeder/rbfeeder_${pkgver}_armhf.deb")

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads prebuilt .deb binaries from a non-whitelisted but project-related host (apt.rb24.com), which is plausibly official; however, the lack of verifiable upstream source and use of binary-only packages from a non-standard domain creates a supply-chain risk if the host were compromised.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Gomasy <nyan@gomasy.jp>
    
      2
    
      3pkgname=rbfeeder
    
      4pkgver=1.0.15+trixie
    
      5pkgrel=1
    
      6pkgdesc="Software for uploading ADS-B data to RadarBox24.com"
    
      7arch=('armv6h' 'armv7h' 'aarch64')
    
      8url="https://www.radarbox.com/sharing-data"
    
      9license=('GPL2')
    
      10depends=('protobuf-c' 'jansson' 'rtl-sdr')
    
      11source=(
    
      12        'rbfeeder.sysusers'
    
      13        'rbfeeder.tmpfiles')
    
      14source_armv6h=("https://apt.rb24.com/pool/main/r/rbfeeder/rbfeeder_${pkgver}_armhf.deb")
    
      15source_armv7h=("https://apt.rb24.com/pool/main/r/rbfeeder/rbfeeder_${pkgver}_armhf.deb")
    
      16source_aarch64=("https://apt.rb24.com/pool/main/r/rbfeeder/rbfeeder_${pkgver}_arm64.deb")
    
      17sha256sums=(
    
      18            '3fb1dae902740e84254a2548c5d81fff18b18658ed408576a438968e43e51746'
    
      19            'd8d127259681d44b8d731c80c14658be5fcac44cf5329601dd6d89b1a4d7e82a')
    
      20sha256sums_armv6h=('17e65df51c47f4144e480aa1651356cc585c5ace40dede9fb56d7868ba93452f')
    
      21sha256sums_armv7h=('17e65df51c47f4144e480aa1651356cc585c5ace40dede9fb56d7868ba93452f')
    
      22sha256sums_aarch64=('f4b1b12e82997de9ab28270e0fa6510fe18d25fee1f675a9caea49f2878f8b27')
    
      23backup=('etc/rbfeeder.ini')
    
      24
    
      25package() {
    
      26  bsdtar -xf data.tar.xz -C "$pkgdir/"
    
      27  mv "$pkgdir/lib" "$pkgdir/usr/"
    
      28
    
      29  install -Dm644 rbfeeder.sysusers "$pkgdir/usr/lib/sysusers.d/$pkgname.conf"
    
      30  install -Dm644 rbfeeder.tmpfiles "$pkgdir/usr/lib/tmpfiles.d/$pkgname.conf"
    
      31}
    
      32

Changes since previous scan

--- PKGBUILD @ 2026-07-30 00:17
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,13 +1,13 @@
 # Maintainer: Gomasy <nyan@gomasy.jp>
 
 pkgname=rbfeeder
-pkgver=1.0.11+bookworm
+pkgver=1.0.15+trixie
 pkgrel=1
 pkgdesc="Software for uploading ADS-B data to RadarBox24.com"
 arch=('armv6h' 'armv7h' 'aarch64')
 url="https://www.radarbox.com/sharing-data"
 license=('GPL2')
-depends=('protobuf-c' 'jansson' 'rtl-sdr=1:0.8.0')
+depends=('protobuf-c' 'jansson' 'rtl-sdr')
 source=(
         'rbfeeder.sysusers'
         'rbfeeder.tmpfiles')
@@ -17,9 +17,9 @@
 sha256sums=(
             '3fb1dae902740e84254a2548c5d81fff18b18658ed408576a438968e43e51746'
             'd8d127259681d44b8d731c80c14658be5fcac44cf5329601dd6d89b1a4d7e82a')
-sha256sums_armv6h=('7a7445608db0c1b3e9fe44604df87805b36f931aa70ab5d16cdb1c02df50c122')
-sha256sums_armv7h=('7a7445608db0c1b3e9fe44604df87805b36f931aa70ab5d16cdb1c02df50c122')
-sha256sums_aarch64=('1f3216d9aeb6e3c6af21488911118a1c2d012423e5f30862b4ba55f9f7e5f71b')
+sha256sums_armv6h=('17e65df51c47f4144e480aa1651356cc585c5ace40dede9fb56d7868ba93452f')
+sha256sums_armv7h=('17e65df51c47f4144e480aa1651356cc585c5ace40dede9fb56d7868ba93452f')
+sha256sums_aarch64=('f4b1b12e82997de9ab28270e0fa6510fe18d25fee1f675a9caea49f2878f8b27')
 backup=('etc/rbfeeder.ini')
 
 package() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 07:14:03	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2