regressi-bin

maintainer polix_minus · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary (regressiM) directly from regressi.fr with no version in the URL path, meaning the same URL could serve different binaries over time. The binary is installed directly to /usr/bin/regressi and executed by users. While regressi.fr appears to be the official upstream site for the Regressi scientific software (a French educational tool), the URL is unversioned (no version string in the path), there is no GPG signature verification, and the sha512sums provided are oddly short (127 hex chars instead of the expected 128 for SHA-512), suggesting possible truncation or corruption in the PKGBUILD. The unversioned URL is a genuine supply-chain concern: if the host is compromised or the maintainer updates the binary without bumping pkgver, users could silently receive a different binary. This is a real medium-severity concern: an executed binary from what appears to be the official but small/personal vendor site, with no signature and a potentially malformed checksum.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source=(http://regressi.fr/zip/regressiM regressi.desktop)

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary (regressiM) directly from regressi.fr with no version in the URL path, meaning the same URL could serve different binaries over time. The binary is installed directly to /usr/bin/regressi and executed by users. While regressi.fr appears to be the official upstream site for the Regressi scientific software (a French educational tool), the URL is unversioned (no version string in the path), there is no GPG signature verification, and the sha512sums provided are oddly short (127 hex chars instead of the expected 128 for SHA-512), suggesting possible truncation or corruption in the PKGBUILD. The unversioned URL is a genuine supply-chain concern: if the host is compromised or the maintainer updates the binary without bumping pkgver, users could silently receive a different binary. This is a real medium-severity concern: an executed binary from what appears to be the official but small/personal vendor site, with no signature and a potentially malformed checksum.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Polis Minus <polisminus2247@tuta.io>
    
      2pkgname=regressi-bin
    
      3pkgver=1.8.0
    
      4pkgrel=2
    
      5pkgdesc="Regressi allows you to calculate combined quantities into a function of differential equational."
    
      6arch=("x86_64")
    
      7
    
      8url='http://regressi.fr'
    
      9makedepends=()
    
      10depends=()
    
      11license=('none')
    
      12sha512sums=(
    
      13  'bb8490c86a63580ab40dbac7e504d8f4819a738486db78048ed9f92b44a14cd3a4b892f8417d87c166361a5c9761536bc3c53c6591eea3e9d575a5a44f63fcc1' 
    
      14  'fc7d8ee6337917d7bf23bdec1157cf5bcf90cc90d1bb012374d2da83d519047167778484706a108466eef8c0136f1a4b612adc85b7cef163eec804c4a5cad19c'
    
      15)
    
      16
    
      17source=(http://regressi.fr/zip/regressiM regressi.desktop)
    
      18
    
      19package() {
    
      20  install -D regressi.desktop "$pkgdir/usr/share/applications/regressi.desktop"
    
      21  install -D regressiM "$pkgdir/usr/bin/regressi"
    
      22}
    
      23

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2