resticity

maintainer adonis · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD uses 'go install github.com/wailsapp/wails/v2/cmd/wails@latest' during the prepare() phase, which fetches and executes an unpinned version of the wails build tool at build time. The '@latest' tag means no specific version or checksum is enforced, so any future compromise or change to the wails module on the Go module proxy could result in arbitrary code execution during the package build. The main source tarball is pinned with a sha256sum, but the wails tool itself is not. Wails is a legitimate, well-known framework (github.com/wailsapp/wails), so this is not clearly malicious, but the lack of version pinning for an executed build tool represents a genuine supply-chain concern. This is a real medium-severity issue, not a false positive.

Triggered rules

MEDIUM External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:31 go install github.com/wailsapp/wails/v2/cmd/wails@latest

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 75%): The PKGBUILD uses 'go install github.com/wailsapp/wails/v2/cmd/wails@latest' during the prepare() phase, which fetches and executes an unpinned version of the wails build tool at build time. The '@latest' tag means no specific version or checksum is enforced, so any future compromise or change to the wails module on the Go module proxy could result in arbitrary code execution during the package build. The main source tarball is pinned with a sha256sum, but the wails tool itself is not. Wails is a legitimate, well-known framework (github.com/wailsapp/wails), so this is not clearly malicious, but the lack of version pinning for an executed build tool represents a genuine supply-chain concern. This is a real medium-severity issue, not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Adis Durakovic <aur@mail.adisdurakovic.com>
    
      2pkgname=resticity
    
      3pkgver=1.0.46
    
      4pkgrel=1
    
      5epoch=
    
      6pkgdesc="A frontend for restic"
    
      7arch=("any")
    
      8url="https://github.com/ad-on-is/resticity"
    
      9license=('GPL3')
    
      10groups=()
    
      11depends=(go nodejs npm pnpm restic webkit2gtk rclone openssh)
    
      12makedepends=()
    
      13checkdepends=()
    
      14optdepends=()
    
      15provides=(resticity)
    
      16conflicts=()
    
      17replaces=()
    
      18backup=()
    
      19options=()
    
      20install=
    
      21changelog=
    
      22source=("$url/archive/refs/tags/$pkgver.tar.gz")
    
      23noextract=()
    
      24sha256sums=('4137863ca8d7cc25bf8d29a5458c930e83a95fd88777c3c2e4fe58c4820f845d')
    
      25validpgpkeys=()
    
      26
    
      27prepare() {
    
      28        cd "$pkgname-$pkgver"
    
      29        export GOPATH=/tmp/go
    
      30        export GOBIN=/tmp/go/bin
    
      31        go install github.com/wailsapp/wails/v2/cmd/wails@latest
    
      32}
    
      33
    
      34build() {
    
      35        cd "$pkgname-$pkgver"
    
      36        export GOPATH=/tmp/go
    
      37        export GOBIN=/tmp/go/bin
    
      38        export PATH=$GOBIN:$PATH
    
      39        ./build.sh desktop $pkgver
    
      40}
    
      41
    
      42check() {
    
      43        cd "$pkgname-$pkgver"
    
      44        
    
      45}
    
      46
    
      47package() {
    
      48        cd "$pkgname-$pkgver"
    
      49        install -Dm755 --no-target-directory "build/bin/resticity" "${pkgdir}/usr/bin/${pkgname}"
    
      50        install -Dm755 --no-target-directory "packaging/io.github.ad_on_is.Resticity.png" "${pkgdir}/usr/share/icons/hicolor/256x256/apps/io.github.ad_on_is.Resticity.png"
    
      51        install -Dm755 --no-target-directory "packaging/io.github.ad_on_is.Resticity.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      52}
    
      53

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2