rupost-desktop

maintainer TitaniumHocker · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary .deb package from rupost.ru, which is the official vendor website for RuPost (a Russian Thunderbird-based email client by LLC 'RuPost'). The source URL matches the official product page listed in the `url` field, so this is not an unofficial or personal host — it is the vendor's own distribution channel. However, the package installs a prebuilt closed-source binary blob (a full Thunderbird-derived email client) directly from a Russian commercial vendor's server without any source build. The sha256sum is pinned, which mitigates substitution attacks at download time, but the binary itself is opaque and could contain anything. This is a legitimate medium-risk concern: executed proprietary binary from a single vendor host with no reproducible build, not clearly malicious but a real supply-chain trust issue. The PKGBUILD also has a minor typo (`$pkname` instead of `$pkgname` in the mv command) but that is cosmetic. Overall this is a genuine medium: a prebuilt binary from a non-mainstream vendor host that users must trust entirely.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 "https://www.rupost.ru/desktop/download/linux/${pkgname}-${pkgver}.ru.linux-x86_64.deb"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt binary .deb package from rupost.ru, which is the official vendor website for RuPost (a Russian Thunderbird-based email client by LLC 'RuPost'). The source URL matches the official product page listed in the `url` field, so this is not an unofficial or personal host — it is the vendor's own distribution channel. However, the package installs a prebuilt closed-source binary blob (a full Thunderbird-derived email client) directly from a Russian commercial vendor's server without any source build. The sha256sum is pinned, which mitigates substitution attacks at download time, but the binary itself is opaque and could contain anything. This is a legitimate medium-risk concern: executed proprietary binary from a single vendor host with no reproducible build, not clearly malicious but a real supply-chain trust issue. The PKGBUILD also has a minor typo (`$pkname` instead of `$pkgname` in the mv command) but that is cosmetic. Overall this is a genuine medium: a prebuilt binary from a non-mainstream vendor host that users must trust entirely.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Ivan Fedorov <i@ifedorov.me>
    
      2
    
      3pkgname=rupost-desktop
    
      4pkgver=117.0.131
    
      5pkgrel=1
    
      6pkgdesc="RuPost Desktop - почтовый клиент, созданный на базе нового поколения Thunderbird (Supernova) компанией ООО 'РуПост'"
    
      7arch=("x86_64")
    
      8url="http://www.rupost.ru/desktop"
    
      9license=('custom')
    
      10depends=('dbus-glib' 'gtk3' 'libxt' 'nss' 'hunspell')
    
      11optdepends=('hyphen: Hyphenation'
    
      12            'libcanberra: Sound support')
    
      13provides=("$pkgname")
    
      14install=
    
      15source=(
    
      16    "https://www.rupost.ru/desktop/download/linux/${pkgname}-${pkgver}.ru.linux-x86_64.deb"
    
      17)
    
      18sha256sums=("505feb9dfe5557966b7c3fc0c4ae872255bc278f28722d42f4430df87c29ae4f")
    
      19
    
      20package() {
    
      21    tar -xC "$pkgdir" -f data.tar.xz
    
      22    # Move license to correct directory
    
      23    mkdir -p "$pkgdir"/usr/share/licenses
    
      24    mv "$pkgdir"/usr/share/doc/"$pkgname" "$pkgdir"/usr/share/licenses/"$pkname"
    
      25    rm -r "$pkgdir"/usr/share/doc
    
      26    # Fix dock icon.
    
      27    sed -i -e 's/RemotingName=rupost-desktop-default/RemotingName=rupost-desktop/' "$pkgdir"/usr/lib/rupost-desktop/application.ini
    
      28    sed -i -e \
    
      29        's/$MOZ_LIBDIR\/$MOZ_APP_NAME "$@"/$MOZ_LIBDIR\/$MOZ_APP_NAME -app \/usr\/lib\/rupost-desktop\/application.ini "$@"/' \
    
      30        "$pkgdir"/usr/bin/rupost-desktop
    
      31    sed -i -e \
    
      32        's/$MOZ_LIBDIR\/$EXE "$@"/$MOZ_LIBDIR\/$EXE -app \/usr\/lib\/rupost-desktop\/application.ini "$@"/' \
    
      33        "$pkgdir"/usr/bin/rupost-desktop
    
      34}
    
      35

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2