sakura-frp

maintainer yjun · 3 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads prebuilt binaries from a non-standard host (nya.globalslb.net) which is not a widely recognized or official domain for the project, posing a supply-chain risk if the host is compromised or malicious.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=(LICENSE::'https://www.natfrp.com/policy/tos'

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads prebuilt binaries from a non-standard host (nya.globalslb.net) which is not a widely recognized or official domain for the project, posing a supply-chain risk if the host is compromised or malicious.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: yjun <jerrysteve1101 at gmail dot com>
    
      2
    
      3pkgname=sakura-frp
    
      4pkgver=0.51.0_sakura_12.3
    
      5pkgrel=2
    
      6pkgdesc="Sakura Frp Client"
    
      7arch=('x86_64' 'i686' 'aarch64' 'armv7h')
    
      8url="https://www.natfrp.com/"
    
      9license=('custom')
    
      10provides=('sakura-frpc' 'natfrp')
    
      11source=(LICENSE::'https://www.natfrp.com/policy/tos'
    
      12        "frpc.ini"
    
      13        "${pkgname}.tmpfiles"
    
      14        "${pkgname}.sysusers"
    
      15        "${pkgname}c.service"
    
      16        "${pkgname}c@.service"
    
      17        "${pkgname}c-f@.service")
    
      18backup=("etc/${pkgname}/frpc.ini")
    
      19_url="https://nya.globalslb.net/natfrp/client/frpc/"
    
      20source_x86_64=(${pkgname}-${pkgver}-x86_64::"${_url}/${pkgver//_/-}/frpc_linux_amd64")
    
      21source_i686=(${pkgname}-${pkgver}-i686::"${_url}/${pkgver//_/-}/frpc_linux_386")
    
      22source_aarch64=(${pkgname}-${pkgver}-aarch64::"${_url}/${pkgver//_/-}/frpc_linux_arm64")
    
      23source_armv7h=(${pkgname}-${pkgver}-armv7::"${_url}/${pkgver//_/-}/frpc_linux_armv7")
    
      24# disbale strip
    
      25# => strip: error: the input file './usr/bin/sakura-frpc' has no sections
    
      26options=('!strip')
    
      27md5sums=('SKIP'
    
      28         '217dc59018558a2ae6fcb98da968b022'
    
      29         'dde0a7ec9482aa7fd1cbccd9ee573794'
    
      30         '7bb599e157bc23c927c9d316fc29b0c8'
    
      31         'aa5e634fe5032eff425151306be9d3d8'
    
      32         'c376a78ccc30f4c741eb4df195c8be69'
    
      33         'b6f05593949f04968ea4012be9aad10c')
    
      34md5sums_x86_64=('8ba7dcde07b1181e4f011e011321c6f8')
    
      35md5sums_i686=('00f0b4bfc7e7b339c0c9884d4f45be16')
    
      36md5sums_aarch64=('248fb095f2c1a9ed8e9a05784223c40b')
    
      37md5sums_armv7h=('59881860fc75bc5e426a816fce6b628e')
    
      38
    
      39package() {
    
      40  install -Dm755 ${pkgname}-${pkgver}-${CARCH} ${pkgdir}/usr/bin/${pkgname}c
    
      41
    
      42  # frpc.ini
    
      43  install -Dm644 ${srcdir}/frpc.ini -t ${pkgdir}/etc/${pkgname}/
    
      44
    
      45  # systemd service
    
      46  install -Dm644 ${pkgname}c.service -t ${pkgdir}/usr/lib/systemd/system/
    
      47  install -Dm644 ${pkgname}c@.service -t ${pkgdir}/usr/lib/systemd/system/
    
      48  install -Dm644 ${pkgname}c-f@.service -t ${pkgdir}/usr/lib/systemd/system/
    
      49
    
      50  # LICENSE
    
      51  install -Dm644 LICENSE -t ${pkgdir}/usr/share/licenses/${pkgname}
    
      52
    
      53  # tmpfiles & sysusers
    
      54  install -Dm644 ${pkgname}.tmpfiles ${pkgdir}/usr/lib/tmpfiles.d/${pkgname}.conf
    
      55  install -Dm644 ${pkgname}.sysusers ${pkgdir}/usr/lib/sysusers.d/${pkgname}.conf
    
      56}
    
      57
    
      58# vim: set sw=2 ts=2 et:
    
      59

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2