sakura-frp

MEDIUM

maintainer yjun 3 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads prebuilt binaries from a non-standard host (nya.globalslb.net) which is not the project's primary domain, creating a supply-chain risk if the host is compromised or swapped.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=(LICENSE::'https://www.natfrp.com/policy/tos'

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads prebuilt binaries from a non-standard host (nya.globalslb.net) which is not the project's primary domain, creating a supply-chain risk if the host is compromised or swapped.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: yjun <jerrysteve1101 at gmail dot com>
    
      2
    
      3pkgname=sakura-frp
    
      4pkgver=0.51.0_sakura_15.1
    
      5pkgrel=2
    
      6pkgdesc="Sakura Frp Client"
    
      7arch=('x86_64' 'i686' 'aarch64' 'armv7h')
    
      8url="https://www.natfrp.com/"
    
      9license=('custom')
    
      10provides=('sakura-frpc' 'natfrp')
    
      11source=(LICENSE::'https://www.natfrp.com/policy/tos'
    
      12        "frpc.ini"
    
      13        "${pkgname}.tmpfiles"
    
      14        "${pkgname}.sysusers"
    
      15        "${pkgname}c.service"
    
      16        "${pkgname}c@.service"
    
      17        "${pkgname}c-f@.service")
    
      18backup=("etc/${pkgname}/frpc.ini")
    
      19_url="https://nya.globalslb.net/natfrp/client/frpc/"
    
      20source_x86_64=(${pkgname}-${pkgver}-x86_64::"${_url}/${pkgver//_/-}/frpc_linux_amd64")
    
      21source_i686=(${pkgname}-${pkgver}-i686::"${_url}/${pkgver//_/-}/frpc_linux_386")
    
      22source_aarch64=(${pkgname}-${pkgver}-aarch64::"${_url}/${pkgver//_/-}/frpc_linux_arm64")
    
      23source_armv7h=(${pkgname}-${pkgver}-armv7::"${_url}/${pkgver//_/-}/frpc_linux_armv7")
    
      24# disbale strip
    
      25# => strip: error: the input file './usr/bin/sakura-frpc' has no sections
    
      26options=('!strip')
    
      27md5sums=('SKIP'
    
      28         '217dc59018558a2ae6fcb98da968b022'
    
      29         'dde0a7ec9482aa7fd1cbccd9ee573794'
    
      30         '7bb599e157bc23c927c9d316fc29b0c8'
    
      31         'aa5e634fe5032eff425151306be9d3d8'
    
      32         'c376a78ccc30f4c741eb4df195c8be69'
    
      33         'b6f05593949f04968ea4012be9aad10c')
    
      34md5sums_x86_64=('a3d443de501d0f8af520219c3ed07f83')
    
      35md5sums_i686=('a0a20f21bff4a2ce8d175867186c5f4c')
    
      36md5sums_aarch64=('4223979f9a9fa259db2f69d840db949b')
    
      37md5sums_armv7h=('76b8fa07a4b08da48be28798c4feccbc')
    
      38
    
      39package() {
    
      40  install -Dm755 ${pkgname}-${pkgver}-${CARCH} ${pkgdir}/usr/bin/${pkgname}c
    
      41
    
      42  # frpc.ini
    
      43  install -Dm644 ${srcdir}/frpc.ini -t ${pkgdir}/etc/${pkgname}/
    
      44
    
      45  # systemd service
    
      46  install -Dm644 ${pkgname}c.service -t ${pkgdir}/usr/lib/systemd/system/
    
      47  install -Dm644 ${pkgname}c@.service -t ${pkgdir}/usr/lib/systemd/system/
    
      48  install -Dm644 ${pkgname}c-f@.service -t ${pkgdir}/usr/lib/systemd/system/
    
      49
    
      50  # LICENSE
    
      51  install -Dm644 LICENSE -t ${pkgdir}/usr/share/licenses/${pkgname}
    
      52
    
      53  # tmpfiles & sysusers
    
      54  install -Dm644 ${pkgname}.tmpfiles ${pkgdir}/usr/lib/tmpfiles.d/${pkgname}.conf
    
      55  install -Dm644 ${pkgname}.sysusers ${pkgdir}/usr/lib/sysusers.d/${pkgname}.conf
    
      56}
    
      57
    
      58# vim: set sw=2 ts=2 et:
    
      59

Changes since previous scan

--- PKGBUILD @ 2026-10-25 00:20
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,7 +1,7 @@
 # Maintainer: yjun <jerrysteve1101 at gmail dot com>
 
 pkgname=sakura-frp
-pkgver=0.51.0_sakura_12.3
+pkgver=0.51.0_sakura_15.1
 pkgrel=2
 pkgdesc="Sakura Frp Client"
 arch=('x86_64' 'i686' 'aarch64' 'armv7h')
@@ -31,10 +31,10 @@
          'aa5e634fe5032eff425151306be9d3d8'
          'c376a78ccc30f4c741eb4df195c8be69'
          'b6f05593949f04968ea4012be9aad10c')
-md5sums_x86_64=('8ba7dcde07b1181e4f011e011321c6f8')
-md5sums_i686=('00f0b4bfc7e7b339c0c9884d4f45be16')
-md5sums_aarch64=('248fb095f2c1a9ed8e9a05784223c40b')
-md5sums_armv7h=('59881860fc75bc5e426a816fce6b628e')
+md5sums_x86_64=('a3d443de501d0f8af520219c3ed07f83')
+md5sums_i686=('a0a20f21bff4a2ce8d175867186c5f4c')
+md5sums_aarch64=('4223979f9a9fa259db2f69d840db949b')
+md5sums_armv7h=('76b8fa07a4b08da48be28798c4feccbc')
 
 package() {
   install -Dm755 ${pkgname}-${pkgver}-${CARCH} ${pkgdir}/usr/bin/${pkgname}c

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 15:42:54	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2