secria-vpn-bin

maintainer Pahheb · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads prebuilt .deb binaries from a non-whitelisted host (secria.me) without a verifiable upstream source, posing a supply-chain risk if the host is compromised or malicious.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source_x86_64=("https://secria.me/download/linux/${pkgname%-bin}_${pkgver}_amd64.deb")

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads prebuilt .deb binaries from a non-whitelisted host (secria.me) without a verifiable upstream source, posing a supply-chain risk if the host is compromised or malicious.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Konstantin Rannev <konstantin d0t rannev @t secria d0t me>
    
      2
    
      3pkgname=secria-vpn-bin
    
      4pkgver=1.0.5
    
      5pkgrel=1
    
      6pkgdesc="Native client with WireGuard and the post-quantum preshared key"
    
      7arch=('x86_64' 'aarch64')
    
      8url="https://secria.me"
    
      9license=('LicenseRef-SecriaTerms')
    
      10depends=('wireguard-tools' 'nftables' 'iproute2' 'hicolor-icon-theme')
    
      11provides=("${pkgname%-bin}=$pkgver")
    
      12conflicts=("${pkgname%-bin}")
    
      13
    
      14source=("LICENSE")
    
      15sha256sums=('b082d2bb6f0da30ec8686931e15caa4e00dd2e642f4f033440680783465f5b14')
    
      16
    
      17source_x86_64=("https://secria.me/download/linux/${pkgname%-bin}_${pkgver}_amd64.deb")
    
      18sha256sums_x86_64=('e2756c5792f09a606d497f2aa32e4bce2d6c03701c089abcdf287b0f9040f9c7')
    
      19
    
      20source_aarch64=("https://secria.me/download/linux/${pkgname%-bin}_${pkgver}_arm64.deb")
    
      21sha256sums_aarch64=('5e713ef4f6b8edb4edd1ea26dbd279dd2a1b9fc38b4dcf9eae67f0121d6dbbac')
    
      22
    
      23package() {
    
      24    # RPMs are automatically extracted into $srcdir
    
      25    cd "$srcdir"
    
      26
    
      27    # Extract the data archive into the package root
    
      28    bsdtar -xf data.tar.xz -C "$pkgdir/"
    
      29    
    
      30    # Install the Terms of Service as the license
    
      31    install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      32}
    
      33

Changes since previous scan

--- PKGBUILD @ 2026-07-21 00:24
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,7 +1,7 @@
 # Maintainer: Konstantin Rannev <konstantin d0t rannev @t secria d0t me>
 
 pkgname=secria-vpn-bin
-pkgver=1.0.4
+pkgver=1.0.5
 pkgrel=1
 pkgdesc="Native client with WireGuard and the post-quantum preshared key"
 arch=('x86_64' 'aarch64')
@@ -14,18 +14,18 @@
 source=("LICENSE")
 sha256sums=('b082d2bb6f0da30ec8686931e15caa4e00dd2e642f4f033440680783465f5b14')
 
-source_x86_64=("https://secria.me/download/linux/${pkgname%-bin}-${pkgver}-1.$CARCH.rpm")
-sha256sums_x86_64=('582a1ef2b38c22c32f2b60d75951a59a2e787cb9e60a1b946b0e2345c55fdf68')
+source_x86_64=("https://secria.me/download/linux/${pkgname%-bin}_${pkgver}_amd64.deb")
+sha256sums_x86_64=('e2756c5792f09a606d497f2aa32e4bce2d6c03701c089abcdf287b0f9040f9c7')
 
-source_aarch64=("https://secria.me/download/linux/${pkgname%-bin}-${pkgver}-1.$CARCH.rpm")
-sha256sums_aarch64=('de4e4660829937f6184b981d2c4ff37f6f1d4747c24f55d89fb8e22ff90ec73f')
+source_aarch64=("https://secria.me/download/linux/${pkgname%-bin}_${pkgver}_arm64.deb")
+sha256sums_aarch64=('5e713ef4f6b8edb4edd1ea26dbd279dd2a1b9fc38b4dcf9eae67f0121d6dbbac')
 
 package() {
     # RPMs are automatically extracted into $srcdir
     cd "$srcdir"
 
-    # Move the entire usr tree to the package root
-    cp -rv usr "$pkgdir/"
+    # Extract the data archive into the package root
+    bsdtar -xf data.tar.xz -C "$pkgdir/"
     
     # Install the Terms of Service as the license
     install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 00:29:32	MEDIUM	3
2026-07-21 19:17:41	MEDIUM	3
2026-07-21 00:24:15	MEDIUM	3
2026-07-20 00:19:49	MEDIUM	3
2026-07-19 00:17:08	MEDIUM	3
2026-07-18 00:14:48	MEDIUM	3
2026-07-17 00:06:16	MEDIUM	3
2026-07-16 00:05:41	MEDIUM	3