sencha-cmd

MEDIUM

maintainer orphaned 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The PKGBUILD downloads a prebuilt binary installer (SenchaCmd-*-linux-amd64.sh.zip) from trials.sencha.com, which is Sencha's own official trial/download host (Sencha is a Idera company). The sha512sum is present and pinned, which mitigates the risk of silent substitution. However, the installer is executed directly in prepare() via './SenchaCmd-*-linux-amd64.sh -q ...' — this is a self-extracting install4j binary that runs arbitrary code on the build machine. The host (trials.sencha.com) is the legitimate Sencha distribution endpoint, not a personal or unofficial mirror, so the supply-chain concern is lower than a truly unofficial host. Still, executing a prebuilt proprietary binary installer rather than building from source is a genuine medium-severity concern: if the binary were ever replaced at the source (or the checksum were updated to a malicious payload), it would execute arbitrary code. The sha512 checksum provides a meaningful integrity check, keeping this at medium rather than high.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("https://trials.sencha.com/cmd/${pkgver%.*}/SenchaCmd-$pkgver-linux-amd64.sh.zip"

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary installer (SenchaCmd-*-linux-amd64.sh.zip) from trials.sencha.com, which is Sencha's own official trial/download host (Sencha is a Idera company). The sha512sum is present and pinned, which mitigates the risk of silent substitution. However, the installer is executed directly in prepare() via './SenchaCmd-*-linux-amd64.sh -q ...' — this is a self-extracting install4j binary that runs arbitrary code on the build machine. The host (trials.sencha.com) is the legitimate Sencha distribution endpoint, not a personal or unofficial mirror, so the supply-chain concern is lower than a truly unofficial host. Still, executing a prebuilt proprietary binary installer rather than building from source is a genuine medium-severity concern: if the binary were ever replaced at the source (or the checksum were updated to a malicious payload), it would execute arbitrary code. The sha512 checksum provides a meaningful integrity check, keeping this at medium rather than high.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: pallxk <aur@pallxk.com>
    
      2# Inspired by PKGBUILD of AUR package sencha-cmd-6
    
      3
    
      4pkgname=sencha-cmd
    
      5pkgver=7.7.0.36
    
      6pkgrel=1
    
      7pkgdesc='Sencha Cmd provides a collection of powerful, time-saving features that work together and in conjunction with the Sencha Ext JS and Sencha Touch frameworks'
    
      8url='https://www.sencha.com/products/extjs/cmd-download/'
    
      9arch=('x86_64')
    
      10license=('custom')
    
      11depends=('java-runtime>=8' 'java-runtime<=17' ruby fontconfig)
    
      12provides=(sencha-cmd-7)
    
      13conflicts=(sencha-cmd-5 sencha-cmd-6)
    
      14source=("https://trials.sencha.com/cmd/${pkgver%.*}/SenchaCmd-$pkgver-linux-amd64.sh.zip"
    
      15	"LICENSE")
    
      16sha512sums=(
    
      17	'c77f696f189b5fc2b9b608df6f99544fe31cb68cf3aef419c27dff706053902f9c9c4eb28f72bb1e70746faf9fb10b59d72cae680016bae5c0275bafdc122ab2'
    
      18	'fda827d9cae0859f37c4b588ae4e1ad3e8e5b6316d23f070691db566291d5a10d17c03934c90d17a9ed9a88a6b80be9e2f4c74fcb25112fe0a3fce3154495915'
    
      19)
    
      20options=(!strip)
    
      21
    
      22prepare() {
    
      23	rm -rf Sencha
    
      24	./SenchaCmd-$pkgver-linux-amd64.sh -q \
    
      25		-Dall=true \
    
      26		-V'addToPath$Integer'=1 \
    
      27		-dir "Sencha/Cmd/$pkgver"
    
      28
    
      29	sed -i -e "s|$srcdir|/opt|g" Sencha/Cmd/$pkgver/.install4j/*
    
      30}
    
      31
    
      32package() {
    
      33	install -d "$pkgdir/opt"
    
      34	cp -a Sencha "$pkgdir/opt"
    
      35
    
      36	install -dm777 "$pkgdir/var/cache/$pkgname/repo"
    
      37	ln -s /var/cache/$pkgname/repo "$pkgdir/opt/Sencha/Cmd/repo"
    
      38
    
      39	install -d "$pkgdir/usr/bin/"
    
      40	ln -s /opt/Sencha/Cmd/sencha "$pkgdir/usr/bin/sencha"
    
      41
    
      42	install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      43}
    
      44

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2