sencha-cmd

maintainer orphaned · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary installer (SenchaCmd-*-linux-amd64.sh.zip) from trials.sencha.com, which is Sencha's own official trial/download host (Sencha is a Idera company). The sha512sum is present and pinned, which mitigates the risk of silent substitution. However, the installer is executed directly in prepare() via './SenchaCmd-*-linux-amd64.sh -q ...' — this is a self-extracting install4j binary that runs arbitrary code on the build machine. The host (trials.sencha.com) is the legitimate Sencha distribution endpoint, not a personal or unofficial mirror, so the supply-chain concern is lower than a truly unofficial host. Still, executing a prebuilt proprietary binary installer rather than building from source is a genuine medium-severity concern: if the binary were ever replaced at the source (or the checksum were updated to a malicious payload), it would execute arbitrary code. The sha512 checksum provides a meaningful integrity check, keeping this at medium rather than high.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("https://trials.sencha.com/cmd/${pkgver%.*}/SenchaCmd-$pkgver-linux-amd64.sh.zip"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary installer (SenchaCmd-*-linux-amd64.sh.zip) from trials.sencha.com, which is Sencha's own official trial/download host (Sencha is a Idera company). The sha512sum is present and pinned, which mitigates the risk of silent substitution. However, the installer is executed directly in prepare() via './SenchaCmd-*-linux-amd64.sh -q ...' — this is a self-extracting install4j binary that runs arbitrary code on the build machine. The host (trials.sencha.com) is the legitimate Sencha distribution endpoint, not a personal or unofficial mirror, so the supply-chain concern is lower than a truly unofficial host. Still, executing a prebuilt proprietary binary installer rather than building from source is a genuine medium-severity concern: if the binary were ever replaced at the source (or the checksum were updated to a malicious payload), it would execute arbitrary code. The sha512 checksum provides a meaningful integrity check, keeping this at medium rather than high.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: pallxk <aur@pallxk.com>
    
      2# Inspired by PKGBUILD of AUR package sencha-cmd-6
    
      3
    
      4pkgname=sencha-cmd
    
      5pkgver=7.7.0.36
    
      6pkgrel=1
    
      7pkgdesc='Sencha Cmd provides a collection of powerful, time-saving features that work together and in conjunction with the Sencha Ext JS and Sencha Touch frameworks'
    
      8url='https://www.sencha.com/products/extjs/cmd-download/'
    
      9arch=('x86_64')
    
      10license=('custom')
    
      11depends=('java-runtime>=8' 'java-runtime<=17' ruby fontconfig)
    
      12provides=(sencha-cmd-7)
    
      13conflicts=(sencha-cmd-5 sencha-cmd-6)
    
      14source=("https://trials.sencha.com/cmd/${pkgver%.*}/SenchaCmd-$pkgver-linux-amd64.sh.zip"
    
      15	"LICENSE")
    
      16sha512sums=(
    
      17	'c77f696f189b5fc2b9b608df6f99544fe31cb68cf3aef419c27dff706053902f9c9c4eb28f72bb1e70746faf9fb10b59d72cae680016bae5c0275bafdc122ab2'
    
      18	'fda827d9cae0859f37c4b588ae4e1ad3e8e5b6316d23f070691db566291d5a10d17c03934c90d17a9ed9a88a6b80be9e2f4c74fcb25112fe0a3fce3154495915'
    
      19)
    
      20options=(!strip)
    
      21
    
      22prepare() {
    
      23	rm -rf Sencha
    
      24	./SenchaCmd-$pkgver-linux-amd64.sh -q \
    
      25		-Dall=true \
    
      26		-V'addToPath$Integer'=1 \
    
      27		-dir "Sencha/Cmd/$pkgver"
    
      28
    
      29	sed -i -e "s|$srcdir|/opt|g" Sencha/Cmd/$pkgver/.install4j/*
    
      30}
    
      31
    
      32package() {
    
      33	install -d "$pkgdir/opt"
    
      34	cp -a Sencha "$pkgdir/opt"
    
      35
    
      36	install -dm777 "$pkgdir/var/cache/$pkgname/repo"
    
      37	ln -s /var/cache/$pkgname/repo "$pkgdir/opt/Sencha/Cmd/repo"
    
      38
    
      39	install -d "$pkgdir/usr/bin/"
    
      40	ln -s /opt/Sencha/Cmd/sencha "$pkgdir/usr/bin/sencha"
    
      41
    
      42	install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      43}
    
      44

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2