snappify-bin

maintainer chocotan · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary .deb from 'release.snappi.fyi', which appears to be a release CDN/subdomain associated with snappify.com (the product's official site). The domain 'snappi.fyi' is plausibly an official short-domain used by the snappify team for distribution, similar to how many projects use alternate short domains for releases. However, it is not the primary domain and cannot be independently verified as officially controlled by snappify.com without external research. The package installs a prebuilt binary extracted directly from the .deb with no source build, which is the standard pattern for -bin AUR packages. The sha256sum is present, which mitigates substitution risk at the point of download but does not address whether the host itself is legitimate. The core concern is a prebuilt binary from a host that is not definitively the official vendor domain — this is a genuine medium supply-chain concern, not a false positive, though it is also not clearly malicious.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 "https://release.snappi.fyi/deb/x64/${_filename}"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary .deb from 'release.snappi.fyi', which appears to be a release CDN/subdomain associated with snappify.com (the product's official site). The domain 'snappi.fyi' is plausibly an official short-domain used by the snappify team for distribution, similar to how many projects use alternate short domains for releases. However, it is not the primary domain and cannot be independently verified as officially controlled by snappify.com without external research. The package installs a prebuilt binary extracted directly from the .deb with no source build, which is the standard pattern for -bin AUR packages. The sha256sum is present, which mitigates substitution risk at the point of download but does not address whether the host itself is legitimate. The core concern is a prebuilt binary from a host that is not definitively the official vendor domain — this is a genuine medium supply-chain concern, not a false positive, though it is also not clearly malicious.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  chocotan < loli at linux.com>
    
      2
    
      3pkgname='snappify-bin'
    
      4_pkgname='snappify-bin'
    
      5pkgver='0.0.5';
    
      6_major="${pkgver%%.*}"
    
      7pkgrel='1'
    
      8pkgdesc="snappify Slides enable developers to create impressive presentations and smoothly animated videos."
    
      9arch=('x86_64')
    
      10url='https://snappify.com/'
    
      11license=('custom')
    
      12provides=()
    
      13_filename=snappify_${pkgver}_amd64.deb
    
      14source=(
    
      15  "https://release.snappi.fyi/deb/x64/${_filename}"
    
      16)
    
      17
    
      18md5sums=('d123b423e81c0e5bf752a1e8b27dba9d')
    
      19sha256sums=('771b76f4c40fd0402b8dba389493f95f2c7e17e596ebc7289a57ac27b2b2a419')
    
      20
    
      21
    
      22package() {
    
      23    bsdtar -xf "$srcdir/data.tar.zst" -C ${pkgdir}/
    
      24}
    
      25

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2