sonic-win-bin

maintainer sonicdesktop · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary package (a compiled kwin-x11 fork) from x11libre.net, which is a third-party/community host rather than an official upstream release infrastructure (e.g., GitHub releases, official distro mirrors). The binary is then extracted and installed directly into the system. While a sha256sum is provided (providing some integrity check), the trust anchor is only as strong as the host itself — if x11libre.net is compromised or the maintainer of that host acts maliciously, arbitrary code could be executed with root privileges during installation. The package installs into /usr, meaning it replaces system kwin components. This is a genuine supply-chain concern: an executed/installed binary from a non-official personal/community host. The sha256 does not mitigate the risk of the host serving a malicious binary from the start. MEDIUM is the correct rating.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("https://x11libre.net/repo/arch_based/x86_64/sonicde/${_pkgname2}-${pkgver}-${pkgrel}-x86_64.pkg.tar.zst")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): This PKGBUILD downloads a prebuilt binary package (a compiled kwin-x11 fork) from x11libre.net, which is a third-party/community host rather than an official upstream release infrastructure (e.g., GitHub releases, official distro mirrors). The binary is then extracted and installed directly into the system. While a sha256sum is provided (providing some integrity check), the trust anchor is only as strong as the host itself — if x11libre.net is compromised or the maintainer of that host acts maliciously, arbitrary code could be executed with root privileges during installation. The package installs into /usr, meaning it replaces system kwin components. This is a genuine supply-chain concern: an executed/installed binary from a non-official personal/community host. The sha256 does not mitigate the risk of the host serving a malicious binary from the start. MEDIUM is the correct rating.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: artist for XLibre <artist4xlibre@proton.me>
    
      2
    
      3_pkgname1=kwin-x11
    
      4_pkgname2=sonic-win
    
      5pkgname="${_pkgname2}-bin"
    
      6pkgver=6.6.4.1
    
      7pkgrel=1.1
    
      8pkgdesc="kwin-x11 with ports from kwin-wayland, bug fixes, and maybe other improvements, for XLibre"
    
      9arch=(x86_64)
    
      10url="https://github.com/Sonic-DE/${_pkgname2}"
    
      11license=('GPL-2.0-or-later')
    
      12options=(!strip)
    
      13source=("https://x11libre.net/repo/arch_based/x86_64/sonicde/${_pkgname2}-${pkgver}-${pkgrel}-x86_64.pkg.tar.zst")
    
      14noextract=("${_pkgname1}-${pkgver}-${pkgrel}-x86_64.pkg.tar.zst")
    
      15depends=(aurorae
    
      16         breeze
    
      17         gcc-libs
    
      18         glibc
    
      19         plasma-activities
    
      20         kauth
    
      21         kcmutils
    
      22         kcolorscheme
    
      23         kconfig
    
      24         kcoreaddons
    
      25         kcrash
    
      26         kdeclarative
    
      27         kdecoration
    
      28         kglobalaccel
    
      29         kglobalacceld
    
      30         kguiaddons
    
      31         ki18n
    
      32         kirigami
    
      33         kitemmodels
    
      34         knewstuff
    
      35         knotifications
    
      36         kpackage
    
      37         kquickcharts
    
      38         kscreenlocker
    
      39         kservice
    
      40         ksvg
    
      41         kwidgetsaddons
    
      42         kwindowsystem
    
      43         kxmlgui
    
      44         lcms2
    
      45         libcanberra
    
      46         libdisplay-info
    
      47         libdrm
    
      48         systemd-libs
    
      49         libepoxy
    
      50         libplasma=$_pkgver
    
      51         libqaccessibilityclient-qt6
    
      52         libx11
    
      53         libxcb
    
      54         libxi
    
      55         libxkbcommon
    
      56         libxkbcommon-x11
    
      57         mesa
    
      58         plasma-x11-session-sonic
    
      59         qt6-5compat
    
      60         qt6-base
    
      61         qt6-declarative
    
      62         qt6-sensors
    
      63         qt6-svg
    
      64         qt6-tools
    
      65         qt6-wayland
    
      66         wayland
    
      67         xcb-util-cursor
    
      68         xcb-util-keysyms
    
      69         xcb-util-wm)
    
      70provides=($_pkgname kwin-x11 "${_pkgname1}-sonic-bin")
    
      71conflicts=($_pkgname kwin-x11 "${_pkgname1}-sonic-bin")
    
      72replaces=("${_pkgname1}-sonic-bin")
    
      73
    
      74sha256sums=('bd61b3ca48345d2177446271a7ed5856815fff4d466d2b27f2368484ff9a4889')
    
      75
    
      76package() {
    
      77  tar -xf "${_pkgname1}-${pkgver}-${pkgrel}-x86_64.pkg.tar.zst" -C "${pkgdir}" usr
    
      78}
    
      79

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2