sonic-workspace-bin

MEDIUM
maintainer sonicdesktop 0 votes scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

This PKGBUILD downloads a prebuilt binary package (plasma-workspace fork) from x11libre.net, which is a third-party/personal host rather than official KDE or distribution infrastructure. The package() function extracts and installs compiled binaries directly into the system. While a sha256sum is provided (offering some integrity protection against transit tampering), the trust anchor is entirely the x11libre.net host operator — if that host is compromised or malicious, arbitrary binaries get installed system-wide. The GitHub URL (Sonic-DE/sonic-workspace) is only referenced as a URL field and is not the actual source. This is a genuine supply-chain concern: prebuilt binaries replacing a core KDE component (plasma-workspace) from an unofficial third-party host, with no way to verify the build process or source correspondence. The sha256sum mitigates substitution attacks but not a malicious build from the host operator themselves.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:13 source=("https://x11libre.net/repo/arch_based/x86_64/sonicde/${_pkgname2}-${pkgver}-${pkgrel}-x86_64.pkg.tar.zst")
Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): This PKGBUILD downloads a prebuilt binary package (plasma-workspace fork) from x11libre.net, which is a third-party/personal host rather than official KDE or distribution infrastructure. The package() function extracts and installs compiled binaries directly into the system. While a sha256sum is provided (offering some integrity protection against transit tampering), the trust anchor is entirely the x11libre.net host operator — if that host is compromised or malicious, arbitrary binaries get installed system-wide. The GitHub URL (Sonic-DE/sonic-workspace) is only referenced as a URL field and is not the actual source. This is a genuine supply-chain concern: prebuilt binaries replacing a core KDE component (plasma-workspace) from an unofficial third-party host, with no way to verify the build process or source correspondence. The sha256sum mitigates substitution attacks but not a malicious build from the host operator themselves.

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: artist for XLibre <artist4xlibre@proton.me>
2
3_pkgname1=plasma-workspace
4_pkgname2=sonic-workspace
5pkgname="${_pkgname2}-bin"
6pkgver=6.6.4
7pkgrel=3.1
8pkgdesc="KDE Plasma Workspace, light version with fixes and improvements for X11 session"
9arch=(x86_64)
10url="https://github.com/Sonic-DE/${_pkgname2}"
11license=('custom')
12options=(!strip)
13source=("https://x11libre.net/repo/arch_based/x86_64/sonicde/${_pkgname2}-${pkgver}-${pkgrel}-x86_64.pkg.tar.zst")
14noextract=("${_pkgname}-${pkgver}-${pkgrel}-x86_64.pkg.tar.zst")
15depends=(accountsservice
16 appstream-qt
17 dbus
18 fontconfig
19 freetype2
20 gcc-libs
21 glibc
22 icu
23 kactivitymanagerd
24 karchive
25 kauth
26 kbookmarks
27 kcmutils
28 kcolorscheme
29 kcompletion
30 kconfig
31 kconfigwidgets
32 kcoreaddons
33 kcrash
34 kde-cli-tools
35 kdeclarative
36 kded
37 kdbusaddons
38 kglobalaccel
39 kguiaddons
40 kholidays
41 ki18n
42 kiconthemes
43 kidletime
44 kio
45 kio-extras
46 kio-fuse
47 kirigami
48 kirigami-addons
49 kitemmodels
50 kjobwidgets
51 knewstuff
52 knighttime
53 knotifications
54 knotifyconfig
55 kpackage
56 kparts
57 kpipewire
58 krunner
59 kquickcharts
60 kscreenlocker
61 kservice
62 kstatusnotifieritem
63 ksvg
64 ksystemstats
65 ktexteditor
66 ktextwidgets
67 kuserfeedback
68 kwallet
69 kwayland
70 kwidgetsaddons
71 kwindowsystem
72 kxmlgui
73 layer-shell-qt
74 libcanberra
75 libice
76 libkexiv2
77 libksysguard
78 libplasma
79 libqalculate
80 libsm
81 libx11
82 libxau
83 libxcb
84 libxcrypt
85 libxcursor
86 libxfixes
87 libxft
88 libxtst
89 milou
90 ocean-sound-theme
91 plasma-activities
92 plasma-activities-stats
93 plasma-integration
94 plasma-x11-session
95 plasma5support
96 prison
97 qt6-5compat
98 qt6-base
99 qt6-declarative
100 qt6-location
101 qt6-positioning
102 qt6-svg
103 qt6-tools # for qdbus
104 qt6-virtualkeyboard
105 sh
106 solid
107 sonic-win
108 systemd-libs
109 wayland
110 xcb-util
111 xcb-util-cursor
112 xcb-util-image
113 xorg-xmessage
114 xorg-xrdb
115 xorg-xwayland
116 zlib)
117provides=($_pkgname1 $_pkgname2 "${_pkgname1}-sonic-bin")
118conflicts=($_pkgname1 $_pkgname2 "${_pkgname1}-sonic-bin")
119replaces=("${_pkgname1}-sonic-bin")
120
121sha256sums=('e6fa67c852b72c60853e7ea43d78dc4a7a13dfbc9a84ed2a8780a86ea20d714b')
122
123package() {
124 tar -xf "${_pkgname2}-${pkgver}-${pkgrel}-x86_64.pkg.tar.zst" -C "${pkgdir}" usr
125}
126

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Medium 2
2026-09-16 00:03:17 Medium 2
2026-09-15 00:25:31 Medium 2
2026-09-14 00:27:57 Medium 2
2026-09-13 00:19:54 Medium 2
2026-09-12 00:25:17 Medium 2
2026-09-11 00:19:22 Medium 2
2026-09-10 00:22:44 Medium 2
2026-09-09 00:04:09 Medium 2
2026-09-08 00:18:08 Medium 2
2026-09-07 00:30:15 Medium 2
2026-09-06 00:17:06 Medium 2
2026-09-05 00:16:27 Medium 2
2026-09-04 00:03:13 Medium 2
2026-09-03 00:15:47 Medium 2
2026-09-02 00:02:31 Medium 2
2026-09-01 00:11:19 Medium 2
2026-08-31 00:19:57 Medium 2
2026-08-30 00:04:14 Medium 2
2026-08-29 00:29:17 Medium 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion