sonic-workspace-bin

maintainer sonicdesktop · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary package (plasma-workspace fork) from x11libre.net, which is a third-party/personal host rather than official KDE or distribution infrastructure. The package() function extracts and installs compiled binaries directly into the system. While a sha256sum is provided (offering some integrity protection against transit tampering), the trust anchor is entirely the x11libre.net host operator — if that host is compromised or malicious, arbitrary binaries get installed system-wide. The GitHub URL (Sonic-DE/sonic-workspace) is only referenced as a URL field and is not the actual source. This is a genuine supply-chain concern: prebuilt binaries replacing a core KDE component (plasma-workspace) from an unofficial third-party host, with no way to verify the build process or source correspondence. The sha256sum mitigates substitution attacks but not a malicious build from the host operator themselves.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("https://x11libre.net/repo/arch_based/x86_64/sonicde/${_pkgname2}-${pkgver}-${pkgrel}-x86_64.pkg.tar.zst")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): This PKGBUILD downloads a prebuilt binary package (plasma-workspace fork) from x11libre.net, which is a third-party/personal host rather than official KDE or distribution infrastructure. The package() function extracts and installs compiled binaries directly into the system. While a sha256sum is provided (offering some integrity protection against transit tampering), the trust anchor is entirely the x11libre.net host operator — if that host is compromised or malicious, arbitrary binaries get installed system-wide. The GitHub URL (Sonic-DE/sonic-workspace) is only referenced as a URL field and is not the actual source. This is a genuine supply-chain concern: prebuilt binaries replacing a core KDE component (plasma-workspace) from an unofficial third-party host, with no way to verify the build process or source correspondence. The sha256sum mitigates substitution attacks but not a malicious build from the host operator themselves.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: artist for XLibre <artist4xlibre@proton.me>
    
      2
    
      3_pkgname1=plasma-workspace
    
      4_pkgname2=sonic-workspace
    
      5pkgname="${_pkgname2}-bin"
    
      6pkgver=6.6.4
    
      7pkgrel=3.1
    
      8pkgdesc="KDE Plasma Workspace, light version with fixes and improvements for X11 session"
    
      9arch=(x86_64)
    
      10url="https://github.com/Sonic-DE/${_pkgname2}"
    
      11license=('custom')
    
      12options=(!strip)
    
      13source=("https://x11libre.net/repo/arch_based/x86_64/sonicde/${_pkgname2}-${pkgver}-${pkgrel}-x86_64.pkg.tar.zst")
    
      14noextract=("${_pkgname}-${pkgver}-${pkgrel}-x86_64.pkg.tar.zst")
    
      15depends=(accountsservice
    
       appstream-qt
    
       dbus
    
       fontconfig
    
       freetype2
    
       gcc-libs
    
       glibc
    
       icu
    
       kactivitymanagerd
    
       karchive
    
       kauth
    
       kbookmarks
    
       kcmutils
    
       kcolorscheme
    
       kcompletion
    
       kconfig
    
       kconfigwidgets
    
       kcoreaddons
    
       kcrash
    
       kde-cli-tools
    
       kdeclarative
    
       kded
    
       kdbusaddons
    
       kglobalaccel
    
       kguiaddons
    
       kholidays
    
       ki18n
    
       kiconthemes
    
       kidletime
    
       kio
    
       kio-extras
    
       kio-fuse
    
       kirigami
    
       kirigami-addons
    
       kitemmodels
    
       kjobwidgets
    
       knewstuff
    
       knighttime
    
       knotifications
    
       knotifyconfig
    
       kpackage
    
       kparts
    
       kpipewire
    
       krunner
    
       kquickcharts
    
       kscreenlocker
    
       kservice
    
       kstatusnotifieritem
    
       ksvg
    
       ksystemstats
    
       ktexteditor
    
       ktextwidgets
    
       kuserfeedback
    
       kwallet
    
       kwayland
    
       kwidgetsaddons
    
       kwindowsystem
    
       kxmlgui
    
       layer-shell-qt
    
       libcanberra
    
       libice
    
       libkexiv2
    
       libksysguard
    
       libplasma
    
       libqalculate
    
       libsm
    
       libx11
    
       libxau
    
       libxcb
    
       libxcrypt
    
       libxcursor
    
       libxfixes
    
       libxft
    
       libxtst
    
       milou
    
       ocean-sound-theme
    
       plasma-activities
    
       plasma-activities-stats
    
       plasma-integration
    
       plasma-x11-session
    
       plasma5support
    
       prison
    
       qt6-5compat
    
       qt6-base
    
       qt6-declarative
    
       qt6-location
    
       qt6-positioning
    
       qt6-svg
    
       qt6-tools # for qdbus
    
       qt6-virtualkeyboard
    
       sh
    
       solid
    
       sonic-win
    
       systemd-libs
    
       wayland
    
       xcb-util
    
       xcb-util-cursor
    
       xcb-util-image
    
       xorg-xmessage
    
       xorg-xrdb
    
       xorg-xwayland
    
       zlib)
    
      117provides=($_pkgname1 $_pkgname2 "${_pkgname1}-sonic-bin")
    
      118conflicts=($_pkgname1 $_pkgname2 "${_pkgname1}-sonic-bin")
    
      119replaces=("${_pkgname1}-sonic-bin")
    
      120
    
      121sha256sums=('e6fa67c852b72c60853e7ea43d78dc4a7a13dfbc9a84ed2a8780a86ea20d714b')
    
      122
    
      123package() {
    
tar -xf "${_pkgname2}-${pkgver}-${pkgrel}-x86_64.pkg.tar.zst" -C "${pkgdir}" usr
    
      125}
    
      126

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2