sonic-x11-session-bin

maintainer sonicdesktop · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary package (.pkg.tar.zst) from x11libre.net, a personal/project host that is not an official Arch Linux mirror or well-known vendor CDN. The binary is then extracted and installed directly into the package directory. While a sha256sum is provided (offering some integrity protection against accidental corruption or simple MITM), the trust anchor is entirely the x11libre.net host — if that host is compromised or the maintainer swaps the file, users get arbitrary binaries executed on their systems. The URL is not reproducible from upstream source (github.com/Sonic-DE/plasma-workspace-sonic) and there is no way to verify the binary matches what would be built from that source. This is a classic supply-chain risk: prebuilt binary from an unofficial personal host with no independent build attestation. The sha256sum mitigates accidental substitution but not intentional replacement by the host owner. This warrants a MEDIUM rating.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("https://x11libre.net/repo/arch_based/x86_64/sonicde/${_pkgname2}-${pkgver}-${pkgrel}-x86_64.pkg.tar.zst")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): This PKGBUILD downloads a prebuilt binary package (.pkg.tar.zst) from x11libre.net, a personal/project host that is not an official Arch Linux mirror or well-known vendor CDN. The binary is then extracted and installed directly into the package directory. While a sha256sum is provided (offering some integrity protection against accidental corruption or simple MITM), the trust anchor is entirely the x11libre.net host — if that host is compromised or the maintainer swaps the file, users get arbitrary binaries executed on their systems. The URL is not reproducible from upstream source (github.com/Sonic-DE/plasma-workspace-sonic) and there is no way to verify the binary matches what would be built from that source. This is a classic supply-chain risk: prebuilt binary from an unofficial personal host with no independent build attestation. The sha256sum mitigates accidental substitution but not intentional replacement by the host owner. This warrants a MEDIUM rating.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: artist for XLibre <artist4xlibre@proton.me>
    
      2
    
      3_pkgname1=plasma-x11-session
    
      4_pkgname2=sonic-x11-session
    
      5pkgname="${_pkgname2}-bin"
    
      6pkgver=6.6.4
    
      7pkgrel=3.1
    
      8pkgdesc="KDE Plasma X11 Session, light version with fixes and improvements"
    
      9arch=(x86_64)
    
      10url='https://github.com/Sonic-DE/plasma-workspace-sonic'
    
      11license=('custom')
    
      12options=(!strip)
    
      13source=("https://x11libre.net/repo/arch_based/x86_64/sonicde/${_pkgname2}-${pkgver}-${pkgrel}-x86_64.pkg.tar.zst")
    
      14noextract=("${_pkgname}-${pkgver}-${pkgrel}-x86_64.pkg.tar.zst")
    
      15depends=(accountsservice
    
       appstream-qt
    
       dbus
    
       fontconfig
    
       freetype2
    
       gcc-libs
    
       glibc
    
       icu
    
       kactivitymanagerd
    
       karchive
    
       kauth
    
       kbookmarks
    
       kcmutils
    
       kcolorscheme
    
       kcompletion
    
       kconfig
    
       kconfigwidgets
    
       kcoreaddons
    
       kcrash
    
       kde-cli-tools
    
       kdeclarative
    
       kded
    
       kdbusaddons
    
       kglobalaccel
    
       kguiaddons
    
       kholidays
    
       ki18n
    
       kiconthemes
    
       kidletime
    
       kio
    
       kio-extras
    
       kio-fuse
    
       kirigami
    
       kirigami-addons
    
       kitemmodels
    
       kjobwidgets
    
       knewstuff
    
       knighttime
    
       knotifications
    
       knotifyconfig
    
       kpackage
    
       kparts
    
       kpipewire
    
       krunner
    
       kquickcharts
    
       kscreenlocker
    
       kservice
    
       kstatusnotifieritem
    
       ksvg
    
       ksystemstats
    
       ktexteditor
    
       ktextwidgets
    
       kuserfeedback
    
       kwallet
    
       kwayland
    
       kwidgetsaddons
    
       kwin
    
       kwin-x11-sonic
    
       kwindowsystem
    
       kxmlgui
    
       layer-shell-qt
    
       libcanberra
    
       libice
    
       libkexiv2
    
       libksysguard
    
       libplasma
    
       libqalculate
    
       libsm
    
       libx11
    
       libxau
    
       libxcb
    
       libxcrypt
    
       libxcursor
    
       libxfixes
    
       libxft
    
       libxtst
    
       milou
    
       ocean-sound-theme
    
       plasma-activities
    
       plasma-activities-stats
    
       plasma-workspace-sonic
    
       plasma5support
    
       prison
    
       qt6-5compat
    
       qt6-base
    
       qt6-declarative
    
       qt6-location
    
       qt6-positioning
    
       qt6-svg
    
       qt6-tools # for qdbus
    
       qt6-virtualkeyboard
    
       sh
    
       solid
    
       systemd-libs
    
       wayland
    
       xcb-util
    
       xcb-util-cursor
    
       xcb-util-image
    
       xorg-xmessage
    
       xorg-xrdb
    
       xorg-xwayland
    
       zlib)
    
      117provides=($_pkgname1 $_pkgname2 "${_pkgname1}-sonic")
    
      118conflicts=($_pkgname1 $_pkgname2 "${_pkgname1}-sonic")
    
      119replaces=("${_pkgname1}-sonic")
    
      120
    
      121sha256sums=('643a5b3e2fdef4d31b3deb4e6c1ab438480a504c80c9e62806a28e7cb3522dbe')
    
      122
    
      123package() {
    
tar -xf "${_pkgname2}-${pkgver}-${pkgrel}-x86_64.pkg.tar.zst" -C "${pkgdir}" usr
    
      125}
    
      126

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2