sonic-x11-session-bin

MEDIUM
maintainer sonicdesktop 0 votes scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

This PKGBUILD downloads a prebuilt binary package (.pkg.tar.zst) from x11libre.net, a personal/project host that is not an official Arch Linux mirror or well-known vendor CDN. The binary is then extracted and installed directly into the package directory. While a sha256sum is provided (offering some integrity protection against accidental corruption or simple MITM), the trust anchor is entirely the x11libre.net host — if that host is compromised or the maintainer swaps the file, users get arbitrary binaries executed on their systems. The URL is not reproducible from upstream source (github.com/Sonic-DE/plasma-workspace-sonic) and there is no way to verify the binary matches what would be built from that source. This is a classic supply-chain risk: prebuilt binary from an unofficial personal host with no independent build attestation. The sha256sum mitigates accidental substitution but not intentional replacement by the host owner. This warrants a MEDIUM rating.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:13 source=("https://x11libre.net/repo/arch_based/x86_64/sonicde/${_pkgname2}-${pkgver}-${pkgrel}-x86_64.pkg.tar.zst")
Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): This PKGBUILD downloads a prebuilt binary package (.pkg.tar.zst) from x11libre.net, a personal/project host that is not an official Arch Linux mirror or well-known vendor CDN. The binary is then extracted and installed directly into the package directory. While a sha256sum is provided (offering some integrity protection against accidental corruption or simple MITM), the trust anchor is entirely the x11libre.net host — if that host is compromised or the maintainer swaps the file, users get arbitrary binaries executed on their systems. The URL is not reproducible from upstream source (github.com/Sonic-DE/plasma-workspace-sonic) and there is no way to verify the binary matches what would be built from that source. This is a classic supply-chain risk: prebuilt binary from an unofficial personal host with no independent build attestation. The sha256sum mitigates accidental substitution but not intentional replacement by the host owner. This warrants a MEDIUM rating.

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: artist for XLibre <artist4xlibre@proton.me>
2
3_pkgname1=plasma-x11-session
4_pkgname2=sonic-x11-session
5pkgname="${_pkgname2}-bin"
6pkgver=6.6.4
7pkgrel=3.1
8pkgdesc="KDE Plasma X11 Session, light version with fixes and improvements"
9arch=(x86_64)
10url='https://github.com/Sonic-DE/plasma-workspace-sonic'
11license=('custom')
12options=(!strip)
13source=("https://x11libre.net/repo/arch_based/x86_64/sonicde/${_pkgname2}-${pkgver}-${pkgrel}-x86_64.pkg.tar.zst")
14noextract=("${_pkgname}-${pkgver}-${pkgrel}-x86_64.pkg.tar.zst")
15depends=(accountsservice
16 appstream-qt
17 dbus
18 fontconfig
19 freetype2
20 gcc-libs
21 glibc
22 icu
23 kactivitymanagerd
24 karchive
25 kauth
26 kbookmarks
27 kcmutils
28 kcolorscheme
29 kcompletion
30 kconfig
31 kconfigwidgets
32 kcoreaddons
33 kcrash
34 kde-cli-tools
35 kdeclarative
36 kded
37 kdbusaddons
38 kglobalaccel
39 kguiaddons
40 kholidays
41 ki18n
42 kiconthemes
43 kidletime
44 kio
45 kio-extras
46 kio-fuse
47 kirigami
48 kirigami-addons
49 kitemmodels
50 kjobwidgets
51 knewstuff
52 knighttime
53 knotifications
54 knotifyconfig
55 kpackage
56 kparts
57 kpipewire
58 krunner
59 kquickcharts
60 kscreenlocker
61 kservice
62 kstatusnotifieritem
63 ksvg
64 ksystemstats
65 ktexteditor
66 ktextwidgets
67 kuserfeedback
68 kwallet
69 kwayland
70 kwidgetsaddons
71 kwin
72 kwin-x11-sonic
73 kwindowsystem
74 kxmlgui
75 layer-shell-qt
76 libcanberra
77 libice
78 libkexiv2
79 libksysguard
80 libplasma
81 libqalculate
82 libsm
83 libx11
84 libxau
85 libxcb
86 libxcrypt
87 libxcursor
88 libxfixes
89 libxft
90 libxtst
91 milou
92 ocean-sound-theme
93 plasma-activities
94 plasma-activities-stats
95 plasma-workspace-sonic
96 plasma5support
97 prison
98 qt6-5compat
99 qt6-base
100 qt6-declarative
101 qt6-location
102 qt6-positioning
103 qt6-svg
104 qt6-tools # for qdbus
105 qt6-virtualkeyboard
106 sh
107 solid
108 systemd-libs
109 wayland
110 xcb-util
111 xcb-util-cursor
112 xcb-util-image
113 xorg-xmessage
114 xorg-xrdb
115 xorg-xwayland
116 zlib)
117provides=($_pkgname1 $_pkgname2 "${_pkgname1}-sonic")
118conflicts=($_pkgname1 $_pkgname2 "${_pkgname1}-sonic")
119replaces=("${_pkgname1}-sonic")
120
121sha256sums=('643a5b3e2fdef4d31b3deb4e6c1ab438480a504c80c9e62806a28e7cb3522dbe')
122
123package() {
124 tar -xf "${_pkgname2}-${pkgver}-${pkgrel}-x86_64.pkg.tar.zst" -C "${pkgdir}" usr
125}
126

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Medium 2
2026-09-16 00:03:17 Medium 2
2026-09-15 00:25:31 Medium 2
2026-09-14 00:27:57 Medium 2
2026-09-13 00:19:54 Medium 2
2026-09-12 00:25:17 Medium 2
2026-09-11 00:19:22 Medium 2
2026-09-10 00:22:44 Medium 2
2026-09-09 00:04:09 Medium 2
2026-09-08 00:18:08 Medium 2
2026-09-07 00:30:15 Medium 2
2026-09-06 00:17:06 Medium 2
2026-09-05 00:16:27 Medium 2
2026-09-04 00:03:13 Medium 2
2026-09-03 00:15:47 Medium 2
2026-09-02 00:02:31 Medium 2
2026-09-01 00:11:19 Medium 2
2026-08-31 00:19:57 Medium 2
2026-08-30 00:04:14 Medium 2
2026-08-29 00:29:17 Medium 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion