spark-store

maintainer Anysets · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads prebuilt .deb binaries from a non-whitelisted host (gitee.com), which are then extracted and installed; this constitutes an unverifiable supply-chain risk as the binaries are not built from source and could contain malicious code.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:32 source_x86_64=("https://gitee.com/spark-store-project/spark-store/releases/download/${pkgver}/spark-store_${pkgver}_amd64.deb")

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads prebuilt .deb binaries from a non-whitelisted host (gitee.com), which are then extracted and installed; this constitutes an unverifiable supply-chain risk as the binaries are not built from source and could contain malicious code.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Anysets <anysets@qq.com>
    
      2pkgname=spark-store
    
      3pkgver=5.2.1.0
    
      4pkgrel=1
    
      5pkgdesc="A community powered app store."
    
      6arch=('x86_64' 'aarch64')
    
      7url="https://www.spark-app.store/"
    
      8license=('GPL3')
    
      9
    
      10depends=(
    
      11    'nss'
    
      12    'libxss'
    
      13    'libxtst'
    
      14    'at-spi2-core'
    
      15    'desktop-file-utils'
    
      16    'libsecret'
    
      17    'xdg-utils'
    
      18    'lsb-release'
    
      19    'shared-mime-info'
    
      20    'libnotify'
    
      21    'util-linux'
    
      22    'polkit'
    
      23    'aria2'
    
      24    'zenity'
    
      25    'amber-package-manager>=1.2.2'
    
      26    'flatpak'
    
      27    'qt5-base'
    
      28    'gtk3'
    
      29)
    
      30install=spark-store.install
    
      31options=(!strip !debug)
    
      32source_x86_64=("https://gitee.com/spark-store-project/spark-store/releases/download/${pkgver}/spark-store_${pkgver}_amd64.deb")
    
      33source_aarch64=("https://gitee.com/spark-store-project/spark-store/releases/download/${pkgver}/spark-store_${pkgver}_arm64.deb")
    
      34sha256sums_x86_64=('b0715c9de9d73824bd1f6eff0056a9861004a3be4d66bbe3225cc4d83c169ee8')
    
      35sha256sums_aarch64=('eb84841f2df584a597b6d1befc640b60ffe01eecbce1ea245a41ff64116b4709')
    
      36package() {
    
      37    bsdtar -xf data.tar.xz -C "${pkgdir}/"
    
      38    rm -rf "${pkgdir}/lib"
    
      39    rm -rf "${pkgdir}/tmp"
    
      40    # sed -i '2i\exit 0' "${pkgdir}/opt/durapps/spark-store/bin/aptss" || true
    
      41
    
      42    # spark-store postinst
    
      43    install -d "$pkgdir/usr/bin"
    
      44    install -d "$pkgdir/usr/share/polkit-1/actions"
    
      45    # ln -sf $pkgdir/opt/durapps/spark-store/bin/ssinstall "$pkgdir/usr/bin/ssinstall"
    
      46    # ln -sf $pkgdir/opt/durapps/spark-store/bin/ssaudit "$pkgdir/usr/bin/ssaudit"
    
      47    ln -sf /opt/durapps/spark-store/bin/spark-dstore-patch "$pkgdir/usr/bin/spark-dstore-patch"
    
      48    ln -sf /opt/durapps/spark-store/bin/spark-store "$pkgdir/usr/bin/spark-store"
    
      49    # ln -sf /opt/durapps/spark-store/bin/aptss "$pkgdir/usr/bin/aptss"
    
      50
    
      51
    
      52    # polkit policy
    
      53    install -Dm644 \
    
      54        "$pkgdir/opt/spark-store/extras/store.spark-app.spark-store.policy" \
    
      55        "$pkgdir/usr/share/polkit-1/actions/store.spark-app.spark-store.policy"
    
      56}
    
      57

Changes since previous scan

--- PKGBUILD @ 2026-07-18 00:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,6 +1,6 @@
 # Maintainer: Anysets <anysets@qq.com>
 pkgname=spark-store
-pkgver=5.1.1
+pkgver=5.2.1.0
 pkgrel=1
 pkgdesc="A community powered app store."
 arch=('x86_64' 'aarch64')
@@ -31,10 +31,12 @@
 options=(!strip !debug)
 source_x86_64=("https://gitee.com/spark-store-project/spark-store/releases/download/${pkgver}/spark-store_${pkgver}_amd64.deb")
 source_aarch64=("https://gitee.com/spark-store-project/spark-store/releases/download/${pkgver}/spark-store_${pkgver}_arm64.deb")
-sha256sums_x86_64=('02ead5c3def74ac376959da9aeeb9f98925ea70beac36165d26d460349aa468b')
-sha256sums_aarch64=('92bb42fb2d8906d549181d81ec952f676f491febbb98dc20e17072c7d9bfbfd8')
+sha256sums_x86_64=('b0715c9de9d73824bd1f6eff0056a9861004a3be4d66bbe3225cc4d83c169ee8')
+sha256sums_aarch64=('eb84841f2df584a597b6d1befc640b60ffe01eecbce1ea245a41ff64116b4709')
 package() {
     bsdtar -xf data.tar.xz -C "${pkgdir}/"
+    rm -rf "${pkgdir}/lib"
+    rm -rf "${pkgdir}/tmp"
     # sed -i '2i\exit 0' "${pkgdir}/opt/durapps/spark-store/bin/aptss" || true
 
     # spark-store postinst

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 15:58:03	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2