sqlark-bin

maintainer zxp19821005 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads prebuilt RPM binaries containing a proprietary Electron application from download.sqlark.com, which is the official vendor download domain (matching the project URL sqlark.com). SHA256 checksums are provided for both architectures. The binary is installed and executed directly on the user's system. The concern is standard for -bin packages: the user must trust the vendor's download infrastructure, and the host is not a well-known, widely-audited distribution channel (like GitHub releases or a major Linux distro mirror). However, this is the official vendor domain, checksums are pinned, and the pattern (vendor RPM repackaged for Arch) is common in AUR -bin packages. The electron version verification helper is a nice safety check. This is a legitimate medium-risk supply-chain concern (executed proprietary binary from a vendor host) but not an active attack or clearly malicious pattern.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:21 source_aarch64=("${pkgname%-bin}-${pkgver}-aarch64.rpm::https://download.sqlark.com/fullPackage/Linux/408830/${_pkgname}_V${pkgver}_linux_arm64.rpm")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads prebuilt RPM binaries containing a proprietary Electron application from download.sqlark.com, which is the official vendor download domain (matching the project URL sqlark.com). SHA256 checksums are provided for both architectures. The binary is installed and executed directly on the user's system. The concern is standard for -bin packages: the user must trust the vendor's download infrastructure, and the host is not a well-known, widely-audited distribution channel (like GitHub releases or a major Linux distro mirror). However, this is the official vendor domain, checksums are pinned, and the pattern (vendor RPM repackaged for Arch) is common in AUR -bin packages. The electron version verification helper is a nice safety check. This is a legitimate medium-risk supply-chain concern (executed proprietary binary from a vendor host) but not an active attack or clearly malicious pattern.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2# Contributor: Bruce Zhang
    
      3pkgname=sqlark-bin
    
      4_pkgname=SQLark
    
      5pkgver=3.10
    
      6_electronversion=32
    
      7pkgrel=1
    
      8pkgdesc="SQLark is a powerful SQL query tool that provides a user-friendly interface for database management and analysis."
    
      9arch=(
    
      10	'aarch64'
    
      11	'x86_64'
    
      12)
    
      13url="https://www.sqlark.com/"
    
      14license=('LicenseRef-scancode-commercial-license')
    
      15conflicts=("${pkgname%-bin}")
    
      16provides=("${pkgname%-bin}=${pkgver}")
    
      17depends=(
    
      18    "electron${_electronversion}"
    
      19	'python'
    
      20)
    
      21source_aarch64=("${pkgname%-bin}-${pkgver}-aarch64.rpm::https://download.sqlark.com/fullPackage/Linux/408830/${_pkgname}_V${pkgver}_linux_arm64.rpm")
    
      22source_x86_64=("${pkgname%-bin}-${pkgver}-x86_64.rpm::https://download.sqlark.com/fullPackage/Linux/408830/${_pkgname}_V${pkgver}_linux_x86_64.rpm")
    
      23sha256sums_aarch64=('380c94126d46d35e2f3b520937a1400bfad83ba9b04df2dc3d2687977ba9ad72')
    
      24sha256sums_x86_64=('c16a28044fd56e2d0576ae31a37e16499c93217d5f15969de59961891ba45b84')
    
      25_check_electron_version() {
    
      26    echo "Verifying Electron version..."
    
      27    local _app_dir=$(find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1)
    
      28    local _main_exe=""
    
      29    if [[ -n "${_app_dir}" ]]; then
    
      30        _main_exe=$(find "${_app_dir}" -maxdepth 1 -type f -executable -printf '%s %p\n' | sort -nr | head -n 1 | cut -d' ' -f2-)
    
      31    fi
    
      32    if [[ -n "${_main_exe}" ]]; then
    
      33        local _elec_ver=$(strings "${_main_exe}" | grep '^Chrome/[0-9.]* Electron/[0-9]' | cut -d'/' -f3 | cut -d'.' -f1 | head -n 1)
    
      34        if [[ -n "${_elec_ver}" ]]; then
    
      35            if [[ "${_elec_ver}" != "${_electronversion}" ]]; then
    
      36                echo -e "\033[1;31mWarning: Electron version mismatch! Detected: ${_elec_ver}, Expected: ${_electronversion}\033[0m"
    
      37            else
    
      38                echo -e "Electron version verified: \033[1;31m${_elec_ver}\033[0m"
    
      39            fi
    
      40        fi
    
      41    else
    
      42        echo -e "\033[1;33mNote: Could not find Electron binary for version verification.\033[0m"
    
      43    fi
    
      44}
    
      45prepare() {
    
      46	_check_electron_version
    
      47	sed -i "s/Exec=\/opt\/${pkgname%-bin}\///g" "${srcdir}/usr/share/applications/${pkgname%-bin}.desktop"
    
      48	_file_list=(chrome_100_percent.pak chrome_200_percent.pak chrome-sandbox icudtl.dat libEGL.so libffmpeg.so \
    
      49		libGLESv2.so libvk_swiftshader.so libvulkan.so.1 resources.pak vk_swiftshader_icd.json)
    
      50	for _files in "${_file_list[@]}";do
    
      51		ln -sf "/usr/lib/electron${_electronversion}/${_files}" "${srcdir}/opt/${pkgname%-bin}/${_files}"
    
      52	done
    
      53}
    
      54package() {
    
      55	install -Dm755 -d "${pkgdir}/usr/"{bin,lib/"${pkgname%-bin}"}
    
      56	cp -Pr --no-preserve=ownership "${srcdir}/opt/${pkgname%-bin}"/* "${pkgdir}/usr/lib/${pkgname%-bin}"
    
      57	ln -sf "/usr/lib/${pkgname%-bin}/${pkgname%-bin}" "${pkgdir}/usr/bin/${pkgname%-bin}"
    
      58	install -Dm644 "${srcdir}/usr/share/applications/${pkgname%-bin}.desktop" -t "${pkgdir}/usr/share/applications"
    
      59	find "${srcdir}" -type f \( -name "*.png" -o -name "*.svg" \) -path "*share/icons/*" | while read -r _i; do
    
      60        _extension="${_i##*.}"
    
      61        _icon_path="${_i#*share/icons/}"
    
      62        _target_dir="/usr/share/icons/$(dirname "${_icon_path}")"
    
      63        install -Dm644 "${_i}" "${pkgdir}${_target_dir}/${pkgname%-bin}.${_extension}"
    
      64    done
    
      65}
    
      66

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2