sqlynx-bin

maintainer witt.9099 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary ZIP from a QCloud COS (Tencent Cloud Object Storage) bucket owned by 'maicong-software' rather than from the official sqlynx.com domain or a well-known distribution mirror. The bucket name 'maicong-software-1302946156' appears to be a personal/vendor-controlled bucket that is not the canonical upstream release host. While a sha256sum is provided (mitigating substitution risk at build time), the concern is that the bucket owner could replace the file at any time and update the PKGBUILD checksum, and there is no way to verify the binary's authenticity (no GPG signature). The package installs a prebuilt binary with a systemd service, giving it persistent execution capability. This is a classic medium-severity supply-chain concern: executed binary from an unofficial/personal host with no cryptographic provenance beyond a mutable checksum. Additionally, the package writes files into $HOME during the package() phase (using ${pkgdir}/${HOME}/), which is non-standard and potentially problematic packaging practice, but not a direct security issue. Overall this is a legitimate medium risk, not a false positive.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 "${pkgname%-bin}-${pkgver}.zip::https://maicong-software-1302946156.cos.ap-beijing.myqcloud.com/software/sqlynx_linux_no_jdk_${pkgver}.zip"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt binary ZIP from a QCloud COS (Tencent Cloud Object Storage) bucket owned by 'maicong-software' rather than from the official sqlynx.com domain or a well-known distribution mirror. The bucket name 'maicong-software-1302946156' appears to be a personal/vendor-controlled bucket that is not the canonical upstream release host. While a sha256sum is provided (mitigating substitution risk at build time), the concern is that the bucket owner could replace the file at any time and update the PKGBUILD checksum, and there is no way to verify the binary's authenticity (no GPG signature). The package installs a prebuilt binary with a systemd service, giving it persistent execution capability. This is a classic medium-severity supply-chain concern: executed binary from an unofficial/personal host with no cryptographic provenance beyond a mutable checksum. Additionally, the package writes files into $HOME during the package() phase (using ${pkgdir}/${HOME}/), which is non-standard and potentially problematic packaging practice, but not a direct security issue. Overall this is a legitimate medium risk, not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: witt <1989161762 at qq dot com>
    
      2pkgname=sqlynx-bin
    
      3pkgver=3.6.0
    
      4pkgrel=4
    
      5pkgdesc="桌面和 Web SQL 工具"
    
      6arch=(
    
      7    'x86_64'
    
      8)
    
      9url="https://www.sqlynx.com/"
    
      10license=('custom')
    
      11conflicts=('sqlynx' 'sqlynx-bin')
    
      12provides=('sqlynx' 'sqlynx-bin' 'sqlynx-nojdk' 'sqlynx-nojdk-bin')
    
      13depends=('java-runtime>=8')
    
      14options=(
    
      15    '!strip'
    
      16    '!debug'
    
      17)
    
      18install="${pkgname}.install";
    
      19source=(
    
      20    "${pkgname%-bin}-${pkgver}.zip::https://maicong-software-1302946156.cos.ap-beijing.myqcloud.com/software/sqlynx_linux_no_jdk_${pkgver}.zip"
    
      21    "sqlynx.service"
    
      22)
    
      23sha256sums=('e0a6d0ba7cfc19d0d5ab65660452c422a1ba6ccd8cebc3ddf38cdd89c8dadeae'
    
      24            '96edc4ea1996f5152f87ad9a31dc4f85f8c32a831cb55a428a7cc3fc1c287b49')
    
      25
    
      26package() {
    
      27    install -d "${pkgdir}/opt/"
    
      28    cp -r "${srcdir}/sqlynx_linux_${pkgver}" "${pkgdir}/opt/sqlynx"
    
      29
    
      30    # data db
    
      31    install -dm700 "${pkgdir}/${HOME}/"
    
      32    install -dm755 "${pkgdir}/${HOME}/.config/"
    
      33
    
      34    install -Dm644 "${srcdir}/sqlynx_linux_${pkgver}/data/sqlite.db" "${pkgdir}/${HOME}/.config/sqlynx/data/sqlite.db"
    
      35    install -Dm644 "${srcdir}/sqlynx_linux_${pkgver}/data/sqlite.db" "${pkgdir}/opt/sqlynx/data/init.db"
    
      36    ln -sf "${HOME}/.config/sqlynx/data/sqlite.db" "${pkgdir}/opt/sqlynx/data/sqlite.db"
    
      37
    
      38    # config
    
      39    install -Dm644 "${srcdir}/sqlynx_linux_${pkgver}/config/sqlynx.yaml" "${pkgdir}/${HOME}/.config/sqlynx/config/sqlynx.yaml"
    
      40    ln -sf "${HOME}/.config/sqlynx/config/sqlynx.yaml" "${pkgdir}/opt/sqlynx/config/sqlynx.yaml"
    
      41
    
      42    # # link
    
      43    # install -dm755 "${pkgdir}/usr/bin/"
    
      44    # ln -s "${pkgdir}/opt/sqlynx/sqlynx-ide.sh" "${pkgdir}/usr/bin/sqlynx"
    
      45
    
      46    install -Dm755 "${srcdir}/sqlynx.service" -t "${pkgdir}/usr/lib/systemd/system/"
    
      47}
    
      48

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2