squawker-vpn-bin

LOW

maintainer ashintosh 0 votes scanned 2026-11-02 00:26:00.633185

View on AUR

Why flagged

The package downloads a prebuilt .deb from the official project domain tryhackme.com, which is plausibly the project's own infrastructure; the binary is unpacked and installed without further modification, and the checksums are verified, making this a standard bin package with low risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt .deb from the official project domain tryhackme.com, which is plausibly the project's own infrastructure; the binary is unpacked and installed without further modification, and the checksums are verified, making this a standard bin package with low risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 source_x86_64=("${pkgname}-x86_64-${pkgver}.deb"::https://squawker-vpn.vm.tryhackme.com/latest/squawker-vpn_${pkgver}_amd64.deb)

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Ashintosh <ash[at]ashinto[dot]sh>
    
      2
    
      3pkgname=squawker-vpn-bin
    
      4pkgver=1.0.0
    
      5pkgrel=4
    
      6pkgdesc='TryHackMe Squawker VPN Client'
    
      7arch=('x86_64' 'aarch64')
    
      8url='https://tryhackme.com'
    
      9license=('custom')
    
      10
    
      11options=('!strip')
    
      12depends=(
    
      13    'gtk3'
    
      14    'webkit2gtk-4.1'
    
      15    'libayatana-appindicator'
    
      16    'libappindicator'
    
      17)
    
      18
    
      19provides=('squawker-vpn')
    
      20conflicts=('squawker-vpn')
    
      21
    
      22source_x86_64=("${pkgname}-x86_64-${pkgver}.deb"::https://squawker-vpn.vm.tryhackme.com/latest/squawker-vpn_${pkgver}_amd64.deb)
    
      23sha256sums_x86_64=('38a00ceac379b2cbfbc87bd103d96ee8214fc3b5a7dc52210e28af13deab188c')
    
      24
    
      25source_aarch64=("${pkgname}-aarch64-${pkgver}.deb"::https://squawker-vpn.vm.tryhackme.com/latest/squawker-vpn_${pkgver}_arm64.deb)
    
      26sha256sums_aarch64=('32494cfae221503912f9222a447e49e93fe272c2269a3e7ad9af58016a1c21a3')
    
      27
    
      28install="${pkgname}.install"
    
      29
    
      30prepare() {
    
      31    cd "${srcdir}" || return 1
    
      32
    
      33    ar x "${pkgname}-${CARCH}-${pkgver}.deb" || return 1
    
      34
    
      35    if ! compgen -G "${srcdir}/data.tar.*" > /dev/null; then
    
      36        printf 'ERROR: no data.tar archive found in the Debian package\n' >&2
    
      37        return 1
    
      38    fi
    
      39}
    
      40
    
      41package() {
    
      42    local data_archive
    
      43
    
      44    data_archive=$(find "${srcdir}" -maxdepth 1 -type f -name 'data.tar.*' -print -quit)
    
      45
    
      46    if [[ -z "${data_archive}" ]]; then
    
      47        printf 'ERROR: no data.tar archive found in %s\n' "${srcdir}" >&2
    
      48        return 1
    
      49    fi
    
      50
    
      51    bsdtar -xf "${data_archive}" -C "${pkgdir}" || return 1
    
      52
    
      53    # Relocate Debian's systemd unit to Arch's /usr/lib layout
    
      54    if [[ -f "${pkgdir}/lib/systemd/system/squawker-vpn-helper.service" ]]; then
    
      55        install -Dm644 \
    
      56            "${pkgdir}/lib/systemd/system/squawker-vpn-helper.service" \
    
      57            "${pkgdir}/usr/lib/systemd/system/squawker-vpn-helper.service" \
    
      58            || return 1
    
      59
    
      60        rm -rf "${pkgdir}/lib" || return 1
    
      61    fi
    
      62
    
      63    # Install the upstream license in Arch's standard license directory
    
      64    if [[ -f "${pkgdir}/usr/lib/squawker-vpn/_up_/LICENSE.txt" ]]; then
    
      65        install -Dm644 \
    
      66        "${pkgdir}/usr/lib/squawker-vpn/_up_/LICENSE.txt" \
    
      67        "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.txt" \
    
      68        || return 1
    
      69    else
    
      70        printf 'ERROR: upstream LICENSE.txt was not found\n' >&2
    
      71        return 1
    
      72    fi
    
      73}
    
      74

Changes since previous scan

--- PKGBUILD @ 2026-10-31 00:07
+++ PKGBUILD @ 2026-11-02 00:26
@@ -2,7 +2,7 @@
 
 pkgname=squawker-vpn-bin
 pkgver=1.0.0
-pkgrel=2
+pkgrel=4
 pkgdesc='TryHackMe Squawker VPN Client'
 arch=('x86_64' 'aarch64')
 url='https://tryhackme.com'
@@ -19,38 +19,56 @@
 provides=('squawker-vpn')
 conflicts=('squawker-vpn')
 
-source_x86_64=("${pkgname}-${pkgver}.deb"::https://squawker-vpn.vm.tryhackme.com/latest/squawker-vpn_${pkgver}_amd64.deb)
+source_x86_64=("${pkgname}-x86_64-${pkgver}.deb"::https://squawker-vpn.vm.tryhackme.com/latest/squawker-vpn_${pkgver}_amd64.deb)
 sha256sums_x86_64=('38a00ceac379b2cbfbc87bd103d96ee8214fc3b5a7dc52210e28af13deab188c')
 
-source_aarch64=("${pkgname}-${pkgver}.deb"::https://squawker-vpn.vm.tryhackme.com/latest/squawker-vpn_${pkgver}_arm64.deb)
+source_aarch64=("${pkgname}-aarch64-${pkgver}.deb"::https://squawker-vpn.vm.tryhackme.com/latest/squawker-vpn_${pkgver}_arm64.deb)
 sha256sums_aarch64=('32494cfae221503912f9222a447e49e93fe272c2269a3e7ad9af58016a1c21a3')
 
 install="${pkgname}.install"
 
 prepare() {
-    cd "${srcdir}"
-    ar x "${pkgname}-${pkgver}.deb"
+    cd "${srcdir}" || return 1
 
-    if [[ ! -f 'data.tar.gz' ]]; then
-        error 'data.tar not found after extraction'
+    ar x "${pkgname}-${CARCH}-${pkgver}.deb" || return 1
+
+    if ! compgen -G "${srcdir}/data.tar.*" > /dev/null; then
+        printf 'ERROR: no data.tar archive found in the Debian package\n' >&2
         return 1
     fi
 }
 
 package() {
-    set -e
+    local data_archive
 
-    cd "${srcdir}"
-    bsdtar -xf 'data.tar.gz' -C "${pkgdir}"
+    data_archive=$(find "${srcdir}" -maxdepth 1 -type f -name 'data.tar.*' -print -quit)
 
-    if [[ -d "${pkgdir}/lib" ]]; then
-        install -d "${pkgdir}/usr"
-        mv "${pkgdir}/lib" "${pkgdir}/usr/lib"
+    if [[ -z "${data_archive}" ]]; then
+        printf 'ERROR: no data.tar archive found in %s\n' "${srcdir}" >&2
+        return 1
     fi
 
-    if [[ -d "${pkgdir}/lib/systemd" ]]; then
-        install -d "${pkgdir}/usr/lib/systemd"
-        cp -a "${pkgdir}/lib/systemd/." "${pkgdir}/usr/lib/systemd/"
-        rm -rf "${pkgdir}/lib/systemd"
+    bsdtar -xf "${data_archive}" -C "${pkgdir}" || return 1
+
+    # Relocate Debian's systemd unit to Arch's /usr/lib layout
+    if [[ -f "${pkgdir}/lib/systemd/system/squawker-vpn-helper.service" ]]; then
+        install -Dm644 \
+            "${pkgdir}/lib/systemd/system/squawker-vpn-helper.service" \
+            "${pkgdir}/usr/lib/systemd/system/squawker-vpn-helper.service" \
+            || return 1
+
+        rm -rf "${pkgdir}/lib" || return 1
+    fi
+
+    # Install the upstream license in Arch's standard license directory
+    if [[ -f "${pkgdir}/usr/lib/squawker-vpn/_up_/LICENSE.txt" ]]; then
+        install -Dm644 \
+        "${pkgdir}/usr/lib/squawker-vpn/_up_/LICENSE.txt" \
+        "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.txt" \
+        || return 1
+    else
+        printf 'ERROR: upstream LICENSE.txt was not found\n' >&2
+        return 1
     fi
 }
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-02 00:26:00	Low	2
2026-11-01 00:21:48	Low	2
2026-10-31 17:58:44	Medium	1
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 15:52:51	Medium	1
2026-10-29 11:52:15	Medium	1
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2