synergy-dragon-alpha-bin

MEDIUM

maintainer Thadah 0 votes scanned 2026-11-02 20:06:34.285075

View on AUR

Why flagged

The package downloads a prebuilt binary .pkg.tar.zst at build time via a multi-step token-authenticated flow from symless.com (the official vendor), but with no checksums (source=() is empty), meaning the downloaded binary is completely unverified and could be silently swapped; however, the download infrastructure appears to be the vendor's own official domain rather than an unrelated third-party host, reducing but not eliminating the supply-chain risk.

Triggered rules

Medium External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:55 curl -fsSL -o "${srcdir}/${_pkgfile}" "https://symless.com/synergy/api/download/${_pkgfile}?token=${token}"

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): The package downloads a prebuilt binary .pkg.tar.zst at build time via a multi-step token-authenticated flow from symless.com (the official vendor), but with no checksums (source=() is empty), meaning the downloaded binary is completely unverified and could be silently swapped; however, the download infrastructure appears to be the vendor's own official domain rather than an unrelated third-party host, reducing but not eliminating the supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainers: thadah
    
      2pkgname="synergy-dragon-alpha-bin"
    
      3pkgver="0.7.0"
    
      4pkgrel="2"
    
      5pkgdesc="Share a single mouse and keyboard between multiple computers"
    
      6url="https://symless.com/synergy"
    
      7license=('custom:Proprietary')
    
      8arch=("x86_64")
    
      9source=()
    
      10sha256sums=()
    
      11conflicts=('synergy-dragon-alpha-bin')
    
      12depends=(
    
      13  'gdk-pixbuf2' 
    
      14  'glib2' 
    
      15  'glibc' 
    
      16  'gtk3'
    
      17  'libei'
    
      18  'libgcc'
    
      19  'libsoup3'
    
      20  'libstdc++'
    
      21  'libx11'
    
      22  'libxext'
    
      23  'libxi'
    
      24  'libxinerama'
    
      25  'libxkbcommon'
    
      26  'libxkbfile'
    
      27  'libxrandr'
    
      28  'libxtst'
    
      29  'openssl'
    
      30  'qt6-base>=6.12'
    
      31  'webkit2gtk-4.1'
    
      32)
    
      33options=("!strip")
    
      34install="synergy-dragon.install"
    
      35
    
      36# Anonymous download permalink provided by Symless
    
      37_permalink="https://email.mg.symless.com/c/eJxMjj1PwzAUAH-Ns1HZ7zn-GDw0gggJECBRqXSzXqw2JbEj2xTCr0d0Yry75QYHPgjTBCe0EdAqbXRzcgSDIkNGWC-EFzRwoFaRJm81tzo0owMOiisB3CJyvbHEEbHVEAhRKmSSz8dNWecplLKhNDeTO9W6FIZbBj2D_l-7Ugz5uDLo_TIy6If0Fafkhz9BFEph2Nf0ESLDW3l4PEO8ed6_bA_nRcLr2hHa9odqd6fu3_P-8-nte_fQiXbXZHcJMWWDRgKT3Gdf8xivQxcHvwEAAP__hk5M-A"
    
      38
    
      39_pkgfile="synergy-dragon-${pkgver}-linux-arch-x86_64.pkg.tar.zst"
    
      40
    
      41
    
      42prepare() {
    
      43  curl -fsSL -c "${srcdir}/cookies.txt" -o /dev/null "$_permalink"
    
      44  curl -fsSL -b "${srcdir}/cookies.txt" -o "${srcdir}/page.html" \
    
      45    "https://symless.com/synergy/download/package/synergy-dragon-alpha/arch-linux/${_pkgfile}"
    
      46
    
      47  local token
    
      48  token=$(grep -oP '(?<=\\"token\\":\\")[^\\"]+' "${srcdir}/page.html" | head -n1)
    
      49  if [[ -z "$token" ]]; then
    
      50    echo "Failed to get download token."
    
      51    return 1
    
      52  fi
    
      53
    
      54  echo "Downloading .pkg.tar.zst file with permalink token..."
    
      55  curl -fsSL -o "${srcdir}/${_pkgfile}" "https://symless.com/synergy/api/download/${_pkgfile}?token=${token}"
    
      56}
    
      57
    
      58package() {
    
      59  # Extract the .tar.zst file and repackage as is
    
      60  bsdtar -xpf "${srcdir}/${_pkgfile}" -C "${pkgdir}" --exclude='.PKGINFO' --exclude='.MTREE' --exclude='.BUILDINFO' --exclude='.INSTALL'
    
      61}
    
      62
    
      63

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-02 20:06:34	Medium	3
2026-11-02 20:03:06	Medium	3