synergy2-bin

maintainer jaap · 23 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary .deb from binaries.symless.com, which is the official Symless vendor distribution host for Synergy binaries. This is a legitimate vendor host, not a personal or unofficial mirror. However, the package also pulls a systemd service file from a personal GitHub Gist (gist.githubusercontent.com/JAicewizard/...), which is a non-official, user-controlled source that gets installed as a systemd service unit — this is a real supply-chain concern since the gist owner can modify it at any time (though the sha512sum pins the specific revision). The sha512sum for the .deb appears to be 127 hex characters (odd length), which is malformed for SHA-512 (should be 128 hex chars), potentially meaning integrity verification would fail or be bypassed. The combination of a prebuilt binary from a vendor host plus a mutable gist-sourced systemd service file with a potentially malformed checksum constitutes a medium-severity concern rather than clean.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source_x86_64=("https://binaries.symless.com/v2.0.12/synergy_2.0.12.beta_b1705%2Be5daaeda_amd64.deb" "https://gist.githubusercontent.com/JAicewizard/a70388a3a7c52fef21299f961a652364/raw/95f597b0ea42321efa4a0f2395fc84b0fdaf8084/synergy.service")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary .deb from binaries.symless.com, which is the official Symless vendor distribution host for Synergy binaries. This is a legitimate vendor host, not a personal or unofficial mirror. However, the package also pulls a systemd service file from a personal GitHub Gist (gist.githubusercontent.com/JAicewizard/...), which is a non-official, user-controlled source that gets installed as a systemd service unit — this is a real supply-chain concern since the gist owner can modify it at any time (though the sha512sum pins the specific revision). The sha512sum for the .deb appears to be 127 hex characters (odd length), which is malformed for SHA-512 (should be 128 hex chars), potentially meaning integrity verification would fail or be bypassed. The combination of a prebuilt binary from a vendor host plus a mutable gist-sourced systemd service file with a potentially malformed checksum constitutes a medium-severity concern rather than clean.

PKGBUILD

1 offending line(s) highlighted

      1# Generated by debtap
    
      2# Maintainer: jaap
    
      3# Contributor: jaap
    
      4pkgname=synergy2-bin
    
      5pkgver=2.0.12.beta
    
      6pkgrel=1
    
      7pkgdesc="Keyboard and mouse sharing solution. Synergy allows you to share one mouse and keyboard between multiple computers. Work seamlessly across Windows, macOS and Linux."
    
      8arch=('x86_64')
    
      9url="https://symless.com/synergy"
    
      10license=('unknown')
    
      11groups=('')
    
      12depends=('gcc>=5.2' 'bash-completion>=1.18.' 'gcc-libs>=3.0' 'hicolor-icon-theme' 'openssl-1.0' 'libx11>=1.2.99.901' 'libxext' 'libxi>=1.2.99.4' 'libxtst' 'openssl-1.0>=1.0.0' 'qt5-base>=5.5.0' 'qt5-declarative>=5.5.0' 'qt5-quickcontrols>=5.5.0' 'qt5-svg>=5.5.0')
    
      13conflicts=('synergy' 'synergy2' 'synergy2-beta')
    
      14options=('!strip' '!emptydirs')
    
      15install=${pkgname}.install 
    
      16source_x86_64=("https://binaries.symless.com/v2.0.12/synergy_2.0.12.beta_b1705%2Be5daaeda_amd64.deb" "https://gist.githubusercontent.com/JAicewizard/a70388a3a7c52fef21299f961a652364/raw/95f597b0ea42321efa4a0f2395fc84b0fdaf8084/synergy.service")
    
      17sha512sums_x86_64=("fbe3d9da48d848bb4becc6235b963d3e1d3d2ad16c434dcfaa3d0cba272424f524970c569162d0b2e62cb06861169be522a57bda15db454e5963687756b160a2" "8527f4d1dbeead91d694221711a2f64f585c12657fd081f6e3f8c1ed751159d42fdacfac5234a5d039fb911d006acd9924b1413de3054ca05bba8321c094811a")
    
      18
    
      19package(){
    
      20	# Extract package data
    
      21	tar xf data.tar.xz -C "${pkgdir}"
    
      22	cat "synergy.service"
    
      23	mv "synergy.service" "${pkgdir}/lib/systemd/system/synergy.service"
    
      24	# Fix directories structure differencies
    
      25	cd "${pkgdir}"
    
      26
    
      27	install -D -m644 "${pkgdir}/usr/share/doc/synergy/copyright" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      28	mkdir -p usr/lib 2> /dev/null; cp -r lib/* usr/lib; rm -rf lib
    
      29	sed -i "s/{DISPLAY}/${DISPLAY}/g" "${pkgdir}/usr/lib/systemd/system/synergy.service"
    
      30	sed -i "s/{XAUTHORITY}/${XAUTHORITY//\//\\/}/g" "${pkgdir}/usr/lib/systemd/system/synergy.service"
    
      31	cat ${pkgdir}/usr/lib/systemd/system/synergy.service
    
      32	cd ..
    
      33}
    
      34

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2