teamdrive

maintainer thieume · 5 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary installer (.run file) from download.teamdrive.net, which is the official TeamDrive vendor download host. The sha256sum is pinned, which mitigates substitution attacks at rest. However, the source is a prebuilt, opaque binary installer executed directly during packaging (chmod +x + --mode unattended), meaning any compromise of that host or the binary itself would result in arbitrary code execution on the builder's system. This is a classic supply-chain medium: the host appears to be the legitimate vendor, but it is not a widely-audited distribution channel (e.g., not a distro mirror or well-known CDN), the binary is closed-source and unauditable, and the installer runs with unattended mode during package(). The checksum provides integrity but not authenticity. This pattern is standard for proprietary software AUR packages but carries inherent medium-level supply-chain risk.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 source_x86_64=("https://download.teamdrive.net/${pkgver}/TMDR/linux-x86_64/Install-TeamDrive-${pkgver}_TMDR.run")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt binary installer (.run file) from download.teamdrive.net, which is the official TeamDrive vendor download host. The sha256sum is pinned, which mitigates substitution attacks at rest. However, the source is a prebuilt, opaque binary installer executed directly during packaging (chmod +x + --mode unattended), meaning any compromise of that host or the binary itself would result in arbitrary code execution on the builder's system. This is a classic supply-chain medium: the host appears to be the legitimate vendor, but it is not a widely-audited distribution channel (e.g., not a distro mirror or well-known CDN), the binary is closed-source and unauditable, and the installer runs with unattended mode during package(). The checksum provides integrity but not authenticity. This pattern is standard for proprietary software AUR packages but carries inherent medium-level supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer : jaltek <jaltek(at)mailbox(dot)org>
    
      2# Maintainer : Matthieu Froment <thieume(at)mailoo(dot)org>
    
      3# Contributor : Xunhua Guo <xunhua(dot)guo(at)gmail(dot)com>
    
      4# Contributor : Robert Orzanna <orschiro(at)gmail(dot)com>
    
      5# Contributor : Cassfalg <ch(dot)assfalg(at)gmx(dot)de>
    
      6
    
      7pkgname=teamdrive
    
      8pkgver=5.2.2.3715
    
      9pkgrel=1
    
      10pkgdesc="Keeps data synchronised between various computers automatically."
    
      11arch=('x86_64')
    
      12url="http://www.teamdrive.com/"
    
      13license=('CUSTOM')
    
      14#depends=('')
    
      15
    
      16source=(teamdrive.desktop)
    
      17dir=$(echo $pkgver|cut -d. -f1,2,4)
    
      18
    
      19#source_x86_64=("https://download.teamdrive.net/${dir}/TMDR/linux-x86_64/Install-TeamDrive-${pkgver}_TMDR.run")
    
      20source_x86_64=("https://download.teamdrive.net/${pkgver}/TMDR/linux-x86_64/Install-TeamDrive-${pkgver}_TMDR.run")
    
      21
    
      22
    
      23sha256sums=('b81c4e2573b8478ce69a0ba66f5a493ecd73dbb8a94fe92fa33b1f5f14b8fb2c')
    
      24sha256sums_x86_64=('c7549cbaf1818f078988e0487854324c3efd21435915d4615dac1068680a8f1d')
    
      25
    
      26options=(!strip)
    
      27
    
      28build() {
    
      29    cd ${srcdir}
    
      30    chmod +x Install-TeamDrive-${pkgver}_TMDR.run
    
      31}
    
      32
    
      33package() {
    
      34    ./Install-TeamDrive-${pkgver}_TMDR.run --mode unattended --prefix ${pkgdir}/opt/${pkgname}
    
      35    install -Dm644 "${srcdir}/${pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      36    rm -f "${pkgdir}/opt/${pkgname}/Uninstall TeamDrive.desktop"
    
      37    rm -f "${pkgdir}/opt/${pkgname}/uninstall"
    
      38}
    
      39
    
      40

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2