teaspeak-client

maintainer mrtuxa · 3 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary .deb from clientapi.teaspeak.de, which is the official TeaSpeak client distribution endpoint (teaspeak.de is the project's own domain). The binary is a closed-source proprietary application installed directly into the system. The sha256sum for the .deb itself IS present and pinned (26e658...), which mitigates substitution risk at that specific version. The LICENSE file has SKIP for its checksum, which is sloppy but the license file is pure data with no execution. The main concern is that this is a prebuilt binary from a vendor-controlled but non-auditable host — standard for proprietary AUR packages but still a supply-chain trust issue. The chmod o-w hardening steps are reasonable. Overall this is a legitimate medium: executed proprietary binary from a non-standard host with a pinned checksum, not a clear attack.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("${pkgname}-${pkgver}-${pkgrel}.deb::https://clientapi.teaspeak.de/files/release/1.5.3-2/TeaClient-linux_x64.deb"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from clientapi.teaspeak.de, which is the official TeaSpeak client distribution endpoint (teaspeak.de is the project's own domain). The binary is a closed-source proprietary application installed directly into the system. The sha256sum for the .deb itself IS present and pinned (26e658...), which mitigates substitution risk at that specific version. The LICENSE file has SKIP for its checksum, which is sloppy but the license file is pure data with no execution. The main concern is that this is a prebuilt binary from a vendor-controlled but non-auditable host — standard for proprietary AUR packages but still a supply-chain trust issue. The chmod o-w hardening steps are reasonable. Overall this is a legitimate medium: executed proprietary binary from a non-standard host with a pinned checksum, not a clear attack.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Tobias Müller <mintuser17 at gmail dot com> (Package Maintainer)
    
      2# Contributor: Markus Hadenfeldt <support at teaspeak dot de> (Program Maintainer)
    
      3
    
      4pkgname=teaspeak-client
    
      5pkgver=1.5.3
    
      6pkgrel=2
    
      7pkgdesc="A free to use client software for voice and video communication"
    
      8arch=('x86_64')
    
      9url='https://teaspeak.de/gb'
    
      10license=("custom:${pkgname}")
    
      11depends=('libxss'
    
      12         'nss'
    
      13         'gtk3')
    
      14source=("${pkgname}-${pkgver}-${pkgrel}.deb::https://clientapi.teaspeak.de/files/release/1.5.3-2/TeaClient-linux_x64.deb"
    
      15        'LICENSE')
    
      16sha256sums=('26e658ccd7e868b7563646db886336dfd1c2bef19b17a7bc3a6038c3f36fdf2e'
    
      17            'SKIP')
    
      18
    
      19package() {
    
      20  tar xvf data.tar.xz -C "${pkgdir}/"
    
      21  install -Dm644 LICENSE -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      22  find "${pkgdir}/usr/lib/teaclient" -type f -exec chmod o-w {} +
    
      23  find "${pkgdir}/usr/lib/teaclient" -type d -exec chmod o-w {} +
    
      24}
    
      25

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2