telegreat-bin

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD installs a prebuilt binary (Telegreat/Telegreat) downloaded directly from telegre.at, which is an unofficial, third-party host rather than an official Telegram or well-known mirror. The binary is executed on the user's system. While sha256sums are provided (offering some integrity protection), the trust anchor is the telegre.at host itself — if that host is compromised or the maintainer of that site is malicious, users receive and execute a tampered binary. This is a classic supply-chain risk: unofficial prebuilt binary from a personal/project-specific host. The icons are pulled from a GitHub repo (Sea-n/tdesktop) which is also unofficial/fork territory but are pure data (PNG files). The overall pattern — unofficial fork binary distributed from the fork author's own domain — is a genuine medium-severity supply-chain concern, not a false positive.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:32 https://telegre.at/tlinux/tsetup.${pkgver}.tar.xz

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD installs a prebuilt binary (Telegreat/Telegreat) downloaded directly from telegre.at, which is an unofficial, third-party host rather than an official Telegram or well-known mirror. The binary is executed on the user's system. While sha256sums are provided (offering some integrity protection), the trust anchor is the telegre.at host itself — if that host is compromised or the maintainer of that site is malicious, users receive and execute a tampered binary. This is a classic supply-chain risk: unofficial prebuilt binary from a personal/project-specific host. The icons are pulled from a GitHub repo (Sea-n/tdesktop) which is also unofficial/fork territory but are pure data (PNG files). The overall pattern — unofficial fork binary distributed from the fork author's own domain — is a genuine medium-severity supply-chain concern, not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Felix Golatofski <contact@xdfr.de>
    
      2# Contributor: Yongmeng <yongmengkennyye@protonmail.com>
    
      3
    
      4pkgname=telegreat-bin
    
      5pkgver=1.9.8
    
      6pkgrel=1
    
      7pkgdesc="Unofficial Telegreat Messaging app - Static binaries"
    
      8arch=('x86_64')
    
      9url="https://telegre.at"
    
      10license=('GPL3')
    
      11depends=(
    
      12    desktop-file-utils
    
      13    glib2
    
      14    hicolor-icon-theme
    
      15    libdbus
    
      16    libx11
    
      17)
    
      18makedepends=(
    
      19    chrpath
    
      20)
    
      21optdepends=(
    
      22    'libappindicator-gtk2: to hide Telegram in the tray bar (GTK2-based desktop environment)'
    
      23    'libappindicator-gtk3: to hide Telegram in the tray bar (GTK3-based desktop environment)'
    
      24    'xdg-utils: for automatic opening of URLs, files and directories in proper applications'
    
      25)
    
      26conflicts=('telegreat-git')
    
      27provides=('telegreat-git')
    
      28source=(
    
      29	$pkgname.desktop
    
      30	tg.protocol
    
      31        https://raw.githubusercontent.com/Sea-n/tdesktop/v${pkgver}/Telegram/Resources/art/icon{16,32,48,64,128,256,512}.png
    
      32	https://telegre.at/tlinux/tsetup.${pkgver}.tar.xz
    
      33)
    
      34# Checksums
    
      35sha256sums=('5645e109f4eff2555306b5f866c6b0c0f1e7e2ac2569ba55e3f3bc73d46a5750'
    
      36            'cebf355fed94f457630557c729b037f0ae4e458b6dba80aae7e50da22c4af206'
    
      37            '84af451f2211262c6f277d36c8908682bf8f6ad67edb8f82a9c5b58eeb75c11d'
    
      38            '0768d3b7c04c7b742b52457862667bf9a054ab0dab35b18abc1732a8b4b301ea'
    
      39            '8265cc98f371f5a9bb24b4d0640476227bb0d6aa66404fc07ef1221b8bf8d1ed'
    
      40            '90959f3114feae624e98faaa71118fc9afdf6e3a0f18dcd1a33709815e5d5de4'
    
      41            '1f8553272fd701ac8b5dc1ee1b949fa806761da5500d8f39f1be75976ba65744'
    
      42            '3a30ea2e58dc4d4d351cf77efb711929a992ec17ee0e07f90de1fa20493a3ff2'
    
      43            '3ada582d7465a7f97a197f9d96c358049084ff4f032609de65c5ef93e48c1173'
    
      44            'bf482a098a9b81668ba45d426b45ddbf19b086743fab0b4aa7fdec32f6bbd986')
    
      45
    
      46package() {
    
      47
    
      48	cd "$srcdir/"
    
      49
    
      50	# Creating needed directories
    
      51	install -dm755 "$pkgdir/usr/bin"
    
      52	install -dm755 "$pkgdir/usr/share/pixmaps/"
    
      53	install -dm755 "$pkgdir/usr/share/applications/"
    
      54
    
      55	# Program
    
      56	install -Dm755 "$srcdir/Telegreat/Telegreat" "$pkgdir/usr/bin/telegreat"
    
      57
    
      58	# Remove RPATH informations
    
      59	chrpath --delete "$pkgdir/usr/bin/telegreat"
    
      60
    
      61	# Desktop launcher
    
      62	install -Dm644 "$srcdir/icon256.png" "$pkgdir/usr/share/pixmaps/telegreat.png"
    
      63	install -Dm644 "$srcdir/$pkgname.desktop" "$pkgdir/usr/share/applications/telegreat.desktop"
    
      64
    
      65	# KDE4 protocol file
    
      66	install -d "$pkgdir/usr/share/kde4/services"
    
      67	install -m644 "$srcdir/tg.protocol" "$pkgdir/usr/share/kde4/services/tg.protocol"
    
      68
    
      69	# Icons
    
      70	local icon_size icon_dir
    
      71	for icon_size in 16 32 48 64 128 256 512; do
    
      72		icon_dir="$pkgdir/usr/share/icons/hicolor/${icon_size}x${icon_size}/apps"
    
      73		install -d "$icon_dir"
    
      74		install -m644 "$srcdir/icon${icon_size}.png" "$icon_dir/telegreat.png"
    
      75	done
    
      76}
    
      77
    
      78

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2