terminal-headers

maintainer Connor · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary package (.pkg.tar.zst) from a personal domain (concise.cc) owned by the maintainer, not from the project's official upstream release infrastructure (gitlab.com/a4to/terminal-headers). This is a genuine supply-chain concern: the maintainer controls both the signing key and the hosting, meaning a compromise of concise.cc or the key would allow silent substitution of executed code. The PGP signature and checksums provide some mitigation, but the trust anchor is entirely the maintainer's own key and server. The package() function installs files from opt/ and usr/ directories that would have been extracted from this prebuilt artifact, meaning arbitrary executables could be installed. This pattern — self-hosted prebuilt binary signed with a self-controlled key — is a real medium-severity supply-chain risk, not a false positive.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 "https://concise.cc/pkg/${pkgname}-${pkgver}-${pkgrel}-$arch.pkg.tar.zst"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt binary package (.pkg.tar.zst) from a personal domain (concise.cc) owned by the maintainer, not from the project's official upstream release infrastructure (gitlab.com/a4to/terminal-headers). This is a genuine supply-chain concern: the maintainer controls both the signing key and the hosting, meaning a compromise of concise.cc or the key would allow silent substitution of executed code. The PGP signature and checksums provide some mitigation, but the trust anchor is entirely the maintainer's own key and server. The package() function installs files from opt/ and usr/ directories that would have been extracted from this prebuilt artifact, meaning arbitrary executables could be installed. This pattern — self-hosted prebuilt binary signed with a self-controlled key — is a real medium-severity supply-chain risk, not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Connor Etherington <connor@concise.cc>
    
      2# ---
    
      3pkgname=terminal-headers
    
      4pkgver=1.4
    
      5pkgrel=1
    
      6pkgdesc='Color scripts providing a fun greeting when opening a terminal or reloading your shell'
    
      7install=terminal-headers.install
    
      8arch=(x86_64)
    
      9url="https://gitlab.com/a4to/${pkgname}"
    
      10license=('MIT')
    
      11depends=(python-lolcat figlet bc)
    
      12source=(
    
      13  "https://concise.cc/pkg/${pkgname}-${pkgver}-${pkgrel}-$arch.pkg.tar.zst"
    
      14  "https://concise.cc/pkg/${pkgname}-${pkgver}-${pkgrel}-$arch.pkg.tar.zst.sig"
    
      15  )
    
      16sha512sums=(
    
      17  'b63266fc5a9484fd66fccbcbd4528e5d5ff7326707b3e17bb24efec9b46b5bb0a934d9fcda8a874a61f136e5567a442878dd59f0e308c141d98457c513487918'
    
      18  'a291f1eb4cc0fd5d5d41c397efe1d3b00566abde7c33c1abb7395918ef04959e9ad304fb2aaf536931dd9b1b5beec881a498a9b671355882448df6bbe4b56ed6'
    
      19  )
    
      20md5sums=(
    
      21  'd63b5d52878937c49de123b9fe290166'
    
      22  '081caa1f04947942f72cff5ba2d67a4b'
    
      23  )
    
      24validpgpkeys=('81BACEEBC3EA26E127166E4A819BB92A9A48160E')
    
      25
    
      26package() {
    
      27  install -Dm755 opt/${pkgname}/* -t "${pkgdir}/opt/${pkgname}"
    
      28  install -Dm644 usr/share/licenses/${pkgname}/LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      29  install -Dm644 usr/share/terminal-headers/fonts/future.tlf "${pkgdir}/usr/share/terminal-headers/fonts/future.tlf"
    
      30}
    
      31

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2