termius

maintainer tbk · 37 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt .snap binary from a non-standard, non-whitelisted host (api.snapcraft.io) which is not the project's direct release infrastructure, creating a supply-chain risk if the source were compromised.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 "$pkgname-$pkgver.snap::https://api.snapcraft.io/api/v1/snaps/download/WkTBXwoX81rBe3s3OTt3EiiLKBx2QhuS_265.snap"

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .snap binary from a non-standard, non-whitelisted host (api.snapcraft.io) which is not the project's direct release infrastructure, creating a supply-chain risk if the source were compromised.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: TBK <aur at jjtc dot eu>
    
      2# Contributor: TBK <aur at jjtc dot eu>
    
      3
    
      4pkgname=termius
    
      5pkgver=9.41.1
    
      6pkgrel=1
    
      7pkgdesc="Desktop SSH Client"
    
      8url="https://www.termius.com/"
    
      9arch=('x86_64')
    
      10license=('custom')
    
      11depends=('alsa-lib' 'at-spi2-core' 'dbus' 'e2fsprogs' 'expat' 'gtk3' 'keyutils' 'libbsd' 'libnotify' 'libsecret' 'libxss' 'libxtst' 'nss' 'util-linux-libs' 'xdg-utils')
    
      12optdepends=('libappindicator-gtk3')
    
      13makedepends=('squashfs-tools')
    
      14# Prebuilt binaries without debug symbols; stripping only breaks them
    
      15options=('!strip' '!debug')
    
      16# Get latest version + link from https://snapcraft.io/termius-app || snap info termius-app || run the following
    
      17# curl -H 'X-Ubuntu-Series: 16' https://api.snapcraft.io/api/v1/snaps/details/termius-app | jq '.download_url' -r
    
      18# curl -H 'X-Ubuntu-Series: 16' https://api.snapcraft.io/api/v1/snaps/details/termius-app | jq '.version' -r
    
      19source=(
    
      20    "$pkgname-$pkgver.snap::https://api.snapcraft.io/api/v1/snaps/download/WkTBXwoX81rBe3s3OTt3EiiLKBx2QhuS_265.snap"
    
      21    "termius.desktop"
    
      22    "tos.html"
    
      23)
    
      24sha512sums=('7ea3f2b6512d8488536dd08ec8ca04ecab0972987c6ae52b47c5aaeaf8647d0beb6a18937767a31a2e8cc6df7ca19e190db430539c6fdc1946d3be4c7b4b766c'
    
      25            'f1ce576d42a624842c9d08807c11580421b708b4bd7fac3aa9874769735df87566012e8fc0f993b08618f31d2f38588cd83d8572a2700f35d42e2761984ca5d0'
    
      26            '6ac7c082d1adba92dd911f46f9926f702be0f92a9843e6252364477d81364569eeeee9b37170a6d9000fde644588734cb6a11d165fc0aff3dbfbcd6ad353ca96')
    
      27
    
      28prepare() {
    
      29    mkdir -p $pkgname
    
      30    unsquashfs -f -d $pkgname $pkgname-$pkgver.snap
    
      31}
    
      32
    
      33package() {
    
      34    # Option 1 - copy only the needed files ~183 MiB
    
      35    mkdir -p "$pkgdir"/opt/$pkgname
    
      36
    
      37    cd "$srcdir"/$pkgname
    
      38
    
      39    cp -r \
    
      40        chrome_100_percent.pak \
    
      41        chrome_200_percent.pak \
    
      42        chrome_crashpad_handler \
    
      43        icudtl.dat \
    
      44        libEGL.so \
    
      45        libffmpeg.so \
    
      46        libGLESv2.so \
    
      47        libvk_swiftshader.so \
    
      48        libvulkan.so.1 \
    
      49        locales \
    
      50        resources \
    
      51        resources.pak \
    
      52        termius-app \
    
      53        v8_context_snapshot.bin \
    
      54        vk_swiftshader_icd.json \
    
      55        "$pkgdir"/opt/$pkgname
    
      56
    
      57    cd "$srcdir"
    
      58    # Option 2 - copy all files from the .snap file ~503 MiB
    
      59    #mkdir -p "$pkgdir"/opt/
    
      60    #cp -r "$srcdir"/$pkgname "$pkgdir"/opt/$pkgname
    
      61
    
      62    find "$pkgdir"/opt/$pkgname/ -type f -exec chmod 644 {} \;
    
      63    chmod 755 "$pkgdir"/opt/$pkgname/termius-app
    
      64    chmod 755 "$pkgdir"/opt/$pkgname/chrome_crashpad_handler
    
      65
    
      66    mkdir -p "$pkgdir"/usr/bin
    
      67    ln -sf /opt/$pkgname/termius-app "$pkgdir"/usr/bin/$pkgname
    
      68    install -Dm0644 tos.html "$pkgdir"/usr/share/licenses/$pkgname/tos.html
    
      69    install -Dm0644 $pkgname.desktop "$pkgdir"/usr/share/applications/$pkgname.desktop
    
      70    install -Dm0644 $pkgname/meta/gui/icon.png "$pkgdir"/usr/share/pixmaps/$pkgname.png
    
      71}
    
      72

Changes since previous scan

--- PKGBUILD @ 2026-07-13 00:19
+++ PKGBUILD @ 2026-08-03 00:08
@@ -2,7 +2,7 @@
 # Contributor: TBK <aur at jjtc dot eu>
 
 pkgname=termius
-pkgver=9.36.2
+pkgver=9.41.1
 pkgrel=1
 pkgdesc="Desktop SSH Client"
 url="https://www.termius.com/"
@@ -11,15 +11,17 @@
 depends=('alsa-lib' 'at-spi2-core' 'dbus' 'e2fsprogs' 'expat' 'gtk3' 'keyutils' 'libbsd' 'libnotify' 'libsecret' 'libxss' 'libxtst' 'nss' 'util-linux-libs' 'xdg-utils')
 optdepends=('libappindicator-gtk3')
 makedepends=('squashfs-tools')
+# Prebuilt binaries without debug symbols; stripping only breaks them
+options=('!strip' '!debug')
 # Get latest version + link from https://snapcraft.io/termius-app || snap info termius-app || run the following
 # curl -H 'X-Ubuntu-Series: 16' https://api.snapcraft.io/api/v1/snaps/details/termius-app | jq '.download_url' -r
 # curl -H 'X-Ubuntu-Series: 16' https://api.snapcraft.io/api/v1/snaps/details/termius-app | jq '.version' -r
 source=(
-    "$pkgname-$pkgver.snap::https://api.snapcraft.io/api/v1/snaps/download/WkTBXwoX81rBe3s3OTt3EiiLKBx2QhuS_253.snap"
+    "$pkgname-$pkgver.snap::https://api.snapcraft.io/api/v1/snaps/download/WkTBXwoX81rBe3s3OTt3EiiLKBx2QhuS_265.snap"
     "termius.desktop"
     "tos.html"
 )
-sha512sums=('8ed85b67c8f67a4e1eabb975dd40093dd14949c813b5bd454513fb9de185413c45d8fb86673929e2012e5d13dbaf00d31beec2fdfc3e93eb02a31bbeb8118295'
+sha512sums=('7ea3f2b6512d8488536dd08ec8ca04ecab0972987c6ae52b47c5aaeaf8647d0beb6a18937767a31a2e8cc6df7ca19e190db430539c6fdc1946d3be4c7b4b766c'
             'f1ce576d42a624842c9d08807c11580421b708b4bd7fac3aa9874769735df87566012e8fc0f993b08618f31d2f38588cd83d8572a2700f35d42e2761984ca5d0'
             '6ac7c082d1adba92dd911f46f9926f702be0f92a9843e6252364477d81364569eeeee9b37170a6d9000fde644588734cb6a11d165fc0aff3dbfbcd6ad353ca96')
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 15:29:50	MEDIUM	2
2026-07-13 00:19:36	CLEAN	2
2026-07-12 05:39:28	MEDIUM	1
2026-06-20 16:03:41	CLEAN	2
2026-06-20 00:50:07	MEDIUM	2
2026-06-20 00:18:46	MEDIUM	2
2026-06-19 23:51:18	MEDIUM	2
2026-06-19 19:07:35	LOW	2
2026-06-19 18:54:17	LOW	2
2026-06-18 16:11:54	MEDIUM	1