termius

MEDIUM

maintainer tbk 37 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt .snap binary from a non-standard, non-whitelisted host (api.snapcraft.io) which is not the project's direct release infrastructure, creating a supply-chain risk if the source were compromised.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 "$pkgname-$pkgver.snap::https://api.snapcraft.io/api/v1/snaps/download/WkTBXwoX81rBe3s3OTt3EiiLKBx2QhuS_265.snap"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .snap binary from a non-standard, non-whitelisted host (api.snapcraft.io) which is not the project's direct release infrastructure, creating a supply-chain risk if the source were compromised.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: TBK <aur at jjtc dot eu>
    
      2# Contributor: TBK <aur at jjtc dot eu>
    
      3
    
      4pkgname=termius
    
      5pkgver=9.41.1
    
      6pkgrel=1
    
      7pkgdesc="Desktop SSH Client"
    
      8url="https://www.termius.com/"
    
      9arch=('x86_64')
    
      10license=('custom')
    
      11depends=('alsa-lib' 'at-spi2-core' 'dbus' 'e2fsprogs' 'expat' 'gtk3' 'keyutils' 'libbsd' 'libnotify' 'libsecret' 'libxss' 'libxtst' 'nss' 'util-linux-libs' 'xdg-utils')
    
      12optdepends=('libappindicator-gtk3')
    
      13makedepends=('squashfs-tools')
    
      14# Prebuilt binaries without debug symbols; stripping only breaks them
    
      15options=('!strip' '!debug')
    
      16# Get latest version + link from https://snapcraft.io/termius-app || snap info termius-app || run the following
    
      17# curl -H 'X-Ubuntu-Series: 16' https://api.snapcraft.io/api/v1/snaps/details/termius-app | jq '.download_url' -r
    
      18# curl -H 'X-Ubuntu-Series: 16' https://api.snapcraft.io/api/v1/snaps/details/termius-app | jq '.version' -r
    
      19source=(
    
      20    "$pkgname-$pkgver.snap::https://api.snapcraft.io/api/v1/snaps/download/WkTBXwoX81rBe3s3OTt3EiiLKBx2QhuS_265.snap"
    
      21    "termius.desktop"
    
      22    "tos.html"
    
      23)
    
      24sha512sums=('7ea3f2b6512d8488536dd08ec8ca04ecab0972987c6ae52b47c5aaeaf8647d0beb6a18937767a31a2e8cc6df7ca19e190db430539c6fdc1946d3be4c7b4b766c'
    
      25            'f1ce576d42a624842c9d08807c11580421b708b4bd7fac3aa9874769735df87566012e8fc0f993b08618f31d2f38588cd83d8572a2700f35d42e2761984ca5d0'
    
      26            '6ac7c082d1adba92dd911f46f9926f702be0f92a9843e6252364477d81364569eeeee9b37170a6d9000fde644588734cb6a11d165fc0aff3dbfbcd6ad353ca96')
    
      27
    
      28prepare() {
    
      29    mkdir -p $pkgname
    
      30    unsquashfs -f -d $pkgname $pkgname-$pkgver.snap
    
      31}
    
      32
    
      33package() {
    
      34    # Option 1 - copy only the needed files ~183 MiB
    
      35    mkdir -p "$pkgdir"/opt/$pkgname
    
      36
    
      37    cd "$srcdir"/$pkgname
    
      38
    
      39    cp -r \
    
      40        chrome_100_percent.pak \
    
      41        chrome_200_percent.pak \
    
      42        chrome_crashpad_handler \
    
      43        icudtl.dat \
    
      44        libEGL.so \
    
      45        libffmpeg.so \
    
      46        libGLESv2.so \
    
      47        libvk_swiftshader.so \
    
      48        libvulkan.so.1 \
    
      49        locales \
    
      50        resources \
    
      51        resources.pak \
    
      52        termius-app \
    
      53        v8_context_snapshot.bin \
    
      54        vk_swiftshader_icd.json \
    
      55        "$pkgdir"/opt/$pkgname
    
      56
    
      57    cd "$srcdir"
    
      58    # Option 2 - copy all files from the .snap file ~503 MiB
    
      59    #mkdir -p "$pkgdir"/opt/
    
      60    #cp -r "$srcdir"/$pkgname "$pkgdir"/opt/$pkgname
    
      61
    
      62    find "$pkgdir"/opt/$pkgname/ -type f -exec chmod 644 {} \;
    
      63    chmod 755 "$pkgdir"/opt/$pkgname/termius-app
    
      64    chmod 755 "$pkgdir"/opt/$pkgname/chrome_crashpad_handler
    
      65
    
      66    mkdir -p "$pkgdir"/usr/bin
    
      67    ln -sf /opt/$pkgname/termius-app "$pkgdir"/usr/bin/$pkgname
    
      68    install -Dm0644 tos.html "$pkgdir"/usr/share/licenses/$pkgname/tos.html
    
      69    install -Dm0644 $pkgname.desktop "$pkgdir"/usr/share/applications/$pkgname.desktop
    
      70    install -Dm0644 $pkgname/meta/gui/icon.png "$pkgdir"/usr/share/pixmaps/$pkgname.png
    
      71}
    
      72

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2