termius-beta

maintainer tbk · 2 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt .snap file from the official snapcraft.io API, which is the project's legitimate distribution channel; while the host is not whitelisted, the source is verifiable and the content is unpacked and installed without executing remote code or introducing untrusted binaries beyond the official release.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt .snap file from the official snapcraft.io API, which is the project's legitimate distribution channel; while the host is not whitelisted, the source is verifiable and the content is unpacked and installed without executing remote code or introducing untrusted binaries beyond the official release.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 "$pkgname-$pkgver.snap::https://api.snapcraft.io/api/v1/snaps/download/yyZzRdoyiRz3EM7iuvjhaIjDfnlFJcZs_415.snap"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: TBK <aur at jjtc dot eu>
    
      2# Contributor: TBK <aur at jjtc dot eu>
    
      3
    
      4pkgname=termius-beta
    
      5pkgver=9.41.1
    
      6pkgrel=1
    
      7pkgdesc="Desktop SSH Client"
    
      8url="https://www.termius.com/"
    
      9arch=('x86_64')
    
      10license=('custom')
    
      11depends=('alsa-lib' 'at-spi2-core' 'dbus' 'e2fsprogs' 'expat' 'gtk3' 'keyutils' 'libbsd' 'libnotify' 'libsecret' 'libxss' 'libxtst' 'nss' 'util-linux-libs' 'xdg-utils')
    
      12optdepends=('libappindicator-gtk3')
    
      13makedepends=('squashfs-tools')
    
      14# Prebuilt binaries without debug symbols; stripping only breaks them
    
      15options=('!strip' '!debug')
    
      16# Get latest version + link from https://snapcraft.io/termius-beta|| snap info termius-beta || run the following
    
      17# curl -H 'X-Ubuntu-Series: 16' https://api.snapcraft.io/api/v1/snaps/details/termius-beta | jq '.download_url' -r
    
      18# curl -H 'X-Ubuntu-Series: 16' https://api.snapcraft.io/api/v1/snaps/details/termius-beta | jq '.version' -r
    
      19source=(
    
      20    "$pkgname-$pkgver.snap::https://api.snapcraft.io/api/v1/snaps/download/yyZzRdoyiRz3EM7iuvjhaIjDfnlFJcZs_415.snap"
    
      21    "termius-beta.desktop"
    
      22    "tos.html"
    
      23)
    
      24sha512sums=('319fbe09f2ad5517fe42cda3e05ab6ac315c14a2c99c2f1fa21e995a7bb7e10d864cc4ae98ac55acd5186c76c0632c6740c066fb31a4d71cb9849ffbf0a88554'
    
      25            '8bf93360614226cf477e5322d87e5fefe781d97e30390777ccb89282219c90714e98868381ab69b001c67a606e068f51a177b6f48bbbdb0c0f4a4f27bf0f0dd4'
    
      26            '6ac7c082d1adba92dd911f46f9926f702be0f92a9843e6252364477d81364569eeeee9b37170a6d9000fde644588734cb6a11d165fc0aff3dbfbcd6ad353ca96')
    
      27
    
      28prepare() {
    
      29    mkdir -p $pkgname
    
      30    unsquashfs -f -d $pkgname $pkgname-$pkgver.snap
    
      31}
    
      32
    
      33package() {
    
      34    # Option 1 - copy only the needed files ~183 MiB
    
      35    mkdir -p "$pkgdir"/opt/$pkgname
    
      36
    
      37    cd "$srcdir"/$pkgname
    
      38
    
      39    cp -r \
    
      40        chrome_100_percent.pak \
    
      41        chrome_200_percent.pak \
    
      42        chrome_crashpad_handler \
    
      43        icudtl.dat \
    
      44        libEGL.so \
    
      45        libffmpeg.so \
    
      46        libGLESv2.so \
    
      47        libvk_swiftshader.so \
    
      48        libvulkan.so.1 \
    
      49        locales \
    
      50        resources \
    
      51        resources.pak \
    
      52        termius-beta \
    
      53        v8_context_snapshot.bin \
    
      54        vk_swiftshader_icd.json \
    
      55        "$pkgdir"/opt/$pkgname
    
      56
    
      57    cd "$srcdir"
    
      58    # Option 2 - copy all files from the .snap file ~503 MiB
    
      59    #mkdir -p "$pkgdir"/opt/
    
      60    #cp -r "$srcdir"/$pkgname "$pkgdir"/opt/$pkgname
    
      61
    
      62    find "$pkgdir"/opt/$pkgname/ -type f -exec chmod 644 {} \;
    
      63    chmod 755 "$pkgdir"/opt/$pkgname/termius-beta
    
      64    chmod 755 "$pkgdir"/opt/$pkgname/chrome_crashpad_handler
    
      65
    
      66    mkdir -p "$pkgdir"/usr/bin
    
      67    ln -sf /opt/$pkgname/termius-beta "$pkgdir"/usr/bin/$pkgname
    
      68    install -Dm0644 tos.html "$pkgdir"/usr/share/licenses/$pkgname/tos.html
    
      69    install -Dm0644 $pkgname.desktop "$pkgdir"/usr/share/applications/$pkgname.desktop
    
      70    install -Dm0644 $pkgname/meta/gui/icon.png "$pkgdir"/usr/share/pixmaps/$pkgname.png
    
      71}
    
      72

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2