termius-deb

MEDIUM

maintainer inetol 3 votes scanned 2026-11-01 14:00:44.307000

View on AUR

Why flagged

The package downloads a prebuilt .deb from the vendor's official domain, but the source is a binary package which could be tampered with if the host were compromised, constituting a supply-chain risk despite being from the official project.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source=("${pkgname}-${pkgver}-amd64.deb::https://deb.termius.com/pool/main/t/termius-app/termius-app_${pkgver}_amd64.deb"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb from the vendor's official domain, but the source is a binary package which could be tampered with if the host were compromised, constituting a supply-chain risk despite being from the official project.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=termius-deb
    
      2pkgver=10.3.0
    
      3pkgrel=1
    
      4pkgdesc='Desktop SSH Client'
    
      5arch=('x86_64')
    
      6url='https://www.termius.com/'
    
      7license=('custom')
    
      8conflicts=('termius')
    
      9depends=('alsa-lib' 'at-spi2-core' 'cairo' 'dbus' 'expat' 'gcc-libs'
    
      10         'glib2' 'glibc' 'gtk3' 'libcups' 'libdrm' 'libnotify' 'libsecret'
    
      11         'libx11' 'libxcb' 'libxcomposite' 'libxdamage' 'libxext' 'libxfixes'
    
      12         'libxkbcommon' 'libxrandr' 'libxss' 'libxtst' 'mesa' 'nspr' 'nss'
    
      13         'pango' 'systemd-libs' 'util-linux-libs' 'xdg-utils')
    
      14optdepends=('libappindicator-gtk3: system tray integration'
    
      15            'org.freedesktop.secrets: credential storage service')
    
      16options=('!strip' '!debug')
    
      17source=("${pkgname}-${pkgver}-amd64.deb::https://deb.termius.com/pool/main/t/termius-app/termius-app_${pkgver}_amd64.deb"
    
      18        'termius.desktop'
    
      19        'tos.html')
    
      20sha256sums=('ab94e18e55db196ad396c0c25bf4181d3c6a6e1240a1b48ed3daa375a504e018'
    
      21            'd97e5258351d06107a0d0816542841d1d61609c0308a5074695dc5c5de0a6268'
    
      22            '51978a30942b337918e18690f9c93dc28eb06d54eafc21bb6b29e6ef428083cb')
    
      23
    
      24prepare() {
    
      25    mkdir -p "${srcdir}/upstream"
    
      26    bsdtar -xf "${srcdir}/data.tar.xz" -C "${srcdir}/upstream"
    
      27    test -x "${srcdir}/upstream/opt/Termius/termius-app"
    
      28    test -f "${srcdir}/upstream/opt/Termius/chrome-sandbox"
    
      29}
    
      30
    
      31package() {
    
      32    install -d "${pkgdir}/opt" "${pkgdir}/usr/bin"
    
      33    cp -a --reflink=never "${srcdir}/upstream/opt/Termius" "${pkgdir}/opt/termius"
    
      34
    
      35    chmod 755 "${pkgdir}/opt/termius/termius-app"
    
      36    chmod 755 "${pkgdir}/opt/termius/chrome_crashpad_handler"
    
      37    chmod 4755 "${pkgdir}/opt/termius/chrome-sandbox"
    
      38    ln -s /opt/termius/termius-app "${pkgdir}/usr/bin/termius"
    
      39
    
      40    install -Dm644 "${srcdir}/termius.desktop" \
    
      41        "${pkgdir}/usr/share/applications/termius.desktop"
    
      42    local icon size
    
      43    for icon in "${srcdir}"/upstream/usr/share/icons/hicolor/*/apps/termius-app.png; do
    
      44        size=${icon%/apps/*}
    
      45        size=${size##*/}
    
      46        install -Dm644 "$icon" \
    
      47            "${pkgdir}/usr/share/icons/hicolor/${size}/apps/termius.png"
    
      48    done
    
      49    install -Dm644 "${srcdir}/tos.html" \
    
      50        "${pkgdir}/usr/share/licenses/${pkgname}/tos.html"
    
      51    install -Dm644 "${srcdir}/upstream/opt/Termius/LICENSE.electron.txt" \
    
      52        "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.electron.txt"
    
      53}
    
      54

Changes since previous scan

--- PKGBUILD @ 2026-11-01 00:21
+++ PKGBUILD @ 2026-11-01 14:00
@@ -1,77 +1,54 @@
-# Maintainer: Ivan Gabaldon <aur[at]inetol.net>
-
-#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!#
-#! This package is NOT checked by checksums, careful... !#
-#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!#
 pkgname=termius-deb
-_pkgname=Termius
-pkgver=9.22.1
+pkgver=10.3.0
 pkgrel=1
-pkgdesc='Desktop SSH Client (deb release)'
+pkgdesc='Desktop SSH Client'
 arch=('x86_64')
-url='https://termius.com'
-license=('LicenseRef-Termius')
-makedepends=('links')
-_electron=electron21
-provides=("${pkgname//-deb}")
-conflicts=("${pkgname//-deb}" "${pkgname//-deb/'-beta'}")
-source=("${pkgname//-deb}-rolling.deb::https://autoupdate.termius.com/linux/$_pkgname.deb"
-        "${pkgname//-deb}.sh")
-b2sums=('SKIP'
-        '16be5f2c2d1134875ac9a284138d2fc6d2133f3588d4efd34422be1c99caddf37e88c53c8b1a1286de0e6ae0d2a806983c2bf91abcff269295fc487bdde56051')
+url='https://www.termius.com/'
+license=('custom')
+conflicts=('termius')
+depends=('alsa-lib' 'at-spi2-core' 'cairo' 'dbus' 'expat' 'gcc-libs'
+         'glib2' 'glibc' 'gtk3' 'libcups' 'libdrm' 'libnotify' 'libsecret'
+         'libx11' 'libxcb' 'libxcomposite' 'libxdamage' 'libxext' 'libxfixes'
+         'libxkbcommon' 'libxrandr' 'libxss' 'libxtst' 'mesa' 'nspr' 'nss'
+         'pango' 'systemd-libs' 'util-linux-libs' 'xdg-utils')
+optdepends=('libappindicator-gtk3: system tray integration'
+            'org.freedesktop.secrets: credential storage service')
+options=('!strip' '!debug')
+source=("${pkgname}-${pkgver}-amd64.deb::https://deb.termius.com/pool/main/t/termius-app/termius-app_${pkgver}_amd64.deb"
+        'termius.desktop'
+        'tos.html')
+sha256sums=('ab94e18e55db196ad396c0c25bf4181d3c6a6e1240a1b48ed3daa375a504e018'
+            'd97e5258351d06107a0d0816542841d1d61609c0308a5074695dc5c5de0a6268'
+            '51978a30942b337918e18690f9c93dc28eb06d54eafc21bb6b29e6ef428083cb')
 
 prepare() {
-    sed -i "s|@ELECTRON@|$_electron|" "${pkgname//-deb}.sh"
-
-    mkdir -p "${pkgname//-deb}-rolling/"
-    bsdtar -xpf 'data.tar.xz' -C "${pkgname//-deb}-rolling/"
-
-    # Convert
-    cd "${pkgname//-deb}-rolling/"
-
-    links -width 80 -dump 'https://termius.com/terms-of-use' | sed -n '/Terms and Conditions/,/Last updated:/p' > "opt/$_pkgname/resources/LICENSE"
-
-    cat "../${pkgname//-deb}.sh" > "opt/$_pkgname/resources/${pkgname//-deb}"
-
-    mv "usr/share/applications/${pkgname//-deb/'-app'}.desktop" "opt/$_pkgname/resources/${pkgname//-deb}.desktop"
-    sed -i -e "s|Exec=.*|Exec=/usr/bin/${pkgname//-deb} %U|" -e "s|Icon=.*|Icon=${pkgname//-deb}|" "opt/$_pkgname/resources/${pkgname//-deb}.desktop"
-
-    mv "usr/share/icons/hicolor/512x512/apps/${pkgname//-deb/'-app'}.png" "opt/$_pkgname/resources/${pkgname//-deb}.png"
-}
-
-pkgver() {
-    mkdir -p "${pkgname//-deb}-control/"
-    bsdtar -xpf 'control.tar.gz' -C "${pkgname//-deb}-control/"
-
-    grep 'Version:' "${pkgname//-deb}-control/control" | awk '{print $2}'
+    mkdir -p "${srcdir}/upstream"
+    bsdtar -xf "${srcdir}/data.tar.xz" -C "${srcdir}/upstream"
+    test -x "${srcdir}/upstream/opt/Termius/termius-app"
+    test -f "${srcdir}/upstream/opt/Termius/chrome-sandbox"
 }
 
 package() {
-    depends=("$_electron-bin"
-             'gcc-libs'
-             'glib2'
-             'glibc'
-             'libsecret'
-             'systemd-libs'
-             'zlib')
+    install -d "${pkgdir}/opt" "${pkgdir}/usr/bin"
+    cp -a --reflink=never "${srcdir}/upstream/opt/Termius" "${pkgdir}/opt/termius"
 
-    optdepends=('libappindicator-gtk3: Systray indicator support')
+    chmod 755 "${pkgdir}/opt/termius/termius-app"
+    chmod 755 "${pkgdir}/opt/termius/chrome_crashpad_handler"
+    chmod 4755 "${pkgdir}/opt/termius/chrome-sandbox"
+    ln -s /opt/termius/termius-app "${pkgdir}/usr/bin/termius"
 
-    install -d "$pkgdir/opt/${pkgname//-deb}/"
-    cp -a "${pkgname//-deb}-rolling/opt/$_pkgname/resources/." "$pkgdir/opt/${pkgname//-deb}/"
-
-    chmod 755 "$pkgdir/opt/${pkgname//-deb}/${pkgname//-deb}"
-
-    install -d "$pkgdir/usr/bin/"
-    ln -s "/opt/${pkgname//-deb}/${pkgname//-deb}" "$pkgdir/usr/bin/${pkgname//-deb}"
-
-    install -d "$pkgdir/usr/share/applications/"
-    ln -s "/opt/${pkgname//-deb}/${pkgname//-deb}.desktop" "$pkgdir/usr/share/applications/${pkgname//-deb}.desktop"
-
-    install -d "$pkgdir/usr/share/icons/"
-    ln -s "/opt/${pkgname//-deb}/${pkgname//-deb}.png" "$pkgdir/usr/share/icons/${pkgname//-deb}.png"
-
-    install -d "$pkgdir/usr/share/licenses/${pkgname//-deb}/"
-    ln -s "/opt/${pkgname//-deb}/LICENSE" "$pkgdir/usr/share/licenses/${pkgname//-deb}/LICENSE"
+    install -Dm644 "${srcdir}/termius.desktop" \
+        "${pkgdir}/usr/share/applications/termius.desktop"
+    local icon size
+    for icon in "${srcdir}"/upstream/usr/share/icons/hicolor/*/apps/termius-app.png; do
+        size=${icon%/apps/*}
+        size=${size##*/}
+        install -Dm644 "$icon" \
+            "${pkgdir}/usr/share/icons/hicolor/${size}/apps/termius.png"
+    done
+    install -Dm644 "${srcdir}/tos.html" \
+        "${pkgdir}/usr/share/licenses/${pkgname}/tos.html"
+    install -Dm644 "${srcdir}/upstream/opt/Termius/LICENSE.electron.txt" \
+        "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.electron.txt"
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 14:00:44	Medium	2
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 07:49:59	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2