termius-deb

maintainer inetol · 3 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt Electron application binary (.deb) from autoupdate.termius.com with b2sums='SKIP', meaning the binary is never verified against a known-good checksum. While autoupdate.termius.com is the official Termius auto-update endpoint (not a personal/unofficial host), the SKIP checksum means any MITM or server-side substitution would go undetected. The maintainer even warns about this explicitly in the PKGBUILD comments. The package installs an executed binary (Electron app with native code) directly from a rolling/always-latest URL with no integrity verification. This is a genuine supply-chain concern: the version pinned in pkgver (9.22.1) is used only for metadata, but the actual downloaded artifact is whatever the server serves at build time. The host is the official vendor update server, which reduces (but does not eliminate) the risk compared to a personal host, but the lack of any checksum verification on an executed binary remains a real medium-severity concern.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source=("${pkgname//-deb}-rolling.deb::https://autoupdate.termius.com/linux/$_pkgname.deb"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 85%): This PKGBUILD downloads a prebuilt Electron application binary (.deb) from autoupdate.termius.com with b2sums='SKIP', meaning the binary is never verified against a known-good checksum. While autoupdate.termius.com is the official Termius auto-update endpoint (not a personal/unofficial host), the SKIP checksum means any MITM or server-side substitution would go undetected. The maintainer even warns about this explicitly in the PKGBUILD comments. The package installs an executed binary (Electron app with native code) directly from a rolling/always-latest URL with no integrity verification. This is a genuine supply-chain concern: the version pinned in pkgver (9.22.1) is used only for metadata, but the actual downloaded artifact is whatever the server serves at build time. The host is the official vendor update server, which reduces (but does not eliminate) the risk compared to a personal host, but the lack of any checksum verification on an executed binary remains a real medium-severity concern.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Ivan Gabaldon <aur[at]inetol.net>
    
      2
    
      3#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!#
    
      4#! This package is NOT checked by checksums, careful... !#
    
      5#!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!#
    
      6pkgname=termius-deb
    
      7_pkgname=Termius
    
      8pkgver=9.22.1
    
      9pkgrel=1
    
      10pkgdesc='Desktop SSH Client (deb release)'
    
      11arch=('x86_64')
    
      12url='https://termius.com'
    
      13license=('LicenseRef-Termius')
    
      14makedepends=('links')
    
      15_electron=electron21
    
      16provides=("${pkgname//-deb}")
    
      17conflicts=("${pkgname//-deb}" "${pkgname//-deb/'-beta'}")
    
      18source=("${pkgname//-deb}-rolling.deb::https://autoupdate.termius.com/linux/$_pkgname.deb"
    
      19        "${pkgname//-deb}.sh")
    
      20b2sums=('SKIP'
    
      21        '16be5f2c2d1134875ac9a284138d2fc6d2133f3588d4efd34422be1c99caddf37e88c53c8b1a1286de0e6ae0d2a806983c2bf91abcff269295fc487bdde56051')
    
      22
    
      23prepare() {
    
      24    sed -i "s|@ELECTRON@|$_electron|" "${pkgname//-deb}.sh"
    
      25
    
      26    mkdir -p "${pkgname//-deb}-rolling/"
    
      27    bsdtar -xpf 'data.tar.xz' -C "${pkgname//-deb}-rolling/"
    
      28
    
      29    # Convert
    
      30    cd "${pkgname//-deb}-rolling/"
    
      31
    
      32    links -width 80 -dump 'https://termius.com/terms-of-use' | sed -n '/Terms and Conditions/,/Last updated:/p' > "opt/$_pkgname/resources/LICENSE"
    
      33
    
      34    cat "../${pkgname//-deb}.sh" > "opt/$_pkgname/resources/${pkgname//-deb}"
    
      35
    
      36    mv "usr/share/applications/${pkgname//-deb/'-app'}.desktop" "opt/$_pkgname/resources/${pkgname//-deb}.desktop"
    
      37    sed -i -e "s|Exec=.*|Exec=/usr/bin/${pkgname//-deb} %U|" -e "s|Icon=.*|Icon=${pkgname//-deb}|" "opt/$_pkgname/resources/${pkgname//-deb}.desktop"
    
      38
    
      39    mv "usr/share/icons/hicolor/512x512/apps/${pkgname//-deb/'-app'}.png" "opt/$_pkgname/resources/${pkgname//-deb}.png"
    
      40}
    
      41
    
      42pkgver() {
    
      43    mkdir -p "${pkgname//-deb}-control/"
    
      44    bsdtar -xpf 'control.tar.gz' -C "${pkgname//-deb}-control/"
    
      45
    
      46    grep 'Version:' "${pkgname//-deb}-control/control" | awk '{print $2}'
    
      47}
    
      48
    
      49package() {
    
      50    depends=("$_electron-bin"
    
      51             'gcc-libs'
    
      52             'glib2'
    
      53             'glibc'
    
      54             'libsecret'
    
      55             'systemd-libs'
    
      56             'zlib')
    
      57
    
      58    optdepends=('libappindicator-gtk3: Systray indicator support')
    
      59
    
      60    install -d "$pkgdir/opt/${pkgname//-deb}/"
    
      61    cp -a "${pkgname//-deb}-rolling/opt/$_pkgname/resources/." "$pkgdir/opt/${pkgname//-deb}/"
    
      62
    
      63    chmod 755 "$pkgdir/opt/${pkgname//-deb}/${pkgname//-deb}"
    
      64
    
      65    install -d "$pkgdir/usr/bin/"
    
      66    ln -s "/opt/${pkgname//-deb}/${pkgname//-deb}" "$pkgdir/usr/bin/${pkgname//-deb}"
    
      67
    
      68    install -d "$pkgdir/usr/share/applications/"
    
      69    ln -s "/opt/${pkgname//-deb}/${pkgname//-deb}.desktop" "$pkgdir/usr/share/applications/${pkgname//-deb}.desktop"
    
      70
    
      71    install -d "$pkgdir/usr/share/icons/"
    
      72    ln -s "/opt/${pkgname//-deb}/${pkgname//-deb}.png" "$pkgdir/usr/share/icons/${pkgname//-deb}.png"
    
      73
    
      74    install -d "$pkgdir/usr/share/licenses/${pkgname//-deb}/"
    
      75    ln -s "/opt/${pkgname//-deb}/LICENSE" "$pkgdir/usr/share/licenses/${pkgname//-deb}/LICENSE"
    
      76}
    
      77

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2