tessoa

MEDIUM

maintainer duanluan 0 votes scanned 2026-10-06 00:19:23.678998

View on AUR

Why flagged

Installs a prebuilt proprietary binary downloaded from the project's own domain (download.tessoa.com), but the source URL always fetches 'latest' rather than a versioned artifact, meaning the binary can be silently swapped at any time without checksum mismatch detection being reliable across rebuilds; the sha256sum pins only the current download, not a stable versioned release, making this a supply-chain risk typical of rolling prebuilt binaries from a low-visibility vendor.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("tessoa-${pkgver}.tar.gz::https://download.tessoa.com/tessoa/latest/tessoa.tar.gz")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 75%): Installs a prebuilt proprietary binary downloaded from the project's own domain (download.tessoa.com), but the source URL always fetches 'latest' rather than a versioned artifact, meaning the binary can be silently swapped at any time without checksum mismatch detection being reliable across rebuilds; the sha256sum pins only the current download, not a stable versioned release, making this a supply-chain risk typical of rolling prebuilt binaries from a low-visibility vendor.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: duanluan <duanluan@outlook.com>
    
      2
    
      3pkgname=tessoa
    
      4pkgver=0.27.0
    
      5pkgrel=1
    
      6pkgdesc='GPU-accelerated file manager with split panes, saved layouts, colored tags and multiple views'
    
      7arch=('x86_64')
    
      8url='https://tessoa.cn/'
    
      9license=('LicenseRef-Proprietary')
    
      10depends=('vulkan-icd-loader' 'vulkan-driver' 'libx11' 'libxcb' 'libxcursor' 'libxi' 'libxkbcommon' 'wayland' 'hicolor-icon-theme')
    
      11options=('!strip')
    
      12# upstream etag: "f9fd2ba2f7d5fbdc51f3a60b0d55cc66-2"
    
      13source=("tessoa-${pkgver}.tar.gz::https://download.tessoa.com/tessoa/latest/tessoa.tar.gz")
    
      14sha256sums=('d8ad9a55d8d8f3ec74fc8768ac7a0c06dd3e9d34724eb66091f6608ca4463518')
    
      15
    
      16package() {
    
      17    install -Dm755 "${srcdir}/tessoa/tessoa" "${pkgdir}/usr/bin/tessoa"
    
      18    install -Dm644 "${srcdir}/tessoa/tessoa.desktop" "${pkgdir}/usr/share/applications/tessoa.desktop"
    
      19    install -Dm644 "${srcdir}/tessoa/tessoa.png" "${pkgdir}/usr/share/icons/hicolor/512x512/apps/tessoa.png"
    
      20    install -Dm644 "${srcdir}/tessoa/THIRD-PARTY-NOTICES.html" "${pkgdir}/usr/share/licenses/${pkgname}/THIRD-PARTY-NOTICES.html"
    
      21}
    
      22

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-06 00:19:23	Medium	3
2026-10-06 00:13:36	Low	3
2026-10-05 23:40:58	Medium	2