testmace

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt AppImage binary from download.testmace.com (the vendor's own download server, not a personal/unofficial host), extracts and installs it system-wide under /opt, and symlinks it into /usr/bin. The concerns are: (1) sha256sums='SKIP' means no integrity verification — any compromise of the download.testmace.com server or a MITM attack would silently deliver a malicious binary that gets executed on the user's system; (2) pkgver='latest' with a floating URL (TestMace.AppImage, no version in path) means the package always fetches whatever is currently served, making reproducibility impossible and updates uncontrolled. While download.testmace.com appears to be the legitimate vendor host, the combination of an executed binary + no checksum + floating 'latest' URL constitutes a genuine supply-chain risk. This is a real medium-severity concern, not a false positive.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("${pkgname}-${pkgver}.AppImage::https://download.testmace.com/TestMace.AppImage")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): This PKGBUILD downloads a prebuilt AppImage binary from download.testmace.com (the vendor's own download server, not a personal/unofficial host), extracts and installs it system-wide under /opt, and symlinks it into /usr/bin. The concerns are: (1) sha256sums='SKIP' means no integrity verification — any compromise of the download.testmace.com server or a MITM attack would silently deliver a malicious binary that gets executed on the user's system; (2) pkgver='latest' with a floating URL (TestMace.AppImage, no version in path) means the package always fetches whatever is currently served, making reproducibility impossible and updates uncontrolled. While download.testmace.com appears to be the legitimate vendor host, the combination of an executed binary + no checksum + floating 'latest' URL constitutes a genuine supply-chain risk. This is a real medium-severity concern, not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  Dimitris Kiziridis <ragouel at outlook dot com>
    
      2
    
      3pkgname=testmace
    
      4pkgver=latest
    
      5pkgrel=1
    
      6pkgdesc="A modern powerful crossplatform tool for working with an API and creating automated API tests"
    
      7arch=('x86_64')
    
      8url='https://testmace.com'
    
      9license=("custom:${pkgname}")
    
      10depends=('zlib')
    
      11options=('!strip')
    
      12noextract=("${pkgname}-${pkgver}.AppImage")
    
      13source=("${pkgname}-${pkgver}.AppImage::https://download.testmace.com/TestMace.AppImage")
    
      14sha256sums=('SKIP')
    
      15
    
      16package() {
    
      17  chmod 755 ./${pkgname}-${pkgver}.AppImage
    
      18  ./${pkgname}-${pkgver}.AppImage --appimage-extract
    
      19  install -Dm644 squashfs-root/usr/share/icons/hicolor/256x256/apps/testmace.png "${pkgdir}/usr/share/pixmaps/testmace.png"
    
      20  gendesk -f -n --pkgname "${pkgname}" \
    
      21          --pkgdesc "$pkgdesc" \
    
      22          --name "Test Mace" \
    
      23          --comment "$pkgdesc" \
    
      24          --exec "${pkgname}" \
    
      25          --categories 'Development;Application;' \
    
      26          --icon "${pkgname}"
    
      27  install -Dm644 "${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
    
      28  install -d "${pkgdir}/usr/bin"
    
      29  install -d "${pkgdir}/opt"
    
      30  cp -avR squashfs-root/ "${pkgdir}/opt/${pkgname}"
    
      31  ln -s /opt/${pkgname}/AppRun "${pkgdir}/usr/bin/${pkgname}"
    
      32  find "${pkgdir}/opt/${pkgname}" -type d -exec chmod 755 {} +
    
      33}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2