tinspec-bin

MEDIUM

maintainer sademir 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt .deb from a non-whitelisted host (tinspec.dev), which is used as the source; if the host were compromised or the URL redirected, an attacker could silently substitute a malicious binary, posing a supply-chain risk despite the fixed checksum.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:23 source=("https://tinspec.dev/releases/Tinspec_${_upver}_amd64.deb")

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb from a non-whitelisted host (tinspec.dev), which is used as the source; if the host were compromised or the URL redirected, an attacker could silently substitute a malicious binary, posing a supply-chain risk despite the fixed checksum.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Samet Demir <dev@sademir.com>
    
      2#
    
      3# Template — do not edit the generated PKGBUILD by hand. `update-aur.sh <version>` fills the
    
      4# @PLACEHOLDERS@ and pushes to the AUR. Repacks the released .deb (built by the desktop repo's
    
      5# GitLab CI and published to tinspec.dev); only the *latest* version's source URL resolves — the
    
      6# site prunes older artifacts on publish.
    
      7pkgname=tinspec-bin
    
      8pkgver=0.1.0preview.8
    
      9pkgrel=1
    
      10pkgdesc="Request-testing tool for backend developers — spec-driven endpoints, request chains, automated auth"
    
      11arch=('x86_64')
    
      12url="https://tinspec.dev"
    
      13license=('AGPL-3.0-only')
    
      14# The Arch closure of the .deb's Depends (webkit2gtk-4.1 + gtk3 and their usual companions).
    
      15# update-aur.sh prints the .deb's actual Depends on every run — reconcile if it changes.
    
      16depends=('webkit2gtk-4.1' 'gtk3' 'cairo' 'gdk-pixbuf2' 'glib2' 'hicolor-icon-theme' 'libsoup3' 'openssl')
    
      17optdepends=('xdg-desktop-portal-gtk: native file/folder pickers'
    
      18            'org.freedesktop.secrets: store auth secrets in the system keyring')
    
      19provides=('tinspec')
    
      20conflicts=('tinspec')
    
      21options=('!strip' '!debug')
    
      22_upver=0.1.0-preview.8
    
      23source=("https://tinspec.dev/releases/Tinspec_${_upver}_amd64.deb")
    
      24sha256sums=('fec3c2684f124bd40da573d5544e13337718d81ffe5f2808588d8ce80cfff583')
    
      25
    
      26package() {
    
      27  # The .deb is an ar archive whose payload is data.tar.{gz,xz,zst} — unpack it straight into
    
      28  # $pkgdir (it already carries usr/bin, icons, and the .desktop file). Updates flow through
    
      29  # pacman; the app detects newer releases but is notify-only for this install (no self-update).
    
      30  local data
    
      31  data=$(bsdtar -tf "$srcdir/Tinspec_${_upver}_amd64.deb" | grep '^data.tar')
    
      32  bsdtar -xOf "$srcdir/Tinspec_${_upver}_amd64.deb" "$data" | bsdtar -xf - -C "$pkgdir"
    
      33}
    
      34

Changes since previous scan

--- PKGBUILD @ 2026-09-08 21:18
+++ PKGBUILD @ 2026-09-17 00:27
@@ -5,7 +5,7 @@
 # GitLab CI and published to tinspec.dev); only the *latest* version's source URL resolves — the
 # site prunes older artifacts on publish.
 pkgname=tinspec-bin
-pkgver=0.1.0preview.7
+pkgver=0.1.0preview.8
 pkgrel=1
 pkgdesc="Request-testing tool for backend developers — spec-driven endpoints, request chains, automated auth"
 arch=('x86_64')
@@ -19,9 +19,9 @@
 provides=('tinspec')
 conflicts=('tinspec')
 options=('!strip' '!debug')
-_upver=0.1.0-preview.7
+_upver=0.1.0-preview.8
 source=("https://tinspec.dev/releases/Tinspec_${_upver}_amd64.deb")
-sha256sums=('a85f4540ed2131a2842fb79728dbc6c73ae08a4c6501c9ea6cfc330579f61353')
+sha256sums=('fec3c2684f124bd40da573d5544e13337718d81ffe5f2808588d8ce80cfff583')
 
 package() {
   # The .deb is an ar archive whose payload is data.tar.{gz,xz,zst} — unpack it straight into

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 23:18:28	Medium	2
2026-09-08 21:18:22	Medium	2
2026-09-08 17:18:20	Medium	2
2026-09-08 15:17:32	Medium	2
2026-09-08 13:17:19	Medium	2
2026-09-08 11:17:13	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 20:01:32	Medium	2
2026-09-05 00:16:27	Medium	2