tinspec-bin

maintainer sademir · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs a prebuilt .deb from a non-whitelisted host (tinspec.dev) without source availability or reproducibility, creating a supply-chain risk if the host is compromised or the artifact is swapped.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:23 source=("https://tinspec.dev/releases/Tinspec_${_upver}_amd64.deb")

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package installs a prebuilt .deb from a non-whitelisted host (tinspec.dev) without source availability or reproducibility, creating a supply-chain risk if the host is compromised or the artifact is swapped.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Samet Demir <dev@sademir.com>
    
      2#
    
      3# Template — do not edit the generated PKGBUILD by hand. `update-aur.sh <version>` fills the
    
      4# @PLACEHOLDERS@ and pushes to the AUR. Repacks the released .deb (built by the desktop repo's
    
      5# GitLab CI and published to tinspec.dev); only the *latest* version's source URL resolves — the
    
      6# site prunes older artifacts on publish.
    
      7pkgname=tinspec-bin
    
      8pkgver=0.1.0preview.1
    
      9pkgrel=1
    
      10pkgdesc="Request-testing tool for backend developers — spec-driven endpoints, request chains, automated auth"
    
      11arch=('x86_64')
    
      12url="https://tinspec.dev"
    
      13license=('AGPL-3.0-only')
    
      14# The Arch closure of the .deb's Depends (webkit2gtk-4.1 + gtk3 and their usual companions).
    
      15# update-aur.sh prints the .deb's actual Depends on every run — reconcile if it changes.
    
      16depends=('webkit2gtk-4.1' 'gtk3' 'cairo' 'gdk-pixbuf2' 'glib2' 'hicolor-icon-theme' 'libsoup3' 'openssl')
    
      17optdepends=('xdg-desktop-portal-gtk: native file/folder pickers'
    
      18            'org.freedesktop.secrets: store auth secrets in the system keyring')
    
      19provides=('tinspec')
    
      20conflicts=('tinspec')
    
      21options=('!strip' '!debug')
    
      22_upver=0.1.0-preview.1
    
      23source=("https://tinspec.dev/releases/Tinspec_${_upver}_amd64.deb")
    
      24sha256sums=('02384145cfb136b16fd76f6ecde1d581ad789ac19e317693fdc8640d19850f9f')
    
      25
    
      26package() {
    
      27  # The .deb is an ar archive whose payload is data.tar.{gz,xz,zst} — unpack it straight into
    
      28  # $pkgdir (it already carries usr/bin, icons, and the .desktop file). Updates flow through
    
      29  # pacman; the app detects newer releases but is notify-only for this install (no self-update).
    
      30  local data
    
      31  data=$(bsdtar -tf "$srcdir/Tinspec_${_upver}_amd64.deb" | grep '^data.tar')
    
      32  bsdtar -xOf "$srcdir/Tinspec_${_upver}_amd64.deb" "$data" | bsdtar -xf - -C "$pkgdir"
    
      33}
    
      34

Changes since previous scan

--- PKGBUILD @ 2026-07-17 00:06
+++ PKGBUILD @ 2026-08-03 00:08
@@ -5,7 +5,7 @@
 # GitLab CI and published to tinspec.dev); only the *latest* version's source URL resolves — the
 # site prunes older artifacts on publish.
 pkgname=tinspec-bin
-pkgver=0.1.0beta.12
+pkgver=0.1.0preview.1
 pkgrel=1
 pkgdesc="Request-testing tool for backend developers — spec-driven endpoints, request chains, automated auth"
 arch=('x86_64')
@@ -19,9 +19,9 @@
 provides=('tinspec')
 conflicts=('tinspec')
 options=('!strip' '!debug')
-_upver=0.1.0-beta.12
+_upver=0.1.0-preview.1
 source=("https://tinspec.dev/releases/Tinspec_${_upver}_amd64.deb")
-sha256sums=('5e26ee900f9171d927f8639cbff2be026eef6759a4d11f0dc8cdaaf405612a78')
+sha256sums=('02384145cfb136b16fd76f6ecde1d581ad789ac19e317693fdc8640d19850f9f')
 
 package() {
   # The .deb is an ar archive whose payload is data.tar.{gz,xz,zst} — unpack it straight into

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 00:29:32	MEDIUM	3
2026-07-21 00:24:15	MEDIUM	3
2026-07-20 00:19:49	MEDIUM	3
2026-07-19 00:17:08	MEDIUM	3
2026-07-18 00:14:48	MEDIUM	3
2026-07-17 23:55:59	MEDIUM	3
2026-07-17 00:06:16	MEDIUM	3
2026-07-16 00:05:41	MEDIUM	3