tinspec-bin

MEDIUM

maintainer sademir 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt .deb from a non-whitelisted host (tinspec.dev), which is used as the source; if the host were compromised or the URL redirected, an attacker could silently substitute a malicious binary, posing a supply-chain risk despite the fixed checksum.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:23 source=("https://tinspec.dev/releases/Tinspec_${_upver}_amd64.deb")

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb from a non-whitelisted host (tinspec.dev), which is used as the source; if the host were compromised or the URL redirected, an attacker could silently substitute a malicious binary, posing a supply-chain risk despite the fixed checksum.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Samet Demir <dev@sademir.com>
    
      2#
    
      3# Template — do not edit the generated PKGBUILD by hand. `update-aur.sh <version>` fills the
    
      4# @PLACEHOLDERS@ and pushes to the AUR. Repacks the released .deb (built by the desktop repo's
    
      5# GitLab CI and published to tinspec.dev); only the *latest* version's source URL resolves — the
    
      6# site prunes older artifacts on publish.
    
      7pkgname=tinspec-bin
    
      8pkgver=0.1.0preview.11
    
      9pkgrel=1
    
      10pkgdesc="Request-testing tool for backend developers — spec-driven endpoints, request chains, automated auth"
    
      11arch=('x86_64')
    
      12url="https://tinspec.dev"
    
      13license=('AGPL-3.0-only')
    
      14# The Arch closure of the .deb's Depends (webkit2gtk-4.1 + gtk3 and their usual companions).
    
      15# update-aur.sh prints the .deb's actual Depends on every run — reconcile if it changes.
    
      16depends=('webkit2gtk-4.1' 'gtk3' 'cairo' 'gdk-pixbuf2' 'glib2' 'hicolor-icon-theme' 'libsoup3' 'openssl')
    
      17optdepends=('xdg-desktop-portal-gtk: native file/folder pickers'
    
      18            'org.freedesktop.secrets: store auth secrets in the system keyring')
    
      19provides=('tinspec')
    
      20conflicts=('tinspec')
    
      21options=('!strip' '!debug')
    
      22_upver=0.1.0-preview.11
    
      23source=("https://tinspec.dev/releases/Tinspec_${_upver}_amd64.deb")
    
      24sha256sums=('ad3a28f353dcb5d344f70bbfc03541f8414c10f4bdef36c78e784a12c704d272')
    
      25
    
      26package() {
    
      27  # The .deb is an ar archive whose payload is data.tar.{gz,xz,zst} — unpack it straight into
    
      28  # $pkgdir (it already carries usr/bin, icons, and the .desktop file). Updates flow through
    
      29  # pacman; the app detects newer releases but is notify-only for this install (no self-update).
    
      30  local data
    
      31  data=$(bsdtar -tf "$srcdir/Tinspec_${_upver}_amd64.deb" | grep '^data.tar')
    
      32  bsdtar -xOf "$srcdir/Tinspec_${_upver}_amd64.deb" "$data" | bsdtar -xf - -C "$pkgdir"
    
      33}
    
      34

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2
2026-10-13 00:23:45	Medium	2