tmetric-desktop

maintainer coredotbin · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary .deb from static.tmetric.com, which is the official TMetric vendor's static asset host (tmetric.com is the product's own domain). The sha256 checksum is pinned, which mitigates casual tampering. However, the package installs a prebuilt, closed-source Electron/desktop binary directly from the vendor's CDN rather than building from source, which is a standard supply-chain concern for AUR packages of this type. The host is the official vendor subdomain (not a personal or third-party host), so this is a legitimate vendor binary distribution pattern common in AUR. The risk is real but typical for proprietary desktop app packages: if the vendor's CDN is compromised or the binary is malicious, it executes on the user's system. This is a genuine medium-severity supply-chain concern (executed binary from a non-open-source vendor host), not a false positive, but also not an active attack.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source_x86_64=('https://static.tmetric.com/desktop/tmetric_desktop_20.2.4_amd64.deb')

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from static.tmetric.com, which is the official TMetric vendor's static asset host (tmetric.com is the product's own domain). The sha256 checksum is pinned, which mitigates casual tampering. However, the package installs a prebuilt, closed-source Electron/desktop binary directly from the vendor's CDN rather than building from source, which is a standard supply-chain concern for AUR packages of this type. The host is the official vendor subdomain (not a personal or third-party host), so this is a legitimate vendor binary distribution pattern common in AUR. The risk is real but typical for proprietary desktop app packages: if the vendor's CDN is compromised or the binary is malicious, it executes on the user's system. This is a genuine medium-severity supply-chain concern (executed binary from a non-open-source vendor host), not a false positive, but also not an active attack.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Corbin Bartsch <corbin.bartsch@protonmail.com>
    
      2# Contributor: Rowan Decker <rdecker@scu.edu>
    
      3
    
      4pkgname=tmetric-desktop
    
      5pkgver=20.2.4
    
      6pkgrel=1
    
      7pkgdesc="Simple time tracking software for teams of any size. Track tasks from multiple project management systems with one click."
    
      8arch=('x86_64')
    
      9url="https://tmetric.com"
    
      10license=('GPL')
    
      11groups=('')
    
      12depends=('gnome-themes-standard' 'libappindicator-gtk2')
    
      13provides=('tmetric')
    
      14conflicts=('tmetric')
    
      15options=('!strip' '!emptydirs')
    
      16install=${pkgname}.install
    
      17source_x86_64=('https://static.tmetric.com/desktop/tmetric_desktop_20.2.4_amd64.deb')
    
      18sha256sums_x86_64=('106579fb9467ec13b681d4a8ea24d447dc2c2206dde5aa9e3c6c4c7896d2d91e')
    
      19
    
      20package(){
    
      21	# Extract package data
    
      22	tar xf data.tar.xz -C "${pkgdir}"
    
      23
    
      24	install -DTm755 "${pkgdir}/usr/share/tmetricdesktop/TMetricDesktop" "${pkgdir}/usr/bin/${pkgname}"
    
      25}
    
      26

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2