toptracker

maintainer jamezrin · 5 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary RPM from a CloudFront CDN URL (d101nvfmxunqnl.cloudfront.net). This is the official Toptal/TopTracker distribution channel — Toptal uses CloudFront to serve their desktop app binaries, and this matches the pattern of other TopTracker AUR packages. The sha256sum is pinned, which mitigates tampering risk somewhat. However, the binary is a closed-source prebuilt executable installed into /opt and run directly on the user's system, and the CDN host is not a well-known official domain (it's an opaque CloudFront distribution ID). There is no way to verify this is actually Toptal's CDN vs. a hijacked or substituted distribution. The package also strips bundled Qt libraries and uses system Qt5, which is reasonable. Overall this is a legitimate but unverifiable prebuilt binary from a non-canonical hostname, which is a genuine medium supply-chain concern — not a false positive, but not clearly malicious either.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("https://d101nvfmxunqnl.cloudfront.net/desktop/builds/redhat/${pkgname}_${_pkgver}_x86_64.rpm"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary RPM from a CloudFront CDN URL (d101nvfmxunqnl.cloudfront.net). This is the official Toptal/TopTracker distribution channel — Toptal uses CloudFront to serve their desktop app binaries, and this matches the pattern of other TopTracker AUR packages. The sha256sum is pinned, which mitigates tampering risk somewhat. However, the binary is a closed-source prebuilt executable installed into /opt and run directly on the user's system, and the CDN host is not a well-known official domain (it's an opaque CloudFront distribution ID). There is no way to verify this is actually Toptal's CDN vs. a hijacked or substituted distribution. The package also strips bundled Qt libraries and uses system Qt5, which is reasonable. Overall this is a legitimate but unverifiable prebuilt binary from a non-canonical hostname, which is a genuine medium supply-chain concern — not a false positive, but not clearly malicious either.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jaime Martínez Rincón <jaime@jamezrin.name> https://github.com/jamezrin
    
      2# Maintainer: Fabio 'Lolix' Loli <lolix@disroot.org> -> https://github.com/FabioLolix
    
      3
    
      4pkgname=toptracker
    
      5_pkgver=1.6.2-342
    
      6pkgver=${_pkgver//-/.}
    
      7pkgrel=2.1
    
      8pkgdesc="Time tracking software for remote teams and individuals"
    
      9arch=(x86_64)
    
      10url="https://www.toptal.com/tracker/"
    
      11license=(custom:toptracker)
    
      12depends=(qt5-base qt5-svg qt5-multimedia libxss gtk3 libappindicator-gtk2)
    
      13source=("https://d101nvfmxunqnl.cloudfront.net/desktop/builds/redhat/${pkgname}_${_pkgver}_x86_64.rpm"
    
      14        'toptracker.desktop'
    
      15        'toptracker-LICENSE'
    
      16        'toptracker-launcher')
    
      17noextract=("${pkgname}_${_pkgver}_x86_64.rpm")
    
      18sha256sums=('e064e0a6cc5596eca82278f51f971fb35241b5bc71dc8ee2d7520291b392de5c'
    
      19            'e65278708e76a1e3772ccdecb1710d59a492a88ee6c3fde87296cccaec79b9cd'
    
      20            '3a12e2c5bd4c992b24320e1e2552476f21d08229417ca298cb39a2512f36162e'
    
      21            'daed1bd315d68a2755e6f13126482eef18c361306c62cb6219be6c39ee64af34')
    
      22
    
      23package() {
    
      24  install -d "${pkgdir}/usr/bin"
    
      25  install -d "${pkgdir}/opt/${pkgname}"
    
      26  install -d "${pkgdir}/usr/share/applications"
    
      27  install -d "${pkgdir}/usr/share/icons"
    
      28
    
      29  bsdtar -xf ${srcdir}/${pkgname}_${_pkgver}_x86_64.rpm -C ${pkgdir}/
    
      30  rm -r ${pkgdir}/etc/yum.repos.d
    
      31  rm ${pkgdir}/etc/cron.daily/toptracker.cron
    
      32  rm ${pkgdir}/usr/share/applications/toptracker.desktop
    
      33  unlink ${pkgdir}/usr/bin/toptracker
    
      34
    
      35  # Use system libraries
    
      36  rm -r ${pkgdir}/opt/toptracker/plugins
    
      37  rm -r ${pkgdir}/opt/toptracker/lib
    
      38  rm ${pkgdir}/opt/toptracker/bin/qt.conf
    
      39
    
      40  cp ${pkgdir}/opt/toptracker/icon.png ${pkgdir}/usr/share/icons/${pkgname}.png
    
      41  install -Dm755 ${srcdir}/${pkgname}-launcher ${pkgdir}/usr/bin/toptracker
    
      42  install -Dm755 ${srcdir}/${pkgname}.desktop ${pkgdir}/usr/share/applications
    
      43  install -Dm644 ${srcdir}/${pkgname}-LICENSE ${pkgdir}/usr/share/licenses/${pkgname}/LICENSE
    
      44}
    
      45
    
      46

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2