trancado-bin

MEDIUM

maintainer Bah 0 votes scanned 2026-09-25 19:15:26.209044

View on AUR

Why flagged

A prebuilt binary is downloaded from downloads.trancado.net, a personal/project-owned domain that is not an established forge or vendor infrastructure, making it trivially swappable; while a sha256sum is provided, the binary itself is unverifiable and installs a password manager application with baked-in OAuth credentials, making supply-chain substitution particularly impactful.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:36 source=("https://downloads.trancado.net/trancado_v${pkgver}_amd64.tar.gz")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 75%): A prebuilt binary is downloaded from downloads.trancado.net, a personal/project-owned domain that is not an established forge or vendor infrastructure, making it trivially swappable; while a sha256sum is provided, the binary itself is unverifiable and installs a password manager application with baked-in OAuth credentials, making supply-chain substitution particularly impactful.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Trancado <maintainers@trancado.net>
    
      2# Contributor: Trancado <maintainers@trancado.net>
    
      3#
    
      4# NOTE TO MAINTAINERS / CI:
    
      5# - Bump `_pkgver` when a new release is tagged (e.g. tag v0.5.1 -> _pkgver=0.5.1).
    
      6#   The release pipeline in .gitlab-ci.yml publishes
    
      7#   `trancado_v${pkgver}_amd64.tar.gz` to downloads.trancado.net (R2 bucket
    
      8#   trancado-releases). Keep the URL in `source=` in sync with the CI upload
    
      9#   step (`trancado_v${VERSION}_amd64.tar.gz` where VERSION comes from
    
      10#   `git describe --tags --abbrev=0`, e.g. v0.5.1).
    
      11# - Keep `sha256sums` in sync with the published tarball: whenever the
    
      12#   tarball changes (a new release bumping `_pkgver`, or a content change such
    
      13#   as a LICENSE file being added), re-verify and update the hash with
    
      14#   `sha256sum trancado_${pkgver}_amd64.tar.gz`.
    
      15# - LICENSE install is CONDITIONAL: package() installs
    
      16#   usr/share/licenses/trancado-bin/LICENSE only if the release tarball
    
      17#   contains it. CI adds the LICENSE file to the tarball once the project
    
      18#   publishes one (BUG-001 pending user-provided LICENSE file — the repo has
    
      19#   no LICENSE today and the package must build without it).
    
      20#
    
      21# SECURITY: This file must NEVER contain real secrets. The Google OAuth client
    
      22# ID/secret are baked into the binary at CI build time via the
    
      23# GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET env vars (GitLab CI/CD variables),
    
      24# not committed anywhere.
    
      25
    
      26pkgname=trancado-bin
    
      27_pkgver=0.7.9
    
      28pkgver=${_pkgver}
    
      29pkgrel=1
    
      30pkgdesc="Trancado password manager — pre-built desktop application"
    
      31arch=('x86_64')
    
      32url="https://trancado.net"
    
      33license=('custom')
    
      34# librsvg: pulled in transitively by webkit2gtk-4.1; listed explicitly per -bin convention
    
      35depends=('webkit2gtk-4.1' 'gtk3' 'libsecret' 'libsoup3' 'librsvg')
    
      36source=("https://downloads.trancado.net/trancado_v${pkgver}_amd64.tar.gz")
    
      37# sha256sum of the published v0.7.9 tarball (verified against the file
    
      38# downloaded from downloads.trancado.net). IMPORTANT: update this whenever the
    
      39# tarball changes — a new release (bump `_pkgver` above) or a content change
    
      40# produces a new hash.
    
      41sha256sums=('7cd08b07d3a4f1a4b22971d0e027688000a860dfdfe76ec5003ae6227a521ece')
    
      42
    
      43package() {
    
      44  # Tarball layout produced by the release pipeline (CI):
    
      45  #   usr/bin/trancado
    
      46  #   usr/share/applications/trancado.desktop
    
      47  #   usr/share/icons/hicolor/512x512/apps/trancado.png
    
      48  install -Dm755 "$srcdir/usr/bin/trancado" "$pkgdir/usr/bin/trancado"
    
      49  install -Dm644 "$srcdir/usr/share/applications/trancado.desktop" \
    
      50    "$pkgdir/usr/share/applications/trancado.desktop"
    
      51  install -Dm644 "$srcdir/usr/share/icons/hicolor/512x512/apps/trancado.png" \
    
      52    "$pkgdir/usr/share/icons/hicolor/512x512/apps/trancado.png"
    
      53
    
      54  # Install license if present in the tarball (LICENSE ships in the release
    
      55  # tarball since BUG-001 was resolved; conditional install keeps the package
    
      56  # buildable either way)
    
      57  if [ -f "$srcdir/usr/share/licenses/trancado-bin/LICENSE" ]; then
    
      58    install -Dm644 "$srcdir/usr/share/licenses/trancado-bin/LICENSE" \
    
      59      "$pkgdir/usr/share/licenses/trancado-bin/LICENSE"
    
      60  fi
    
      61}
    
      62

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-25 19:15:26	Medium	3
2026-09-25 19:13:08	Medium	2