uam

maintainer danvj · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary .deb from update.u.is (a subdomain of u.is, the project's own domain) and installs it directly into /opt. Several concerns: (1) The source URL uses 'uam-latest_amd64.deb' — the 'latest' in the filename means the actual binary downloaded at build time may not correspond to the pinned pkgver=1.3.789, making the sha256sum check potentially unreliable if the file is updated server-side without changing the URL. (2) Prebuilt closed-source binary ('license=Unknown') installed from a vendor update server with no source build — this is a classic supply-chain risk pattern. (3) The prepare() function extracts data.tar.xz without first extracting the .deb itself (ar x), which suggests the PKGBUILD may be broken or relies on implicit behavior. Despite update.u.is being the project's own subdomain, the 'latest' URL pattern undermines the integrity guarantee of the checksum, and the package installs an opaque prebuilt binary. This is a genuine medium-severity supply-chain concern.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:10 source=("$pkgname-$pkgver.deb::https://update.u.is/downloads/uam/linux/uam-latest_amd64.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): This PKGBUILD downloads a prebuilt binary .deb from update.u.is (a subdomain of u.is, the project's own domain) and installs it directly into /opt. Several concerns: (1) The source URL uses 'uam-latest_amd64.deb' — the 'latest' in the filename means the actual binary downloaded at build time may not correspond to the pinned pkgver=1.3.789, making the sha256sum check potentially unreliable if the file is updated server-side without changing the URL. (2) Prebuilt closed-source binary ('license=Unknown') installed from a vendor update server with no source build — this is a classic supply-chain risk pattern. (3) The prepare() function extracts data.tar.xz without first extracting the .deb itself (ar x), which suggests the PKGBUILD may be broken or relies on implicit behavior. Despite update.u.is being the project's own subdomain, the 'latest' URL pattern undermines the integrity guarantee of the checksum, and the package installs an opaque prebuilt binary. This is a genuine medium-severity supply-chain concern.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: DanVJ <geral@danvj.pt>
    
      2
    
      3pkgname=uam
    
      4pkgver=1.3.789
    
      5pkgrel=1
    
      6pkgdesc='Utopia Alternative Miner'
    
      7arch=('x86_64')
    
      8url='https://u.is'
    
      9license=('Unknown')
    
      10source=("$pkgname-$pkgver.deb::https://update.u.is/downloads/uam/linux/uam-latest_amd64.deb")
    
      11sha256sums=('8a3e1091d66963e9bfc8a9da86b0eceb78c0900a5999010aaa023aea51a6f296')
    
      12
    
      13prepare() {
    
      14  tar xJf data.tar.xz
    
      15}
    
      16
    
      17package() {
    
      18  install -d "$pkgdir"/opt \
    
      19           "$pkgdir"/usr/bin
    
      20
    
      21  cp -a "${srcdir}/opt/$pkgname" "$pkgdir/opt/"
    
      22  ln -s /opt/uam/uam "$pkgdir/usr/bin/uam"
    
      23}
    
      24

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2