ukrainealarm-client-gui-bin

maintainer sonmi-451 · 1 votes · base ukrainealarm-client-gui · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary .deb from apt.ukrainealarm.com, which is the project's own official APT repository (matching the package's stated URL ukrainealarm.com/linux-app). This is a legitimate vendor-hosted package repository, not a random personal host. However, it is still a prebuilt binary from a third-party host that is not a major, well-audited distribution channel. The sha256sum is pinned, which mitigates MITM/substitution risk at build time, but does not protect against the vendor themselves shipping malicious code. The package extracts and installs the binary directly without source build. This is a standard pattern for proprietary Linux software distributed via vendor APT repos (similar to how Chrome, Slack, etc. are packaged in AUR). The risk is real but typical for binary AUR packages from a vendor's own infrastructure — medium severity is appropriate.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:25 https://apt.ukrainealarm.com/pool/main/u/${pkgbase}/${pkgbase}_${_pkgver}_${_arch}.deb

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from apt.ukrainealarm.com, which is the project's own official APT repository (matching the package's stated URL ukrainealarm.com/linux-app). This is a legitimate vendor-hosted package repository, not a random personal host. However, it is still a prebuilt binary from a third-party host that is not a major, well-audited distribution channel. The sha256sum is pinned, which mitigates MITM/substitution risk at build time, but does not protect against the vendor themselves shipping malicious code. The package extracts and installs the binary directly without source build. This is a standard pattern for proprietary Linux software distributed via vendor APT repos (similar to how Chrome, Slack, etc. are packaged in AUR). The risk is real but typical for binary AUR packages from a vendor's own infrastructure — medium severity is appropriate.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Yevhen Hurynovych <support@stfalcon.com>
    
      2# Contributor: Alexander Hrinchuk <agrynchuk@gmail.com>
    
      3
    
      4pkgbase='ukrainealarm-client-gui'
    
      5pkgname="${pkgbase}-bin"
    
      6pkgver=0.1.1
    
      7pkgrel=0
    
      8pkgdesc="Linux client for receiving alarms in Ukraine (see https://www.ukrainealarm.com/). GUI package."
    
      9arch=('x86_64')
    
      10_arch='amd64'
    
      11_pkgver="${pkgver}-0~bullseye0"
    
      12url="https://www.ukrainealarm.com/linux-app"
    
      13license=('custom')
    
      14depends=(
    
      15    'libxext'
    
      16    'libxcb'
    
      17    'libxau'
    
      18    'libxdmcp'
    
      19    'glibc'
    
      20)
    
      21optdepends=('libpulse: A featureful, general-purpose sound server.')
    
      22provides=(${pkgbase})
    
      23conflicts=(${pkgbase})
    
      24source=(
    
      25    https://apt.ukrainealarm.com/pool/main/u/${pkgbase}/${pkgbase}_${_pkgver}_${_arch}.deb
    
      26)
    
      27sha256sums=('7a30db5beb07abf7432abc975d9e5ba97b3227daf6c431da3f07841633872f2b')
    
      28package() {
    
      29    tar xf data.tar.xz -C "${pkgdir}"
    
      30    rm -f ${pkgdir}/usr/share/doc/ukrainealarm-client-gui/changelog.Debian.gz
    
      31}
    
      32
    
      33

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2