universal-android-debloater-bin

MEDIUM

maintainer yochananmarqos 17 votes scanned 2026-11-02 20:03:06.122793

View on AUR

Why flagged

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

Triggered rules

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

PKGBUILD:35 install -Dm755 "$srcdir/uad-ng-noselfupdate-linux" "$pkgdir/usr/bin/uad-ng"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Mark Wagie <mark dot wagie at proton dot me>
    
      2pkgname=universal-android-debloater-bin
    
      3pkgver=1.3.1
    
      4pkgrel=1
    
      5pkgdesc="Cross-platform GUI written in Rust using ADB to debloat non-rooted Android devices."
    
      6arch=('x86_64')
    
      7url="https://github.com/Universal-Debloater-Alliance/universal-android-debloater-next-generation"
    
      8license=('GPL-3.0-or-later')
    
      9depends=(
    
      10  'android-tools'
    
      11  'libgcc'
    
      12)
    
      13provides=("${pkgname%-bin}")
    
      14conflicts=("${pkgname%-bin}")
    
      15source=("uad-cli-$pkgver-linux.tar.gz::$url/releases/download/v$pkgver/uad-cli-linux.tar.gz"
    
      16        "uad-cli-$pkgver-linux-checksum::$url/releases/download/v$pkgver/uad-cli-linux-checksum"
    
      17        "uad-ng-$pkgver-noselfupdate-linux.tar.gz::$url/releases/download/v$pkgver/uad-ng-noselfupdate-linux.tar.gz"
    
      18        "uad-ng-$pkgver-noselfupdate-linux-checksum::$url/releases/download/v$pkgver/uad-ng-noselfupdate-linux-checksum"
    
      19        "uad-ng-$pkgver.png::https://raw.githubusercontent.com/Universal-Debloater-Alliance/universal-android-debloater-next-generation/main/resources/assets/logo-dark.png"
    
      20        "uad-ng.desktop")
    
      21sha256sums=('6aa187b0679c77601cd12931c1d02aba6e12fa0c804c9a85c58a0d5808dc2766'
    
      22            'd5692b91aac7253029071b721b4e7e6f913f3b599a6c755e12587be4c90ed85f'
    
      23            'f4dd84f4bbce870e3be9a6803b8406a3685b0b7c17003de7c2ff885b610404cc'
    
      24            '77991bf72b85d958260ec6fe789f3db32d4fb273d36e200a555cc9d83bc0995a'
    
      25            '019c4df893dca5b54557c381881d7946b7a53ebf5b610cc04d61c2980c1a22ec'
    
      26            '8d5d790fffd35101af340792d081f8f75b61b1579bc8f89acab818f03f1071ea')
    
      27
    
      28prepare() {
    
      29  sha256sum -c "uad-cli-$pkgver-linux-checksum"
    
      30  sha256sum -c "uad-ng-$pkgver-noselfupdate-linux-checksum"
    
      31}
    
      32
    
      33package() {
    
      34  install -Dm755 "$srcdir/uad-cli-linux" "$pkgdir/usr/bin/uad"
    
      35  install -Dm755 "$srcdir/uad-ng-noselfupdate-linux" "$pkgdir/usr/bin/uad-ng"
    
      36  install -Dm644 "$srcdir/uad-ng-$pkgver.png" "${pkgdir}/usr/share/pixmaps/uad-ng.png"
    
      37  install -Dm644 "$srcdir/uad-ng.desktop" -t "$pkgdir/usr/share/applications/"
    
      38}
    
      39

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-11-02 20:03
@@ -1,6 +1,6 @@
 # Maintainer: Mark Wagie <mark dot wagie at proton dot me>
 pkgname=universal-android-debloater-bin
-pkgver=1.2.0
+pkgver=1.3.1
 pkgrel=1
 pkgdesc="Cross-platform GUI written in Rust using ADB to debloat non-rooted Android devices."
 arch=('x86_64')
@@ -12,20 +12,26 @@
 )
 provides=("${pkgname%-bin}")
 conflicts=("${pkgname%-bin}")
-source=("uad-ng-$pkgver-noselfupdate-linux.tar.gz::$url/releases/download/v$pkgver/uad-ng-noselfupdate-linux.tar.gz"
+source=("uad-cli-$pkgver-linux.tar.gz::$url/releases/download/v$pkgver/uad-cli-linux.tar.gz"
+        "uad-cli-$pkgver-linux-checksum::$url/releases/download/v$pkgver/uad-cli-linux-checksum"
+        "uad-ng-$pkgver-noselfupdate-linux.tar.gz::$url/releases/download/v$pkgver/uad-ng-noselfupdate-linux.tar.gz"
         "uad-ng-$pkgver-noselfupdate-linux-checksum::$url/releases/download/v$pkgver/uad-ng-noselfupdate-linux-checksum"
         "uad-ng-$pkgver.png::https://raw.githubusercontent.com/Universal-Debloater-Alliance/universal-android-debloater-next-generation/main/resources/assets/logo-dark.png"
         "uad-ng.desktop")
-sha256sums=('980273195eb39ae43c776159252d67be0a5eea31faf88b600c2f9218cb099314'
-            '7793a2dab004dfd792ba47616413cd77b975d889ecf71a411e6bdf017f8476b7'
+sha256sums=('6aa187b0679c77601cd12931c1d02aba6e12fa0c804c9a85c58a0d5808dc2766'
+            'd5692b91aac7253029071b721b4e7e6f913f3b599a6c755e12587be4c90ed85f'
+            'f4dd84f4bbce870e3be9a6803b8406a3685b0b7c17003de7c2ff885b610404cc'
+            '77991bf72b85d958260ec6fe789f3db32d4fb273d36e200a555cc9d83bc0995a'
             '019c4df893dca5b54557c381881d7946b7a53ebf5b610cc04d61c2980c1a22ec'
             '8d5d790fffd35101af340792d081f8f75b61b1579bc8f89acab818f03f1071ea')
 
 prepare() {
+  sha256sum -c "uad-cli-$pkgver-linux-checksum"
   sha256sum -c "uad-ng-$pkgver-noselfupdate-linux-checksum"
 }
 
 package() {
+  install -Dm755 "$srcdir/uad-cli-linux" "$pkgdir/usr/bin/uad"
   install -Dm755 "$srcdir/uad-ng-noselfupdate-linux" "$pkgdir/usr/bin/uad-ng"
   install -Dm644 "$srcdir/uad-ng-$pkgver.png" "${pkgdir}/usr/share/pixmaps/uad-ng.png"
   install -Dm644 "$srcdir/uad-ng.desktop" -t "$pkgdir/usr/share/applications/"

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-02 20:03:06	Medium	1
2026-06-18 16:11:54	Clean	0