utopia

maintainer danvj · 3 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary .deb from update.u.is (the vendor's own update server for the Utopia P2P ecosystem product), extracts it, and installs the compiled binaries directly into /opt and /usr/bin. The domain u.is/update.u.is is the official distribution host for the Utopia project (not a random personal host), so this is analogous to many other AUR packages that pull vendor-supplied .deb files. However, the source URL uses a 'latest' floating filename (utopia-latest.amd64.deb) rather than a versioned artifact, meaning the sha256sum could become stale if the file is silently updated upstream — though a sha256sum is present, which provides some protection at build time. The core concern is that a closed-source binary blob is being installed from a vendor update server with no source code available for audit, which is a legitimate medium-severity supply-chain concern (executed binary from a non-mainstream vendor). This is not clearly malicious but represents real risk if the vendor's update infrastructure were compromised or if the vendor itself is untrustworthy. The 'Anti Orwellian Ecosystem' branding and closed-source nature add to the opacity. Rating remains medium.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=(https://update.u.is/downloads/linux/utopia-latest.amd64.deb)

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from update.u.is (the vendor's own update server for the Utopia P2P ecosystem product), extracts it, and installs the compiled binaries directly into /opt and /usr/bin. The domain u.is/update.u.is is the official distribution host for the Utopia project (not a random personal host), so this is analogous to many other AUR packages that pull vendor-supplied .deb files. However, the source URL uses a 'latest' floating filename (utopia-latest.amd64.deb) rather than a versioned artifact, meaning the sha256sum could become stale if the file is silently updated upstream — though a sha256sum is present, which provides some protection at build time. The core concern is that a closed-source binary blob is being installed from a vendor update server with no source code available for audit, which is a legitimate medium-severity supply-chain concern (executed binary from a non-mainstream vendor). This is not clearly malicious but represents real risk if the vendor's update infrastructure were compromised or if the vendor itself is untrustworthy. The 'Anti Orwellian Ecosystem' branding and closed-source nature add to the opacity. Rating remains medium.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: albakham <contact@geber.ga>
    
      2# Co-Maintainer: danvj <geral@danvj.pt>
    
      3
    
      4pkgname=utopia
    
      5pkgver=1.3.984
    
      6pkgrel=1
    
      7pkgdesc='Client for Utopia, an "Anti Orwellian Ecosystem"'
    
      8arch=('x86_64')
    
      9url='https://u.is'
    
      10license=('other')
    
      11source=(https://update.u.is/downloads/linux/utopia-latest.amd64.deb)
    
      12depends=(libx11 libglvnd libpulse fontconfig)
    
      13optdepends=(gst-plugins-base gst-plugins-ugly gst-plugins-good gst-plugins-bad)
    
      14sha256sums=('088d1f827f3bfb9fe3ff29b8a6bee3af91faa8a60fb511451a67c701c6d345a2')
    
      15
    
      16build() {
    
      17  ar -x ${srcdir}/utopia-latest.amd64.deb
    
      18  tar -xJf ${srcdir}/data.tar.xz
    
      19}
    
      20
    
      21package() {
    
      22  install -d "${pkgdir}/opt/"
    
      23  cp -r "${srcdir}/opt/${pkgname}" "${pkgdir}/opt/"
    
      24  install -Dm644 "${srcdir}/usr/share/applications/${pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      25  install -Dm755 "${srcdir}/opt/utopia/messenger/utopia" "${pkgdir}/usr/bin/${pkgname}"
    
      26  install -Dm644 "${srcdir}/usr/share/pixmaps/${pkgname}.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
    
      27}
    
      28

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2