v7_sh

maintainer severach · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The source tarball is fetched from aur.zapto.org/PRIVATE/ — a personal dynamic-DNS host (zapto.org is a no-ip/DynDNS subdomain service) rather than the upstream project host (riemann.fmi.uni-sofia.bg, which is commented out). The PRIVATE path component reinforces that this is a personal mirror with no transparency. The tarball contains compiled source that is built and installed as an executable binary, so if the host were compromised or the tarball swapped, arbitrary code would be compiled and installed. The checksums (md5 + sha256) provide some integrity guarantee against silent substitution, but md5 is weak and the host itself is not trustworthy — a motivated attacker controlling the domain could serve a matching-hash tarball only if they also control the hash values in the PKGBUILD, which they would not unless the AUR package itself were also compromised. The real concern is that the canonical upstream source is commented out and replaced with a personal host, which is a non-standard supply-chain pattern. This is a genuine medium-risk concern: executed code from an unofficial personal host, not clearly malicious but not verifiably safe either.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("http://aur.zapto.org/PRIVATE/${pkgname}.tar.gz")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The source tarball is fetched from aur.zapto.org/PRIVATE/ — a personal dynamic-DNS host (zapto.org is a no-ip/DynDNS subdomain service) rather than the upstream project host (riemann.fmi.uni-sofia.bg, which is commented out). The PRIVATE path component reinforces that this is a personal mirror with no transparency. The tarball contains compiled source that is built and installed as an executable binary, so if the host were compromised or the tarball swapped, arbitrary code would be compiled and installed. The checksums (md5 + sha256) provide some integrity guarantee against silent substitution, but md5 is weak and the host itself is not trustworthy — a motivated attacker controlling the domain could serve a matching-hash tarball only if they also control the hash values in the PKGBUILD, which they would not unless the AUR package itself were also compromised. The real concern is that the canonical upstream source is commented out and replaced with a personal host, which is a non-standard supply-chain pattern. This is a genuine medium-risk concern: executed code from an unofficial personal host, not clearly malicious but not verifiably safe either.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  Chris Severance aur.severach aATt spamgourmet dott com
    
      2# Contributor: bender02 at gmx dot com
    
      3
    
      4set -u
    
      5pkgname='v7_sh'
    
      6pkgver='0'
    
      7pkgrel='1'
    
      8pkgdesc='A port of original Steve Bourne shell from 1978'
    
      9arch=('i686' 'x86_64')
    
      10url='http://riemann.fmi.uni-sofia.bg/sh/'
    
      11license=('custom')
    
      12makedepends=('dietlibc')
    
      13#source=("http://riemann.fmi.uni-sofia.bg/sh/${pkgname}.tar.gz")
    
      14source=("http://aur.zapto.org/PRIVATE/${pkgname}.tar.gz")
    
      15md5sums=('e503e6110a95a8387421f5c938e0ce92')
    
      16sha256sums=('e096dacd4bab4b6b4eecc63f0016ff72f83739258ff0376f54775b68db728b72')
    
      17
    
      18build() {
    
      19  set -u
    
      20  cd "${srcdir}/${pkgname}"
    
      21  make CC='/opt/diet/bin/diet -Os gcc -W'
    
      22  set +u
    
      23}
    
      24
    
      25check() {
    
      26  set -u
    
      27  cd "${srcdir}/${pkgname}"
    
      28  make tests
    
      29  set +u
    
      30}
    
      31
    
      32package() {
    
      33  set -u
    
      34  cd "${srcdir}/${pkgname}"
    
      35  # need to use some other name than 'sh', since /bin/sh is already owned by bash package
    
      36  install -Dm755 'sh' "${pkgdir}/usr/bin/${pkgname}"
    
      37  install -Dm644 'NOTICE.pdf' "${pkgdir}/usr/share/licenses/${pkgname}/notice.pdf"
    
      38  set +u
    
      39}
    
      40set +u
    
      41

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2