vcard-studio-bin

maintainer leledumbo · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary .deb from svn.zdechov.net, which is a subdomain of the same domain as the project's official URL (app.zdechov.net). This is consistent with the upstream author hosting their own release artifacts on their own infrastructure (svn subdomain likely used as a file server). However, it is still a prebuilt binary from a personal/unofficial host rather than a well-known distribution channel, and there is no GPG signature verification — only a sha256sum. The binary is extracted and installed directly into the package directory. This represents a genuine supply-chain concern: if svn.zdechov.net is compromised or the maintainer's server is taken over, a malicious binary could be distributed. The sha256sum provides some protection against in-transit tampering but not against the upstream host serving a malicious file. This is a textbook medium-severity case: executed binary from an unofficial/personal host with no cryptographic signing beyond a checksum.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("https://svn.zdechov.net/vcard-studio/bin/deb/vcard-studio_${pkgver}_amd64.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from svn.zdechov.net, which is a subdomain of the same domain as the project's official URL (app.zdechov.net). This is consistent with the upstream author hosting their own release artifacts on their own infrastructure (svn subdomain likely used as a file server). However, it is still a prebuilt binary from a personal/unofficial host rather than a well-known distribution channel, and there is no GPG signature verification — only a sha256sum. The binary is extracted and installed directly into the package directory. This represents a genuine supply-chain concern: if svn.zdechov.net is compromised or the maintainer's server is taken over, a malicious binary could be distributed. The sha256sum provides some protection against in-transit tampering but not against the upstream host serving a malicious file. This is a textbook medium-severity case: executed binary from an unofficial/personal host with no cryptographic signing beyond a checksum.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Mario Ray Mahardhika <leledumbo_cool@yahoo.co.id>
    
      2pkgname=vcard-studio-bin
    
      3pkgver=1.5.0
    
      4pkgrel=1
    
      5pkgdesc="A contact management application with support for vCard file format (.vcf)."
    
      6arch=('x86_64')
    
      7url="https://app.zdechov.net/vcard-studio"
    
      8provides=("vcard-studio=${pkgver}")
    
      9conflicts=("vcard-studio")
    
      10license=('CC0')
    
      11makedepends=()
    
      12depends=('at-spi2-core' 'glibc' 'gdk-pixbuf2' 'glib2' 'libx11' 'cairo' 'pango' 'gtk2')
    
      13source=("https://svn.zdechov.net/vcard-studio/bin/deb/vcard-studio_${pkgver}_amd64.deb")
    
      14sha256sums=('33689bdae3eedf74b29713289e5653fe55c07132bb2f862bf901ffc126c83bb1')
    
      15
    
      16prepare() {
    
      17  rm control.tar.zst
    
      18  rm debian-binary
    
      19  tar xf data.tar.zst
    
      20}
    
      21
    
      22package() {
    
      23  cp -Rfp $srcdir/usr $pkgdir/
    
      24}
    
      25

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2