vivlio

maintainer mJolimaitre · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary .deb from my.vivlio.com (the vendor's own download endpoint, not a personal/unofficial host) and installs it directly into the package root. Two concerns: (1) sha256sums=('SKIP') means there is zero integrity verification — any MITM or server-side substitution goes undetected; (2) the source URL is a redirect/dynamic endpoint ('linux64/deb' with no filename or version pinning), so the downloaded binary can change at any time without the PKGBUILD reflecting it. The host appears to be the official Vivlio vendor domain, which reduces but does not eliminate supply-chain risk. The combination of an executed prebuilt binary with no checksum and a floating download URL is a genuine medium-severity supply-chain concern, consistent with the cheaper model's rating.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:10 source=("vivlio.deb::https://my.vivlio.com/desktop/download/linux64/deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt binary .deb from my.vivlio.com (the vendor's own download endpoint, not a personal/unofficial host) and installs it directly into the package root. Two concerns: (1) sha256sums=('SKIP') means there is zero integrity verification — any MITM or server-side substitution goes undetected; (2) the source URL is a redirect/dynamic endpoint ('linux64/deb' with no filename or version pinning), so the downloaded binary can change at any time without the PKGBUILD reflecting it. The host appears to be the official Vivlio vendor domain, which reduces but does not eliminate supply-chain risk. The combination of an executed prebuilt binary with no checksum and a floating download URL is a genuine medium-severity supply-chain concern, consistent with the cheaper model's rating.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: JOLIMAITRE Matthieu <matthieu@imagevo.fr>
    
      2pkgname="vivlio"
    
      3pkgver=2.2.1
    
      4pkgrel=1
    
      5pkgdesc="Application Vivlio pour Mac / Windows / Linux"
    
      6url="https://app.vivlio.com"
    
      7arch=('x86_64')
    
      8license=('MIT')
    
      9depends=('gtk3' 'libnotify' 'nss' 'libxss' 'libxtst' 'xdg-utils' 'at-spi2-core' 'util-linux-libs' 'libappindicator' 'libsecret')
    
      10source=("vivlio.deb::https://my.vivlio.com/desktop/download/linux64/deb")
    
      11sha256sums=('SKIP')
    
      12
    
      13package() {
    
      14    ar x vivlio.deb
    
      15    tar -xf data.tar.xz
    
      16    cp -fr opt usr "$pkgdir/"
    
      17}
    
      18
    
      19pkgver() {
    
      20    zcat control.tar.gz | grep --text 'Version:' | cut -d ' ' -f 2 | cut -d '-' -f 1
    
      21}
    
      22

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2