wahay-bin

maintainer orphaned · 4 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary named 'wahay-latest' directly from wahay.org and installs it as an executable. While wahay.org appears to be the official project website, this is still a supply-chain concern: (1) the binary is a prebuilt executable with no source build, (2) the URL is 'wahay-latest' — a mutable/rolling filename rather than a versioned release artifact, meaning the sha256sum is the only integrity check and it could silently drift if the maintainer updates the file without bumping the PKGBUILD, (3) there is no GPG signature verification, and (4) the host is not a well-known, audited distribution channel (like GitHub releases). The combination of a mutable URL pointing to an executed binary from a small project's own hosting infrastructure represents a genuine, if moderate, supply-chain risk. The cheaper model's MEDIUM rating is correct here.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source_x86_64=("https://wahay.org/downloads/wahay-latest")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 85%): The PKGBUILD downloads a prebuilt binary named 'wahay-latest' directly from wahay.org and installs it as an executable. While wahay.org appears to be the official project website, this is still a supply-chain concern: (1) the binary is a prebuilt executable with no source build, (2) the URL is 'wahay-latest' — a mutable/rolling filename rather than a versioned release artifact, meaning the sha256sum is the only integrity check and it could silently drift if the maintainer updates the file without bumping the PKGBUILD, (3) there is no GPG signature verification, and (4) the host is not a well-known, audited distribution channel (like GitHub releases). The combination of a mutable URL pointing to an executed binary from a small project's own hosting infrastructure represents a genuine, if moderate, supply-chain risk. The cheaper model's MEDIUM rating is correct here.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Łaurent ʘ❢Ŧ Ŧough <laurent dot fough at gmail dot com>
    
      2
    
      3pkgname=wahay-bin
    
      4_pkgname=wahay
    
      5pkgver=6be34ec
    
      6_buildid=202007132259.6be34ec
    
      7pkgrel=1
    
      8pkgdesc="Wahay - Host and Participate in voice conference calls (uses Tor & Mumble)"
    
      9arch=('x86_64')
    
      10url="https://wahay.org"
    
      11license=('GPL3')
    
      12provides=('wahay')
    
      13depends=('gtk3' 'mumble' 'tor' 'torsocks' 'xclip')
    
      14optdepends=('torsocks-git')
    
      15conflicts=('wahay' 'wahay-bin')
    
      16
    
      17source_x86_64=("https://wahay.org/downloads/wahay-latest")
    
      18sha256sums_x86_64=('61441bb4c5d08e56302074f0e6b46d0c83e568ffc45cf46c0635cbf6b96e8ba3')
    
      19
    
      20package () {
    
      21  install -Dm 775 "${_pkgname}-latest" "${pkgdir}/usr/bin/${_pkgname}"
    
      22}
    
      23

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2