web2desk

maintainer Connor · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary package (.pkg.tar.zst) from concise.cc, a personal domain belonging to the maintainer, rather than from the official upstream (gitlab.com/a4to/web2desk). This is a genuine supply-chain concern: the binary is not built from source, and its provenance depends entirely on the maintainer's personal hosting infrastructure. A PGP signature is present and a validpgpkeys entry is provided, which partially mitigates the risk (the binary is signed and the signature is verified by makepkg). However, the key belongs to the maintainer themselves, so it only proves the maintainer signed it — not that it matches any official upstream release. The executable is installed to /usr/bin and additional files to /usr/share, so a compromised or malicious artifact would result in code execution. This pattern (self-hosted prebuilt binary signed with maintainer's own key, no source build) is a recognized medium-severity supply-chain risk in AUR packaging.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 "https://concise.cc/pkg/${pkgname}-${pkgver}-${pkgrel}-$arch.pkg.tar.zst"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt binary package (.pkg.tar.zst) from concise.cc, a personal domain belonging to the maintainer, rather than from the official upstream (gitlab.com/a4to/web2desk). This is a genuine supply-chain concern: the binary is not built from source, and its provenance depends entirely on the maintainer's personal hosting infrastructure. A PGP signature is present and a validpgpkeys entry is provided, which partially mitigates the risk (the binary is signed and the signature is verified by makepkg). However, the key belongs to the maintainer themselves, so it only proves the maintainer signed it — not that it matches any official upstream release. The executable is installed to /usr/bin and additional files to /usr/share, so a compromised or malicious artifact would result in code execution. This pattern (self-hosted prebuilt binary signed with maintainer's own key, no source build) is a recognized medium-severity supply-chain risk in AUR packaging.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Connor Etherington <connor@concise.cc>
    
      2# ---
    
      3pkgname=web2desk
    
      4pkgver=0.1.0
    
      5pkgrel=1
    
      6pkgdesc="A means of creating desktop applications from websites/webapps"
    
      7arch=(any)
    
      8url="https://gitlab.com/a4to/${pkgname}"
    
      9license=('MIT')
    
      10depends=()
    
      11source=(
    
      12  "https://concise.cc/pkg/${pkgname}-${pkgver}-${pkgrel}-$arch.pkg.tar.zst"
    
      13  "https://concise.cc/pkg/${pkgname}-${pkgver}-${pkgrel}-$arch.pkg.tar.zst.sig"
    
      14  )
    
      15sha512sums=(
    
      16  '1c25e219321141afe135dac1fd8d5baafc553f3519e2003055ff1567991ec7fbd3c6ed625f4efe3a0b74a1e4aa452bf71880c21a9f07d1043fe85391c8cdc39b'
    
      17  '84a79d251760fb41ffeb5f39fcf08d750f2fde22767bcf3368ca5f707134751039f845207da6a5cd15d90e46fbf0fbcc86bad6d9246637e2a0d9ee611272bdee'
    
      18  )
    
      19md5sums=(
    
      20  'e311c28f84649841196f30595cc458bf'
    
      21  '9eb8f4c180bf9e4a5e4855d5a3100a4f'
    
      22  )
    
      23validpgpkeys=('81BACEEBC3EA26E127166E4A819BB92A9A48160E')
    
      24
    
      25package() {
    
      26  cd "$srcdir/${pkgname}" 2>/dev/null || cd "$srcdir" 2>/dev/null
    
      27  install -Dm755 "usr/bin/$pkgname" "$pkgdir/usr/bin/$pkgname"
    
      28  install -Dm644 "usr/share/licenses/$pkgname/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      29  cp -r "usr/share/$pkgname" "$pkgdir/usr/share/$pkgname"
    
      30}
    
      31
    
      32

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2