websitino-bin

maintainer lapsus · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary from a GitHub Pages host (trikko.github.io) rather than from a tagged GitHub release asset. While the sha256sum provides integrity verification for the specific binary fetched, GitHub Pages content can be updated at any time by the repository owner without changing the URL, meaning the checksum is the only guard against substitution. More concerning: the `latestver()` function downloads the same binary, marks it executable, and runs it (`"$tmp" --version`) purely to extract a version string — this is arbitrary code execution of an unverified binary during what appears to be a version-check helper. Additionally, the `package()` function fetches the LICENSE file at install time via a second `curl` call with no integrity check, which is a minor additional concern. The binary itself is not built from source and originates from a personal GitHub Pages domain rather than a versioned release artifact. These factors together constitute a genuine supply-chain concern: a prebuilt binary from an unofficial/personal host is installed directly, and the version-check helper executes it without prior checksum verification.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 curl -fsSL 'https://trikko.github.io/websitino/linux/websitino' -o "$tmp" || return 1

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): This PKGBUILD downloads a prebuilt binary from a GitHub Pages host (trikko.github.io) rather than from a tagged GitHub release asset. While the sha256sum provides integrity verification for the specific binary fetched, GitHub Pages content can be updated at any time by the repository owner without changing the URL, meaning the checksum is the only guard against substitution. More concerning: the `latestver()` function downloads the same binary, marks it executable, and runs it (`"$tmp" --version`) purely to extract a version string — this is arbitrary code execution of an unverified binary during what appears to be a version-check helper. Additionally, the `package()` function fetches the LICENSE file at install time via a second `curl` call with no integrity check, which is a minor additional concern. The binary itself is not built from source and originates from a personal GitHub Pages domain rather than a versioned release artifact. These factors together constitute a genuine supply-chain concern: a prebuilt binary from an unofficial/personal host is installed directly, and the version-check helper executes it without prior checksum verification.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Yakov Till <yakov.till@gmail.com>
    
      2
    
      3pkgname=websitino-bin
    
      4pkgver=0.2.9
    
      5pkgrel=1
    
      6pkgdesc="A lightweight static file server for local development"
    
      7arch=('x86_64')
    
      8url="https://github.com/trikko/websitino"
    
      9license=('MIT')
    
      10provides=('websitino')
    
      11conflicts=('websitino')
    
      12options=('!strip' '!debug')
    
      13
    
      14latestver() {
    
      15  local tmp
    
      16  tmp=$(mktemp) || return 1
    
      17  trap 'rm -f "$tmp"' RETURN
    
      18  curl -fsSL 'https://trikko.github.io/websitino/linux/websitino' -o "$tmp" || return 1
    
      19  chmod +x "$tmp" || return 1
    
      20  "$tmp" --version | sed -nE 's/.*\(v([0-9]+\.[0-9]+\.[0-9]+)\).*/\1/p'
    
      21}
    
      22
    
      23source=("websitino-${pkgver}::https://trikko.github.io/websitino/linux/websitino")
    
      24sha256sums=('514616b1414b7eaa94ff5275f3a62b9921b5382e145d8bbc457bbd3dc0649d7c')
    
      25
    
      26prepare() {
    
      27  chmod +x "${srcdir}/websitino-${pkgver}"
    
      28}
    
      29
    
      30package() {
    
      31  # Create directories
    
      32  install -dm755 "${pkgdir}/usr/bin"
    
      33  install -dm755 "${pkgdir}/usr/share/licenses/${pkgname}"
    
      34  
    
      35  # Install binary
    
      36  install -Dm755 "${srcdir}/websitino-${pkgver}" "${pkgdir}/usr/bin/websitino"
    
      37  
    
      38  # Install license
    
      39  curl -s "https://raw.githubusercontent.com/trikko/websitino/main/LICENSE" > "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      40}
    
      41

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2