whoisthat-bin

MEDIUM

maintainer kvunoff 0 votes scanned 2026-11-02 22:03:11.184944

View on AUR

Why flagged

The package installs prebuilt binaries from GitHub releases, which are not built from source, creating a supply-chain risk if the release assets are compromised.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package installs prebuilt binaries from GitHub releases, which are not built from source, creating a supply-chain risk if the release assets are compromised.

PKGBUILD

      1# Maintainer: kvunoff <kvunoff@proton.me>
    
      2pkgname=whoisthat-bin
    
      3pkgver=0.17.4
    
      4pkgrel=1
    
      5pkgdesc="Modern terminal-based VPN client with Xray-core backend (prebuilt binaries)"
    
      6arch=('x86_64' 'aarch64')
    
      7url="https://github.com/kvunoff/whoisthat"
    
      8license=('MIT')
    
      9depends=('iproute2' 'nftables' 'libcap' 'systemd')
    
      10optdepends=(
    
      11    'iptables: legacy firewall backend for TUN mode'
    
      12    'polkit: pkexec-based capability setup from the TUI'
    
      13    'xray: system Xray-core binary (managed runtime used automatically if absent)'
    
      14)
    
      15provides=('whoisthat')
    
      16conflicts=('whoisthat')
    
      17install=whoisthat-bin.install
    
      18# Prebuilt static musl binaries; do not strip or split debug symbols.
    
      19options=(!strip !debug)
    
      20source_x86_64=("whoisthat-${pkgver}-linux-amd64.tar.gz::${url}/releases/download/v${pkgver}/whoisthat-linux-amd64.tar.gz")
    
      21source_aarch64=("whoisthat-${pkgver}-linux-arm64.tar.gz::${url}/releases/download/v${pkgver}/whoisthat-linux-arm64.tar.gz")
    
      22# CI pins the checksums of the published release assets.
    
      23sha256sums_x86_64=('2dd1a44201122df8169036d22077bcb211141c37144f782528b7c7bfb1879779')
    
      24sha256sums_aarch64=('33d0beea6b47d6e330e9a353e33f2fee5fd69c347b814333af0946b8f02fef9f')
    
      25
    
      26package() {
    
      27    local src
    
      28    case "$CARCH" in
    
      29        x86_64)  src="whoisthat-${pkgver}-linux-amd64.tar.gz" ;;
    
      30        aarch64) src="whoisthat-${pkgver}-linux-arm64.tar.gz" ;;
    
      31        *) error "unsupported architecture: $CARCH"; exit 1 ;;
    
      32    esac
    
      33
    
      34    tar -xzf "${srcdir}/${src}" -C "${srcdir}"
    
      35    install -Dm755 "${srcdir}/whoisthat"                 "${pkgdir}/usr/bin/whoisthat"
    
      36    install -Dm755 "${srcdir}/whoisthat-core"            "${pkgdir}/usr/bin/whoisthat-core"
    
      37    install -Dm644 "${srcdir}/whoisthat.desktop"         "${pkgdir}/usr/share/applications/whoisthat.desktop"
    
      38    install -Dm644 "${srcdir}/LICENSE"                   "${pkgdir}/usr/share/licenses/whoisthat/LICENSE"
    
      39}
    
      40

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-02 22:03:11	Medium	2