wifiman-desktop

maintainer yochananmarqos · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary .deb from desktop.wifiman.com, which is the official Ubiquiti/UI WifiMan desktop distribution host (Ubiquiti's product, distributed at wifiman.com). The sha256sum is pinned, which mitigates substitution attacks at rest. However, the concern is legitimate: this is a closed-source binary blob from a vendor host (not a distro mirror or GitHub release), there is no GPG signature verification, and if the host were compromised or the binary updated silently the sha256 would catch it only if the attacker also updated the PKGBUILD. The binary is executed directly on the user's system with a systemd service. This is a classic AUR binary-repackaging pattern — common and not inherently malicious, but it does represent a real supply-chain risk since users are trusting Ubiquiti's distribution infrastructure entirely. The cheaper model's MEDIUM rating is correct: it's a prebuilt executed binary from a non-standard (vendor) host with no signature verification beyond a sha256sum in the PKGBUILD itself.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:26 source=("https://desktop.wifiman.com/$pkgname-$pkgver-amd64.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt binary .deb from desktop.wifiman.com, which is the official Ubiquiti/UI WifiMan desktop distribution host (Ubiquiti's product, distributed at wifiman.com). The sha256sum is pinned, which mitigates substitution attacks at rest. However, the concern is legitimate: this is a closed-source binary blob from a vendor host (not a distro mirror or GitHub release), there is no GPG signature verification, and if the host were compromised or the binary updated silently the sha256 would catch it only if the attacker also updated the PKGBUILD. The binary is executed directly on the user's system with a systemd service. This is a classic AUR binary-repackaging pattern — common and not inherently malicious, but it does represent a real supply-chain risk since users are trusting Ubiquiti's distribution infrastructure entirely. The cheaper model's MEDIUM rating is correct: it's a prebuilt executed binary from a non-standard (vendor) host with no signature verification beyond a sha256sum in the PKGBUILD itself.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Mark Wagie <mark dot wagie at proton dot me>
    
      2pkgname=wifiman-desktop
    
      3pkgver=1.2.8
    
      4pkgrel=3
    
      5pkgdesc="Network analysis and WiFi speed testing tool by Ubiquiti"
    
      6arch=('x86_64')
    
      7url="https://ui.com"
    
      8license=('LicenseRef-unknown')
    
      9depends=(
    
      10  'bash'
    
      11  'gtk3'
    
      12  'iw'
    
      13  'libayatana-appindicator'
    
      14  'libsoup3'
    
      15  'net-tools'
    
      16  'networkmanager'
    
      17  'webkit2gtk-4.1'
    
      18  'wireless_tools'
    
      19  'systemd'
    
      20)
    
      21optdepends=(
    
      22  'resolvconf: for DNS functionality'
    
      23  'sudo: elevate privileges'
    
      24)
    
      25install="$pkgname.install"
    
      26source=("https://desktop.wifiman.com/$pkgname-$pkgver-amd64.deb")
    
      27sha256sums=('47e31bc317e7055f5571859e33534cd3c2d7d4ccfdf9fcb8afab9920bc9d964b')
    
      28
    
      29package() {
    
      30  bsdtar -xvf data.tar.gz -C "$pkgdir/"
    
      31
    
      32  install -d "$pkgdir/usr/lib/systemd/system"
    
      33  ln -s "/usr/lib/wifiman-desktop/$pkgname.service" "$pkgdir/usr/lib/systemd/system/"
    
      34}
    
      35

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2