wikitaxi

maintainer sunflsks · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged WikiTaxi is a Windows application distributed by its author at yunqa.de (Ralf Junker's personal/commercial Delphi site). The package downloads a prebuilt Windows binary ZIP from this host and runs it under Wine. yunqa.de is the actual upstream vendor site for WikiTaxi, not a random third-party mirror, so this is not an unofficial redistribution — it is the canonical download location. However, the concern remains that this is a prebuilt, closed-source Windows executable (Delphi-compiled) from a personal/small-vendor host with no independent verification beyond the provided checksums. The checksums are present and cover all sources, which mitigates substitution risk somewhat. The license is listed as 'unknown', which is a red flag for a proprietary binary. Since this is an executed binary (run via Wine) from a non-major-vendor host with no source code available, the medium rating is appropriate — it is not clearly malicious but represents a real supply-chain concern: if yunqa.de is compromised or the maintainer updates the checksums to match a trojaned binary, arbitrary code execution results. This is a genuine medium-severity concern, not a false positive.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:7 source=("https://www.yunqa.de/delphi/downloads/WikiTaxi_$pkgver.zip" "wikitaxi" "wikitaxi_importer" "wikitaxi.desktop" "wikitaxi.png" "LICENSE")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): WikiTaxi is a Windows application distributed by its author at yunqa.de (Ralf Junker's personal/commercial Delphi site). The package downloads a prebuilt Windows binary ZIP from this host and runs it under Wine. yunqa.de is the actual upstream vendor site for WikiTaxi, not a random third-party mirror, so this is not an unofficial redistribution — it is the canonical download location. However, the concern remains that this is a prebuilt, closed-source Windows executable (Delphi-compiled) from a personal/small-vendor host with no independent verification beyond the provided checksums. The checksums are present and cover all sources, which mitigates substitution risk somewhat. The license is listed as 'unknown', which is a red flag for a proprietary binary. Since this is an executed binary (run via Wine) from a non-major-vendor host with no source code available, the medium rating is appropriate — it is not clearly malicious but represents a real supply-chain concern: if yunqa.de is compromised or the maintainer updates the checksums to match a trojaned binary, arbitrary code execution results. This is a genuine medium-severity concern, not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=wikitaxi
    
      2pkgver=1.3.0
    
      3pkgrel=3
    
      4pkgdesc="browse MediaWiki files offline"
    
      5arch=('x86_64')
    
      6license=('unknown')
    
      7source=("https://www.yunqa.de/delphi/downloads/WikiTaxi_$pkgver.zip" "wikitaxi" "wikitaxi_importer" "wikitaxi.desktop" "wikitaxi.png" "LICENSE")
    
      8options=(!strip)
    
      9depends=('wine')
    
      10sha512sums=('985d613606e87a59a4ac170ee923a559c31a0ff0a478935f1a98655ce3658977bce49b864d0ac801ab01c63459c389a24274b4eb060761d0ec0e89d57525bba3'
    
      11            '5bb0312acdf0908e08046b4518ce8423e1bf07a98589f79e2e6354467bdb39df37e08306bd9e918faa926081db2bb0eafee175cd3f18f94ee2458905a46704c5'
    
      12            '93ac8f15d927e5f53c50e1ef6cec0cadfd19701d71a4ac219d3526afa00f124ea822a5b1b0c3e1958a663a7fb8d23488222918bc1a488c1f244907dec392510a'
    
      13            'ff7232ffcd436aab435c2ce3691473ae2a701cc11ddc1c2269b10338af0c79f22b9cd46b9d40d6ff9ad8d4c5f75b2ef34a158aab34d52f4100d5f1e9e2e28767'
    
      14            'd8becbce1507714b489d5cd3323fd526ff334efd845803a24bf92ec95ac00c11b37ce8c5f9fec999dc1935a93ade29e5e2ebebec08294152900fde50d91f5218'
    
      15            '32131ec8be4d5dcf845378981132954b5d2592d7b3e172690c9f22de3e1fbe9ac368cf345dad1ea44765e9de14f64a269dbf50091a53fcb5c521cb6f05f124bd')
    
      16package() {
    
      17	mkdir -p "$pkgdir"/usr/share/"$pkgname" "$pkgdir"/usr/bin
    
      18
    
      19	cp -ra "$srcdir"/* "$pkgdir"/usr/share/"$pkgname"
    
      20
    
      21	find "$pkgdir"/usr/share/"$pkgname" -type f -exec chmod -R 755 "{}" +
    
      22	find "$pkgdir"/usr/share/"$pkgname" -type l -delete
    
      23
    
      24	install -Dm755 "$pkgname" "$pkgname"_importer "$pkgdir"/usr/bin
    
      25	install -Dm644 "$pkgname.png" "$pkgdir"/usr/share/icons/"$pkgname.png"
    
      26	install -Dm644 "$pkgname.desktop" "$pkgdir"/usr/share/applications/"$pkgname.desktop"
    
      27	install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      28}	
    
      29

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2