wox-git

maintainer witt.9099 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt Flutter SDK tarball from Google's official storage infrastructure (storage.googleapis.com/flutter_infra_release) with a SKIP'd checksum. While the host is Google's official Flutter release CDN (not a personal or unofficial host), skipping the checksum means the tarball cannot be verified for integrity or authenticity, creating a real supply-chain risk for an executed build toolchain component. Additionally, `dart pub global activate flutter_distributor` pulls a Dart package from pub.dev at build time without pinning or verification, and `pip install --upgrade pip` runs in a venv. The Flutter SDK itself is official, but the combination of SKIP'd checksums on a binary SDK plus unpinned pub.dev package activation represents a genuine medium-severity supply-chain concern: a compromised or substituted Flutter tarball or flutter_distributor package would execute arbitrary code during the build. This is not a false positive — the risk is real even though the host is legitimate, because the missing checksum removes the only integrity guarantee.

Triggered rules

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:40 pip install --upgrade pip

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_3.19.4-stable.tar.xz"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 75%): The PKGBUILD downloads a prebuilt Flutter SDK tarball from Google's official storage infrastructure (storage.googleapis.com/flutter_infra_release) with a SKIP'd checksum. While the host is Google's official Flutter release CDN (not a personal or unofficial host), skipping the checksum means the tarball cannot be verified for integrity or authenticity, creating a real supply-chain risk for an executed build toolchain component. Additionally, `dart pub global activate flutter_distributor` pulls a Dart package from pub.dev at build time without pinning or verification, and `pip install --upgrade pip` runs in a venv. The Flutter SDK itself is official, but the combination of SKIP'd checksums on a binary SDK plus unpinned pub.dev package activation represents a genuine medium-severity supply-chain concern: a compromised or substituted Flutter tarball or flutter_distributor package would execute arbitrary code during the build. This is not a false positive — the risk is real even though the host is legitimate, because the missing checksum removes the only integrity guarantee.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: irmluity <45vw4yz8g@mozmail.com>
    
      2
    
      3_pkgname=wox
    
      4pkgname=$_pkgname-git
    
      5pkgver=2.0.0_nightly
    
      6pkgrel=1
    
      7pkgdesc="A cross-platform launcher that simply works"
    
      8arch=(x86_64)
    
      9url='https://github.com/Wox-launcher/Wox'
    
      10license=('GPL3')
    
      11depends=('webkit2gtk' 'libayatana-indicator' 'glibc' 'libx11' 'libxtst' 'pango' 'ayatana-ido' 'at-spi2-core' 'glib2' 'cairo' 'harfbuzz' 'gdk-pixbuf2' 'libayatana-appindicator' 'zlib' 'gtk3' 'libdbusmenu-glib' 'libkeybinder3')
    
      12makedepends=('git' 'go' 'just' 'nodejs' 'pnpm' 'python' 'cargo' 'libsoup' 'python-loguru' 'python-websockets' 'upx' 'lefthook' 'python-pip' 'cmake' 'ninja' 'clang')
    
      13provides=(${_pkgname})
    
      14options=(!strip)
    
      15conflicts=(${_pkgname}-bin ${_pkgname})
    
      16source=(
    
      17    "git+https://github.com/Wox-launcher/Wox.git"
    
      18    "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_3.19.4-stable.tar.xz"
    
      19)
    
      20sha256sums=(
    
      21    "SKIP"
    
      22    "SKIP"
    
      23)
    
      24
    
      25pkgver() {
    
      26    cd "$srcdir/Wox"
    
      27    printf "%s" "$(git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g' | sed 's/^v//')"
    
      28}
    
      29
    
      30prepare() {
    
      31    cd "${srcdir}"
    
      32    export PATH="$PATH:${srcdir}/flutter/bin"
    
      33    dart pub global activate flutter_distributor
    
      34    export PATH="$PATH":"$HOME/.pub-cache/bin"
    
      35    export CHANNEL=prod
    
      36    flutter config --no-analytics
    
      37    flutter config --enable-linux-desktop
    
      38    python -m venv .venv
    
      39    source .venv/bin/activate
    
      40    pip install --upgrade pip
    
      41}
    
      42
    
      43build() {
    
      44    cd "${srcdir}/Wox"
    
      45    just release linux
    
      46}
    
      47
    
      48package() {
    
      49    install -Dm755 "${srcdir}/Wox/Release/wox-linux-amd64" "${pkgdir}/usr/bin/${_pkgname}"
    
      50}
    
      51

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 00:29:32	MEDIUM	3
2026-07-21 00:24:15	MEDIUM	3
2026-07-20 00:19:49	MEDIUM	3
2026-07-19 00:17:08	MEDIUM	3
2026-07-18 00:14:48	MEDIUM	3
2026-07-17 00:06:16	MEDIUM	3
2026-07-16 00:05:41	MEDIUM	3
2026-07-15 00:09:25	MEDIUM	3