writefull-bin

maintainer renedeleze · 7 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads and installs prebuilt binaries (an Electron/Chromium-based app) from an S3 bucket (s3-eu-west-1.amazonaws.com/writefull-binaries). While S3 is a legitimate hosting platform, this is the vendor's own S3 bucket rather than an official distribution channel like a vendor's own domain or a well-known package registry. The binaries are executed code installed to /opt and /usr/bin. The sha256sums are pinned, which mitigates substitution attacks at the transport layer, but S3 bucket ownership can change, be misconfigured, or be taken over. The package is also quite old (version 3.0.0-beta19), and the vendor's S3 bucket may no longer be maintained or could be repurposed. This is a classic medium-risk pattern: prebuilt proprietary binaries from a non-canonical host with checksums present but no additional verification (e.g., GPG signature). The cheaper model's assessment is correct here — this is a genuine medium supply-chain concern, not a false positive.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source_i686=("https://s3-eu-west-1.amazonaws.com/writefull-binaries/${_ver}/writefull_${_ver}_ia32.zip")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads and installs prebuilt binaries (an Electron/Chromium-based app) from an S3 bucket (s3-eu-west-1.amazonaws.com/writefull-binaries). While S3 is a legitimate hosting platform, this is the vendor's own S3 bucket rather than an official distribution channel like a vendor's own domain or a well-known package registry. The binaries are executed code installed to /opt and /usr/bin. The sha256sums are pinned, which mitigates substitution attacks at the transport layer, but S3 bucket ownership can change, be misconfigured, or be taken over. The package is also quite old (version 3.0.0-beta19), and the vendor's S3 bucket may no longer be maintained or could be repurposed. This is a classic medium-risk pattern: prebuilt proprietary binaries from a non-canonical host with checksums present but no additional verification (e.g., GPG signature). The cheaper model's assessment is correct here — this is a genuine medium supply-chain concern, not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Filipe Laíns (FFY00) <fiilipe.lains@gmail.com>
    
      2# Contributor: Shameempk <mailtoshameempk@gmail.com>
    
      3pkgname=writefull-bin
    
      4_pkgname=${pkgname%-bin}
    
      5_rver=3.0.0
    
      6_bver=19
    
      7pkgver=${_rver}_beta$_bver
    
      8pkgrel=2
    
      9pkgdesc="App that gives feedback on your writing."
    
      10arch=('i686' 'x86_64')
    
      11url="http://writefullapp.com/"
    
      12license=('MIT' 'custom:Chromium')
    
      13makedepends=('imagemagick')
    
      14provides=('writefull')
    
      15conflicts=('writefull')
    
      16_ver=$_rver-beta$_bver
    
      17source_i686=("https://s3-eu-west-1.amazonaws.com/writefull-binaries/${_ver}/writefull_${_ver}_ia32.zip")
    
      18source_x86_64=("https://s3-eu-west-1.amazonaws.com/writefull-binaries/${_ver}/writefull_${_ver}_amd64.zip")
    
      19sha256sums_i686=('43e2237729e4b6eb267dd70ebb0aacc42a4a3ad6a97a5a5e38bab35b3eb7ad84')
    
      20sha256sums_x86_64=('6fdc2b8bcf93c972f4691c244c3a6bcc5ba6ee6bad76e163c889a1aacedc7c39')
    
      21
    
      22if [ "$(uname -m)" = "x86_64" ]; then
    
      23        _arch=amd64
    
      24	_arch_dir=x64
    
      25elif [ "$(uname -m)" = "i686" ]; then
    
      26        _arch=ia32
    
      27	_arch_dir=ia32
    
      28fi
    
      29
    
      30package() {
    
      31	install -dm 755 "$pkgdir"/opt/$_pkgname
    
      32	cp -dr --no-preserve=ownership "$srcdir"/Writefull-linux-$_arch_dir/* "$pkgdir"/opt/$_pkgname
    
      33
    
      34	convert "$pkgdir"/opt/$_pkgname/Writefull.ico "$pkgdir"/opt/$_pkgname/Writefull.png
    
      35	install -Dm 644 "$pkgdir"/opt/$_pkgname/Writefull-0.png "$pkgdir"/opt/pixmaps/writefull.png
    
      36
    
      37	sed -i 's|Icon=.*$|Icon=/opt/pixmaps/writefull.png|g' "$pkgdir"/opt/$_pkgname/writefull.desktop
    
      38	sed -i 's|Exec=.*$|Exec=writefull|g' "$pkgdir"/opt/$_pkgname/writefull.desktop
    
      39	install -Dm 755 "$pkgdir"/opt/$_pkgname/writefull.desktop "$pkgdir"/usr/share/applications/Writefull.desktop
    
      40
    
      41	rm "$pkgdir"/opt/$_pkgname/Writefull.ico
    
      42	rm "$pkgdir"/opt/$_pkgname/Writefull-*.png
    
      43	rm "$pkgdir"/opt/$_pkgname/writefull.desktop
    
      44
    
      45	install -dm 644 "$pkgdir"/usr/share/licenses/$pkgname
    
      46	ln -s "$pkgdir"/opt/$_pkgname/LICENSE "$pkgdir"/usr/share/licenses/$pkgname/LICENSE
    
      47	ln -s "$pkgdir"/opt/$_pkgname/LICENSES.chromium.html "$pkgdir"/usr/share/licenses/$pkgname/LICENSES.chromium.html
    
      48
    
      49	install -dm 755 "$pkgdir"/usr/bin
    
      50	ln -s /opt/$_pkgname/Writefull "$pkgdir"/usr/bin/writefull
    
      51}
    
      52

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2