xermius-bin

maintainer ar1su · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

broken

Why flagged This PKGBUILD installs a prebuilt binary (Electron-based SSH client) downloaded from app.xermius.com, which is the vendor's own download server but not a well-known, auditable release host (e.g. GitHub releases). The sha512sum is present and pinned, which mitigates interception risk, but does not protect against the host owner substituting the binary at the same URL with a new version. The license is listed as 'unknown', the software is a proprietary SSH client (closed-source), and the binary is extracted directly from a .deb and installed — meaning users are running unauditable native code. The PKGBUILD itself is missing the bsdtar/ar extraction step to unpack the .deb before extracting data.tar.xz (the .deb is not automatically unpacked by makepkg), which makes this likely broken in practice. The supply-chain concern is real but moderate: the sha512 checksum is present, the host appears to be the official vendor download endpoint, and there is no evidence of malicious intent. This fits the medium category: a prebuilt proprietary binary from a non-GitHub/non-standard host with a pinned checksum.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:34 source_x86_64=("${_pkgname}-${pkgver}.deb::https://app.xermius.com/storage/downloads/xermius_${pkgver}_amd64.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD installs a prebuilt binary (Electron-based SSH client) downloaded from app.xermius.com, which is the vendor's own download server but not a well-known, auditable release host (e.g. GitHub releases). The sha512sum is present and pinned, which mitigates interception risk, but does not protect against the host owner substituting the binary at the same URL with a new version. The license is listed as 'unknown', the software is a proprietary SSH client (closed-source), and the binary is extracted directly from a .deb and installed — meaning users are running unauditable native code. The PKGBUILD itself is missing the bsdtar/ar extraction step to unpack the .deb before extracting data.tar.xz (the .deb is not automatically unpacked by makepkg), which makes this likely broken in practice. The supply-chain concern is real but moderate: the sha512 checksum is present, the host appears to be the official vendor download endpoint, and there is no evidence of malicious intent. This fits the medium category: a prebuilt proprietary binary from a non-GitHub/non-standard host with a pinned checksum.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: ar1su <traleeee@duck.com>
    
      2
    
      3_pkgname=xermius
    
      4pkgname=${_pkgname}-bin
    
      5pkgver=1.1.23
    
      6pkgrel=1
    
      7pkgdesc="Xermius - Easy SSH Client"
    
      8arch=('x86_64')
    
      9url="https://xermius.com"
    
      10license=('unknown')
    
      11
    
      12depends=(
    
      13    'gtk3'
    
      14    'libnotify'
    
      15    'nss'
    
      16    'libxss'
    
      17    'libxtst'
    
      18    'xdg-utils'
    
      19    'at-spi2-core'
    
      20    'util-linux-libs'
    
      21    'libsecret'
    
      22    'hicolor-icon-theme'
    
      23    'desktop-file-utils'
    
      24)
    
      25
    
      26optdepends=(
    
      27    'libappindicator-gtk3: for system tray icon support'
    
      28)
    
      29
    
      30provides=("${_pkgname}")
    
      31conflicts=("${_pkgname}")
    
      32options=('!strip')
    
      33
    
      34source_x86_64=("${_pkgname}-${pkgver}.deb::https://app.xermius.com/storage/downloads/xermius_${pkgver}_amd64.deb")
    
      35sha512sums_x86_64=('3fbefd9793d876d7b8fbd71562f032c0a0f85f200d0d64477e408c2e1c19a6fbf57a0a437889b57e62363eda8bf8d0063ad785daf49515dd3764192d4e3738f6')
    
      36
    
      37package() {
    
      38    cd "${pkgdir}"
    
      39    
    
      40    # Extract data from the .deb package
    
      41    tar -xf "${srcdir}/data.tar.xz"
    
      42    
    
      43    # Fix permissions
    
      44    chmod -R u+w "${pkgdir}"
    
      45}
    
      46
    
      47post-install() {
    
      48    echo "Updating icon and desktop database caches..."
    
      49    ln -sf /usr/share/icons/hicolor/1024x1024/apps/xermius.png /usr/share/icons/hicolor/256x256/apps/xermius.png
    
      50    ln -sf /usr/share/icons/hicolor/1024x1024/apps/xermius.png /usr/share/icons/hicolor/128x128/apps/xermius.png
    
      51    ln -sf /usr/share/icons/hicolor/1024x1024/apps/xermius.png /usr/share/icons/hicolor/48x48/apps/xermius.png
    
      52
    
      53    gtk-update-icon-cache -q -t -f /usr/share/icons/hicolor
    
      54    update-desktop-database -q
    
      55}
    
      56

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2