xteink-unlocker-bin

LOW

maintainer fourier 0 votes scanned 2026-10-31 20:02:55.268531

View on AUR

Why flagged

Prebuilt binary (.deb) downloaded from a subdomain of the project's own domain (crosspointreader.com) with a pinned sha256 checksum; the host is non-standard but plausibly project-owned official release infrastructure, making silent swapping unlikely, though the package is new with few votes and the binary is unverifiable beyond the checksum.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Prebuilt binary (.deb) downloaded from a subdomain of the project's own domain (crosspointreader.com) with a pinned sha256 checksum; the host is non-standard but plausibly project-owned official release infrastructure, making silent swapping unlikely, though the package is new with few votes and the binary is unverifiable beyond the checksum.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:26 source=("https://unlocker-releases.crosspointreader.com/v${pkgver}/XteinkUnlocker_${pkgver}_linux-x86_64.deb")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Miguel Perez Andrade <miguel.perezandrade@gmail.com>
    
      2
    
      3pkgname=xteink-unlocker-bin
    
      4_pkgname=xteink-unlocker
    
      5pkgver=0.2.42
    
      6pkgrel=1
    
      7pkgdesc="Install CrossPoint Reader on USB-locked Xteink devices via their own OTA update mechanism"
    
      8arch=('x86_64')
    
      9url='https://crosspointreader.com'
    
      10license=('LicenseRef-unknown')
    
      11depends=(
    
      12  'webkit2gtk-4.1'
    
      13  'gtk3'
    
      14  'libsoup3'
    
      15  'libayatana-appindicator'
    
      16  'polkit'
    
      17  'networkmanager'
    
      18  'dnsmasq'
    
      19  'procps-ng'
    
      20  'hicolor-icon-theme'
    
      21)
    
      22optdepends=('polkit-gnome: graphical polkit agent, needed if your session does not run one')
    
      23provides=("$_pkgname")
    
      24conflicts=("$_pkgname")
    
      25options=('!strip' '!debug')
    
      26source=("https://unlocker-releases.crosspointreader.com/v${pkgver}/XteinkUnlocker_${pkgver}_linux-x86_64.deb")
    
      27sha256sums=('5afdc3bd426c9475248b31fc80e143875b7158da5aaa26a1260a5f68c2c4472b')
    
      28noextract=("XteinkUnlocker_${pkgver}_linux-x86_64.deb")
    
      29
    
      30prepare() {
    
      31  mkdir -p deb
    
      32  bsdtar -xOf "XteinkUnlocker_${pkgver}_linux-x86_64.deb" data.tar.gz | bsdtar -xf - -C deb
    
      33}
    
      34
    
      35package() {
    
      36  cd deb
    
      37
    
      38  install -Dm755 usr/bin/unlocker-app "$pkgdir/usr/bin/unlocker-app"
    
      39  # The app looks for its privileged helper at this exact path (pkexec'd)
    
      40  install -Dm755 "usr/lib/Xteink Unlocker/unlocker-helper" \
    
      41    "$pkgdir/usr/lib/Xteink Unlocker/unlocker-helper"
    
      42
    
      43  install -Dm644 "usr/share/applications/Xteink Unlocker.desktop" \
    
      44    "$pkgdir/usr/share/applications/$_pkgname.desktop"
    
      45
    
      46  for size in 32x32 128x128 256x256@2; do
    
      47    install -Dm644 "usr/share/icons/hicolor/$size/apps/unlocker-app.png" \
    
      48      "$pkgdir/usr/share/icons/hicolor/$size/apps/unlocker-app.png"
    
      49  done
    
      50}
    
      51

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-31 20:02:55	Low	3
2026-10-31 19:58:49	Medium	2