yad-light

maintainer sfs · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The source is an SRPM fetched from git.altlinux.org (an ALT Linux build infrastructure task URL), which is not the official upstream release host (github.com/v1cont/yad). An SRPM is an archive containing source tarballs and patches; the PKGBUILD extracts v14.1.tar.gz and patches from it. The concern is that the SRPM could contain modified sources or patches compared to the official upstream release — the maintainer is using ALT Linux's packaged version as a proxy for the upstream source rather than fetching directly from GitHub. The sha256sum pins the specific SRPM, which mitigates substitution attacks, but the integrity of the SRPM's contents relative to upstream is not independently verified. The patches applied (show-cursor-initially.patch, ru.po) come from inside this third-party SRPM. This is a genuine, if mild, supply-chain concern: executed/compiled code originates from a non-official packaging host rather than the upstream project directly. Not clearly malicious, but not clean either.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("https://git.altlinux.org/tasks/398769/build/100/x86_64/srpm/yad-14.1-alt1.src.rpm")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The source is an SRPM fetched from git.altlinux.org (an ALT Linux build infrastructure task URL), which is not the official upstream release host (github.com/v1cont/yad). An SRPM is an archive containing source tarballs and patches; the PKGBUILD extracts v14.1.tar.gz and patches from it. The concern is that the SRPM could contain modified sources or patches compared to the official upstream release — the maintainer is using ALT Linux's packaged version as a proxy for the upstream source rather than fetching directly from GitHub. The sha256sum pins the specific SRPM, which mitigates substitution attacks, but the integrity of the SRPM's contents relative to upstream is not independently verified. The patches applied (show-cursor-initially.patch, ru.po) come from inside this third-party SRPM. This is a genuine, if mild, supply-chain concern: executed/compiled code originates from a non-official packaging host rather than the upstream project directly. Not clearly malicious, but not clean either.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: sfs sfslinux@gmail.com
    
      2
    
      3pkgname=yad-light
    
      4_pkgname=yad
    
      5pkgver=14.1
    
      6pkgrel=3
    
      7pkgdesc='A fork of zenity - display graphical dialogs from shell scripts or command line w\o html, spell, sourceview'
    
      8url='https://github.com/v1cont/yad'
    
      9arch=('x86_64')
    
      10license=('GPL3')
    
      11depends=('gtk3')
    
      12makedepends=('autoconf' 'automake' 'intltool')
    
      13source=("https://git.altlinux.org/tasks/398769/build/100/x86_64/srpm/yad-14.1-alt1.src.rpm")
    
      14sha256sums=('520dc26b56c2da198798d65a34f19f409c2d4ff8721f1ad12c2a0be460935594')
    
      15replaces=('yad')
    
      16provides=('yad')
    
      17conflicts=('yad' 'yad-git' 'yad-gtk2')
    
      18
    
      19prepare() {
    
      20  tar -xf v14.1.tar.gz
    
      21  cd "${srcdir}/${_pkgname}-${pkgver}"
    
      22  cp ../ru.po po && echo ru >> po/LINGUAS
    
      23#  patch -Np0 -i ../fix-missing-buttons.patch 
    
      24  patch -Np1 -i ../show-cursor-initially.patch 
    
      25  # use webkit2gtk-4.1
    
      26  sed -i 's|webkit2gtk-4.0|webkit2gtk-4.1|' configure.ac
    
      27
    
      28  autoreconf -ivf
    
      29  intltoolize
    
      30}
    
      31
    
      32build() {
    
      33  cd "${srcdir}/${_pkgname}-${pkgver}"
    
      34
    
      35  ./configure \
    
      36    --prefix=/usr \
    
      37    --enable-icon-browser \
    
      38    --disable-html \
    
      39    --disable-spell \
    
      40    --disable-sourceview
    
      41
    
      42  make
    
      43}
    
      44
    
      45package() {
    
      46  cd "${srcdir}/${_pkgname}-${pkgver}"
    
      47
    
      48  make DESTDIR="${pkgdir}" install
    
      49}
    
      50

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2