yandex-disk

LOW

maintainer Stezko 139 votes scanned 2026-11-04 10:06:54.832549

View on AUR

Why flagged

The package downloads a prebuilt Debian package from Yandex's official repository, which is a legitimate source for the software; while the host is not a common forge, it is the vendor's own domain, and the checksums are provided, making this a normal distribution method for this proprietary software.

Triggered rules

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads a prebuilt Debian package from Yandex's official repository, which is a legitimate source for the software; while the host is not a common forge, it is the vendor's own domain, and the checksums are provided, making this a normal distribution method for this proprietary software.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("$_deb_package::https://repo.yandex.ru/yandex-disk/deb/pool/main/y/yandex-disk/$_deb_package"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Lucas Saliés Brum <lucas@archlinux.com.br>
    
      2# Contributor: Marochkin Sergey <me@ziggi.org>
    
      3# Contributor: Dmitry Chusovitin <dchusovitin@gmail.com>
    
      4
    
      5pkgname='yandex-disk'
    
      6pkgver=0.1.6.1080
    
      7pkgrel=2
    
      8pkgdesc='Yandex.Disk keeps your files with you at all times.'
    
      9arch=('x86_64')
    
      10url='http://disk.yandex.ru/'
    
      11license=('LicenseRef-yandex-disk')
    
      12depends=('glibc' 'gcc' 'gcc-libs' 'zlib')
    
      13_deb_package="yandex-disk_${pkgver}_amd64.deb"
    
      14install=yandex-disk.install
    
      15source=("$_deb_package::https://repo.yandex.ru/yandex-disk/deb/pool/main/y/yandex-disk/$_deb_package"
    
      16        "yandex-disk.install"
    
      17        "yandex-disk.service")
    
      18md5sums=('19446922ba1713183476953663a2b1cb'
    
      19        '5ad775bd895526c6b1f335c6d71dbdfa'
    
      20        '3d0370f3dfadf9da294b91441c226547')
    
      21
    
      22package() {
    
      23    cd "$srcdir"
    
      24    ar x "$_deb_package"
    
      25    bsdtar xf data.tar.gz -C "$pkgdir"
    
      26    install -Dm644 "$pkgdir/usr/share/doc/yandex-disk/copyright" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      27    install -Dm644 "${srcdir}/yandex-disk.service" "${pkgdir}/usr/lib/systemd/user/yandex-disk.service"
    
      28}
    
      29

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-04 10:06:54	Low	2
2026-06-19 19:07:35	Clean	2
2026-06-18 16:11:54	Low	1