zeroform-bin

maintainer simonrepp · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt .deb binary from simonrepp.com, which is the maintainer's personal domain rather than an official distribution channel or well-known forge. While a sha256sum is provided (offering some integrity protection against transit tampering), the binary itself is self-hosted by the maintainer with no independent verification possible. The package installs an executed binary extracted directly from the .deb, meaning any compromise of simonrepp.com or silent replacement of the file (while keeping the same hash) would result in arbitrary code execution on the user's system. This is a genuine supply-chain concern: a prebuilt binary from a personal host with no reproducible build, no upstream release infrastructure (GitHub releases, PyPI, etc.), and no way for users to independently verify the binary's provenance. The sha256sum mitigates substitution attacks but does not address the trust question of who controls the signing/hosting. This fits the medium severity definition exactly.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source_x86_64=("https://simonrepp.com/zeroform/packages/zeroform_${pkgver}-1+deb11_amd64.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt .deb binary from simonrepp.com, which is the maintainer's personal domain rather than an official distribution channel or well-known forge. While a sha256sum is provided (offering some integrity protection against transit tampering), the binary itself is self-hosted by the maintainer with no independent verification possible. The package installs an executed binary extracted directly from the .deb, meaning any compromise of simonrepp.com or silent replacement of the file (while keeping the same hash) would result in arbitrary code execution on the user's system. This is a genuine supply-chain concern: a prebuilt binary from a personal host with no reproducible build, no upstream release infrastructure (GitHub releases, PyPI, etc.), and no way for users to independently verify the binary's provenance. The sha256sum mitigates substitution attacks but does not address the trust question of who controls the signing/hosting. This fits the medium severity definition exactly.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Simon Repp <simon@fdpl.io>
    
      2
    
      3arch=('x86_64')
    
      4license=('AGPL3')
    
      5options=('!lto')
    
      6pkgdesc='A static and dynamic online form generator'
    
      7pkgname=zeroform-bin
    
      8pkgrel=1
    
      9pkgver=0.8.0
    
      10sha256sums_x86_64=('98c0c0fe4704673199b004f386de99bc7b5daf0eb24fb2834eb4d84a6b2ea769')
    
      11url='https://simonrepp.com/zeroform'
    
      12
    
      13source_x86_64=("https://simonrepp.com/zeroform/packages/zeroform_${pkgver}-1+deb11_amd64.deb")
    
      14
    
      15package() {
    
      16	tar -xvf data.tar.xz -C "${pkgdir}"
    
      17}
    
      18

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2