ztoim

maintainer chocotan · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt AppImage binary from fscdn.zto.com, which is ZTO Express's (中通快递) CDN domain — a major Chinese logistics company. While this is a plausible official vendor CDN, it is not a well-known, independently verifiable release host (no GitHub releases, no official download page with checksums). The binary is executed directly as an AppImage. The sha256sum provides some integrity guarantee against tampering in transit, but does not verify the authenticity of the binary's origin or that the CDN hasn't been compromised or the file silently replaced at the same URL. The obfuscated filename (random-looking hash) and lack of version in the URL path mean there's no way to independently verify this is the correct binary for version 8.23.0.21. This is a genuine medium-severity supply-chain concern: an executed binary from an unofficial/unverifiable CDN host with no reproducible build path.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 "https://fscdn.zto.com/fs41/M09/8A/36/CgRRbWSb07WATnVHBn5OkGX3MTs.AppIma"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt AppImage binary from fscdn.zto.com, which is ZTO Express's (中通快递) CDN domain — a major Chinese logistics company. While this is a plausible official vendor CDN, it is not a well-known, independently verifiable release host (no GitHub releases, no official download page with checksums). The binary is executed directly as an AppImage. The sha256sum provides some integrity guarantee against tampering in transit, but does not verify the authenticity of the binary's origin or that the CDN hasn't been compromised or the file silently replaced at the same URL. The obfuscated filename (random-looking hash) and lack of version in the URL path mean there's no way to independently verify this is the correct binary for version 8.23.0.21. This is a genuine medium-severity supply-chain concern: an executed binary from an unofficial/unverifiable CDN host with no reproducible build path.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  chocotan < loli at linux.com>
    
      2
    
      3pkgname='ztoim'
    
      4_pkgname='ztoim'
    
      5pkgver='8.23.0.21';
    
      6_major="${pkgver%%.*}"
    
      7pkgrel='1'
    
      8pkgdesc="ZTO BAOHE ${_major}"
    
      9arch=('x86_64')
    
      10url='https://baohe.zto.com'
    
      11license=('custom')
    
      12provides=()
    
      13_filename=CgRRbWSb07WATnVHBn5OkGX3MTs.AppIma
    
      14source=(
    
      15  "https://fscdn.zto.com/fs41/M09/8A/36/CgRRbWSb07WATnVHBn5OkGX3MTs.AppIma"
    
      16)
    
      17
    
      18md5sums=('3d2dbc3d328568e3a93a8a5518affa8f')
    
      19sha256sums=('c2138767b7e66b61edf6003ec1402c9e420237b3e766b1db249ac76c955ad9b3')
    
      20
    
      21options=(!strip)
    
      22prepare() {
    
      23    cd "${srcdir}"
    
      24    chmod +x ${_filename}
    
      25}
    
      26
    
      27
    
      28package() {
    
      29    install -Dm755 "${srcdir}/${_filename}" "${pkgdir}/opt/appimages/${_filename}"
    
      30    # Install Exec Script
    
      31    ExecScript="#!/bin/sh\nexec /opt/appimages/${_filename} \"\$@\""
    
      32    install -dm755 "${pkgdir}/usr/bin"
    
      33    echo -e $ExecScript > "${pkgdir}/usr/bin/${_pkgname}"
    
      34    chmod +x "${pkgdir}/usr/bin/${_pkgname}"
    
      35}
    
      36

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2