On 29-08-2026 09:33, Andreas Reichel wrote:
All,
A naive question about packages like *1panel-stable-bin.* It is *not*
*malicious*, but it fetches an install script at build time with
curl | sh — not in source=(), no checksum. I read the script; it is
install-count telemetry, nothing more.
The problem is that reading it proves very little. The content is
unpinned, so what I read is not necessarily what runs on the next
build. *Worse, a host can serve one thing to whoever is obviously*
*reviewing and another to everyone else — reviewing it may actually*
*be counterproductive, since it tells the server it is being looked*
*at.*
The same package also downloads its binary with curl -k, and then
verifies it against a checksum file fetched from the same host, so
a single attacker controls both halves.
*None of that is evidence of bad intent.* All of it means the package
cannot be reviewed in any meaningful sense.
How should such packages be treated? Genuinely asking, not
proposing:
- a packaging-guideline violation, to be reported to the
maintainer and fixed
- grounds for removal if unfixed
- acceptable, with the risk left to the user
I ask because I do not know what to write down when I review one.
"Malicious" is clearly wrong, and "Fine" seems wrong too.
Best and cheers,
Andreas
I can only find 1panel and 1panel-git in AUR, but your description
triggers me to flag *1panel-stable-bin *as "needs review before using".
Before pacman got Hooks support .install files were common, today there
are very few valid usecases left for having any .install file.
Showing a message with echo at install/update/removal time is the main
valid usecase left.
Having a .install file is enough to require review.
Usage of su/sudo/doas and co in any package file (including .install )
is at best a very low quality PKGBUILD written by someone who doesn't
understand how makepkg/pacman work together.
It should raise a huge flag immediately.
Lone_Wolf
