Arch Linux User Repository

Binance don't version their binaries. They simply replace the binance-amd64-linux.deb with a newer version. This means you will correctly receive a validity check error as the deb file no longer matches with the SHA sum.

Please confirm the latest Binance version and then mark this package as out of date.

Unless Binance change their release strategy or someone can come up with a clever solution, it is what it is.

@metaanon sorry for the version number error, I didn't know about that diff with pkg and binary...

@metaanon the pb actually is that the checksum from binance isn't up to date with the checksum of the deb file and this is for me suspicious and we can't publish a new version if binance checksum does not match the deb checksum. I prefer wait that binance correct the pb first. That's good to know that you're reactive :) With the check added, your pipeline should failed I presume so seems good to me now...

Hey @tyjak it would have made more sense for you to bump the pkg release version rather than the binary i.e. 1.15.4-2. Binance binary is still at 1.15.4 not 1.15.5

Hi @huck @tyjak.

Firstly, I've just downloaded both the deb and sha from Binance and the checksum both match locally and with the sha in PKGBUILD. I pushed 1.15.4 43 hours ago and there's been no change since then.

I've mentioned previously, Binance don't version their binaries, they only provide a generically named binance-amd64-linux.deb. They replace that deb file and update the sha txt accordingly. If you try and install this aur package after Binance have updated their side but before I've updated this package, as you've discovered, the checksum fails and the installation stops. I could add a check against the PKGBUILD sha and Binance sha during install but in the scenario above the outcome is exactly the same, the checksum fails and install stops.

FYI I confirm locally the deb and sha match as part of my automated script that updates and pushes a new PKGBUILD. Doesn't stop the above issue occurring.

The only other option I can really look at is croning/GitLab pipeline my automated script to constantly check for an update and trying to reduce the gap between Binance updating and me updating the AUR. People seem to flag this package out of data very quickly after Binance push an update and myself and @tyjak have generally reacted within an hour or so, so for most people they will never have this timing issue.

Happy to listen to peoples thoughts or advice though.

@metaanon, @huck, I added a check against checksum from binance file, PKGBUILD declared and checksum of the deb file downloaded... I feel more secure with this. Feel free to optimze if needed it.

@huck, I'm totally agree with you, I did the check for 1.14.3-1. I'm co-maintainer, and I'm wondering if it's possible to add a check in the install script, since Binance could be updated very frequently... Like get the sha256sum from binance and check it against the deb file downloaded and against the sha256sum from PKGBUILD in the install procedure.

Otherwise, I'm thinking of not installing by AUR, if I can't be sure that the sha256sum is verified by one of the co-maintainer...

I see that this package is updated with the latest binance application release. However, after downloading the .deb file from binance.com and attempting to verify it with the sha256 checksum does not verify the application as original. Therefore, the application could contain malware or binance must not have updated the checksum. I am assuming that you didn't verify the application prior to updating the AUR package with the lasted release either. I would be wary of upgrading the binance application to its latest version until binance has updated the checksum.

1.15.2

diff --git a/.SRCINFO b/.SRCINFO
index 699d6d6..7c61a17 100644
--- a/.SRCINFO
+++ b/.SRCINFO
@@ -1,13 +1,13 @@
 pkgbase = binance
    pkgdesc = The Binance desktop application
-   pkgver = 1.15.1
+   pkgver = 1.15.2
    pkgrel = 1
    url = https://www.binance.com/en/download
    arch = x86_64
    license = unknown
    depends = electron
-   source = binance-1.15.1.deb::https://ftp.binance.com/electron-desktop/linux/production/binance-amd64-linux.deb
-   sha256sums = fa6edaa265b3870c7a449b315dc2bc5b68fd459801dd71672c6454872a161536
+   source = binance-1.15.2.deb::https://ftp.binance.com/electron-desktop/linux/production/binance-amd64-linux.deb
+   sha256sums = 00f85c34fdb270fb0e3f030c07ed00faef28273a0dc8dc0433929ed22deeb53f

 pkgname = binance

diff --git a/PKGBUILD b/PKGBUILD
index 9bd9df9..3d7be8c 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -3,7 +3,7 @@
 # Maintainer: tyjak

 pkgname=binance
-pkgver=1.15.1
+pkgver=1.15.2
 pkgrel=1
 pkgdesc="The Binance desktop application"
 arch=('x86_64')
@@ -12,7 +12,7 @@ license=('unknown')
 depends=('electron')
 source=('https://ftp.binance.com/electron-desktop/linux/production/binance-amd64-linux.deb')
 source=("${pkgname}-${pkgver}.deb::https://ftp.binance.com/electron-desktop/linux/production/binance-amd64-linux.deb")
-sha256sums=('fa6edaa265b3870c7a449b315dc2bc5b68fd459801dd71672c6454872a161536')
+sha256sums=('00f85c34fdb270fb0e3f030c07ed00faef28273a0dc8dc0433929ed22deeb53f')

 package() {
     bsdtar -xv -C "${pkgdir}" -f "${srcdir}/data.tar.xz"

@metaanon, 1.15.1 is working perfectly. Really appreciate your effort. Thanks!

This package had already been flagged out of date. Binance don't version their releases, just replace the file and sha with a newer one. Nothing I can do about that. I've updated the aur package to 1.15.1 so you should be good to go.