5db5-channel-vst3-bin

maintainer orphaned · 0 votes · base 5db5-channel · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs prebuilt binary shared libraries (.so files for LV2 and VST3 plugins) downloaded from an S3 bucket (5db5public.s3.amazonaws.com) that is not an official distribution channel like a distro mirror or well-known vendor CDN. While SHA256 checksums are provided (pinning the specific archive), the S3 bucket is a personal/vendor-controlled storage that could be replaced or compromised without notice. The binaries are executed at runtime by audio hosts (DAWs), making this a genuine supply-chain concern: a compromised or substituted binary would execute arbitrary code in the user's audio environment. The url field points to audioassault.mx (the vendor), but the actual download comes from a different host (the S3 bucket), which is a common but still noteworthy pattern. The 'Channel551 Linker' script is also installed as an executable (Dm755) and its content is not visible here but has a checksum. Overall this is a legitimate medium-risk pattern: prebuilt closed-source binaries from a non-canonical host with checksums but no reproducibility guarantees.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=('https://5db5public.s3.amazonaws.com/Channel551Linux.zip'

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package installs prebuilt binary shared libraries (.so files for LV2 and VST3 plugins) downloaded from an S3 bucket (5db5public.s3.amazonaws.com) that is not an official distribution channel like a distro mirror or well-known vendor CDN. While SHA256 checksums are provided (pinning the specific archive), the S3 bucket is a personal/vendor-controlled storage that could be replaced or compromised without notice. The binaries are executed at runtime by audio hosts (DAWs), making this a genuine supply-chain concern: a compromised or substituted binary would execute arbitrary code in the user's audio environment. The url field points to audioassault.mx (the vendor), but the actual download comes from a different host (the S3 bucket), which is a common but still noteworthy pattern. The 'Channel551 Linker' script is also installed as an executable (Dm755) and its content is not visible here but has a checksum. Overall this is a legitimate medium-risk pattern: prebuilt closed-source binaries from a non-canonical host with checksums but no reproducibility guarantees.

PKGBUILD

1 offending line(s) highlighted

      1pkgbase=5db5-channel
    
      2pkgname=('5db5-channel-data-bin' '5db5-channel-lv2-bin' '5db5-channel-vst3-bin')
    
      3pkgver=1.0.1
    
      4pkgrel=3
    
      5arch=('x86_64')
    
      6url="https://audioassault.mx/plugin/Channel551"
    
      7license=('EULA')
    
      8depends=('alsa-lib' 'bzip2' 'brotli' 'freetype2' 'glibc' 'graphite' 'harfbuzz' 'keyutils' 'krb5' 'libcurl-gnutls' 'libffi' 'libnghttp2' 'libidn2' 'libp11-kit' 'libpng' 'libpsl' 'libssh2' 'libtasn1' 'libunistring' 'libxau' 'libxcb' 'libx11' 'nettle' 'openssl' 'pcre2' 'zlib' 'zstd')
    
      9makedepends=('xdg-user-dirs')
    
      10provides=('5db5-channel')
    
      11source=('https://5db5public.s3.amazonaws.com/Channel551Linux.zip'
    
      12        'Channel551 Linker')
    
      13sha256sums=('3363742449270118ce5807c6081ddb7e50537eb76d55720e4662b1a881f851c8'
    
      14            '35041e56af62e7d07d1a2920fa1fb0d0af14bb570968e74eab33a57005c797f0')
    
      15
    
      16package_5db5-channel-data-bin() {
    
      17    ## Install Asset Data
    
      18    pkgdesc="British Style Channel Strip (Data Assets)"
    
      19    groups=('pro-audio')
    
      20
    
      21    ## Make data assets dir
    
      22    mkdir -p "$pkgdir/usr/lib/5db5/Channel551/Presets"
    
      23
    
      24    ## Copy assets to data directory
    
      25    cp -r "$srcdir/Presets"/* "$pkgdir/usr/lib/5db5/Channel551/Presets"
    
      26
    
      27    ## Install Double Take Linker Script
    
      28    install -Dm755 "$srcdir/Channel551 Linker" "$pkgdir/usr/bin/Channel551 Linker"
    
      29}
    
      30
    
      31package_5db5-channel-lv2-bin() {
    
      32    ## Install LV2 Plugin
    
      33    pkgdesc="British Style Channel Strip (LV2)"
    
      34    groups=('pro-audio' 'lv2-plugins')
    
      35    install -Dm755 "$srcdir/Channel551.lv2/Channel551.so" "$pkgdir/usr/lib/lv2/Channel551.lv2/Channel551.so"
    
      36    install -Dm644 "$srcdir/Channel551.lv2/dsp.ttl" "$pkgdir/usr/lib/lv2/Channel551.lv2/dsp.ttl"
    
      37    install -Dm644 "$srcdir/Channel551.lv2/manifest.ttl" "$pkgdir/usr/lib/lv2/Channel551.lv2/manifest.ttl"
    
      38    install -Dm644 "$srcdir/Channel551.lv2/ui.ttl" "$pkgdir/usr/lib/lv2/Channel551.lv2/ui.ttl"
    
      39}
    
      40
    
      41package_5db5-channel-vst3-bin() {
    
      42    ## Install VST3 Plugin
    
      43    pkgdesc="British Style Channel Strip (VST3)"
    
      44    groups=('pro-audio' 'vst3-plugins')
    
      45    install -Dm755 "$srcdir/Channel551.vst3/Contents/Resources/moduleinfo.json" "$pkgdir/usr/lib/vst3/Channel551.vst3/Contents/Resources/moduleinfo.json"
    
      46    install -Dm755 "$srcdir/Channel551.vst3/Contents/x86_64-linux/Channel551.so" "$pkgdir/usr/lib/vst3/Channel551.vst3/Contents/x86_64-linux/Channel551.so"
    
      47}
    
      48

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2