5db5-rm2-data-bin

maintainer orphaned · 0 votes · base 5db5-rm2 · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD installs prebuilt binary plugin files (shared libraries: RM-2.so for LV2 and VST3) downloaded from an S3 bucket (5db5public.s3.amazonaws.com) rather than the vendor's official domain (audioassault.mx). The binaries are executed/loaded at runtime by audio hosts. While SHA-256 checksums are present and the S3 bucket appears to be the vendor's own distribution channel (the bucket name '5db5public' matches the pkgbase '5db5-rm2' and the vendor branding), S3 buckets are not the same as a verified official release page — the bucket could be taken over, the URL could be changed, or the object could be replaced without the maintainer noticing. This is a genuine supply-chain concern for executed code from a non-canonical host, which is the definition of medium severity. It is not high because there is no obfuscation, no exfiltration, and the checksum provides integrity verification at build time. The 'RM-2 Linker' script listed as a source has no URL, meaning it must be a local file submitted to the AUR alongside the PKGBUILD — this is slightly unusual but not inherently malicious, though it does mean an additional unverifiable artifact is being installed to /usr/bin.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 'https://5db5public.s3.amazonaws.com/RM2Linux.zip')

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD installs prebuilt binary plugin files (shared libraries: RM-2.so for LV2 and VST3) downloaded from an S3 bucket (5db5public.s3.amazonaws.com) rather than the vendor's official domain (audioassault.mx). The binaries are executed/loaded at runtime by audio hosts. While SHA-256 checksums are present and the S3 bucket appears to be the vendor's own distribution channel (the bucket name '5db5public' matches the pkgbase '5db5-rm2' and the vendor branding), S3 buckets are not the same as a verified official release page — the bucket could be taken over, the URL could be changed, or the object could be replaced without the maintainer noticing. This is a genuine supply-chain concern for executed code from a non-canonical host, which is the definition of medium severity. It is not high because there is no obfuscation, no exfiltration, and the checksum provides integrity verification at build time. The 'RM-2 Linker' script listed as a source has no URL, meaning it must be a local file submitted to the AUR alongside the PKGBUILD — this is slightly unusual but not inherently malicious, though it does mean an additional unverifiable artifact is being installed to /usr/bin.

PKGBUILD

1 offending line(s) highlighted

      1pkgbase=5db5-rm2
    
      2pkgname=( ${pkgbase}-{data,lv2,vst3}-bin )
    
      3pkgver=1.0.0
    
      4pkgrel=3
    
      5arch=('x86_64')
    
      6url="https://audioassault.mx/plugin/RM-2"
    
      7license=('EULA')
    
      8depends=('alsa-lib' 'bzip2' 'brotli' 'freetype2' 'glibc' 'graphite' 'harfbuzz' 'keyutils' 'krb5' 'libcurl-gnutls' 'libffi' 'libnghttp2' 'libidn2' 'libp11-kit' 'libpng' 'libpsl' 'libssh2' 'libtasn1' 'libunistring' 'libxau' 'libxcb' 'libx11' 'nettle' 'openssl' 'pcre2' 'zlib' 'zstd')
    
      9makedepends=('xdg-user-dirs')
    
      10provides=( ${pkgbase} )
    
      11source=('RM-2 Linker'
    
      12        'https://5db5public.s3.amazonaws.com/RM2Linux.zip')
    
      13sha256sums=('7ffdc44a6b69444c5b665d5b4280c7610d6f0172739893f56ca316536235c4c6'
    
      14            '8d1c58e8163579288ca88b290672c03f19500c760fb26c2c00df2a247b7ba399')
    
      15
    
      16package_5db5-rm2-data-bin() {
    
      17    ## Install Asset Data
    
      18    pkgdesc="Analog Channel Emulator Plugin (Data Assets)"
    
      19    groups=('pro-audio')
    
      20
    
      21    ## Make data assets dir
    
      22    mkdir -p "$pkgdir/usr/lib/5db5/RM-2/Presets"
    
      23
    
      24    ## Copy assets to data directory
    
      25    cp -r "$srcdir/Presets/"* "$pkgdir/usr/lib/5db5/RM-2/Presets"
    
      26
    
      27    ## Install RM-2 Linker Script
    
      28    install -Dm755 "$srcdir/RM-2 Linker" "$pkgdir/usr/bin/RM-2 Linker"
    
      29}
    
      30
    
      31package_5db5-rm2-lv2-bin() {
    
      32    ## Install LV2 Plugin
    
      33    pkgdesc="Analog Channel Emulator Plugin (LV2)"
    
      34    depends=('5db5-rm2-data-bin')
    
      35    groups=('pro-audio' 'lv2-plugins')
    
      36    install -Dm755 "$srcdir/RM-2.lv2/RM-2.so" "$pkgdir/usr/lib/lv2/RM-2.lv2/RM-2.so"
    
      37    install -Dm644 "$srcdir/RM-2.lv2/dsp.ttl" "$pkgdir/usr/lib/lv2/RM-2.lv2/dsp.ttl"
    
      38    install -Dm644 "$srcdir/RM-2.lv2/manifest.ttl" "$pkgdir/usr/lib/lv2/RM-2.lv2/manifest.ttl"
    
      39    install -Dm644 "$srcdir/RM-2.lv2/ui.ttl" "$pkgdir/usr/lib/lv2/RM-2.lv2/ui.ttl"
    
      40}
    
      41
    
      42package_5db5-rm2-vst3-bin() {
    
      43    ## Install VST3 Plugin
    
      44    pkgdesc="Analog Channel Emulator Plugin (VST3)"
    
      45    depends=('5db5-rm2-data-bin')
    
      46    groups=('pro-audio' 'vst3-plugins')
    
      47    install -Dm755 "$srcdir/RM-2.vst3/Contents/Resources/moduleinfo.json" "$pkgdir/usr/lib/vst3/RM-2.vst3/Contents/Resources/moduleinfo.json"
    
      48    install -Dm755 "$srcdir/RM-2.vst3/Contents/x86_64-linux/RM-2.so" "$pkgdir/usr/lib/vst3/RM-2.vst3/Contents/x86_64-linux/RM-2.so"
    
      49}
    
      50

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2