acestream-engine
maintainer qark
· 131 votes
· scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged
This PKGBUILD installs a prebuilt binary tarball of the Ace Stream engine from download.acestream.media (the official project's own download host, not a personal/unofficial mirror), along with prebuilt Python wheel files from files.pythonhosted.org (the official PyPI CDN). All sources have sha256sums. The primary concern is that the main tarball is a closed-source, prebuilt binary bundle containing bundled shared libraries (libavcodec, libx264, libfdk-aac, etc.) that are installed and executed directly — this is a legitimate supply-chain risk if the upstream host were compromised or if the binary contains malicious code that the checksum cannot detect. The PyPI wheels are from the official host with checksums. The pattern (official vendor binary + official PyPI wheels + checksums) is standard for proprietary closed-source AUR packages. The medium rating is appropriate: not clearly malicious, but the prebuilt closed-source binary from a project-controlled host with no reproducibility is a real, if typical, supply-chain concern for this class of package.
Triggered rules
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:28
"$pkgname-$pkgver.tar.gz::https://download.acestream.media/linux/acestream_${pkgver}_ubuntu_${_ubuntuver}_x86_64_py${_pyver}.tar.gz"
MEDIUM
AI review of an ambiguous pattern
llm_review
The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed it and judged it MEDIUM (confidence 72%): This PKGBUILD installs a prebuilt binary tarball of the Ace Stream engine from download.acestream.media (the official project's own download host, not a personal/unofficial mirror), along with prebuilt Python wheel files from files.pythonhosted.org (the official PyPI CDN). All sources have sha256sums. The primary concern is that the main tarball is a closed-source, prebuilt binary bundle containing bundled shared libraries (libavcodec, libx264, libfdk-aac, etc.) that are installed and executed directly — this is a legitimate supply-chain risk if the upstream host were compromised or if the binary contains malicious code that the checksum cannot detect. The PyPI wheels are from the official host with checksums. The pattern (official vendor binary + official PyPI wheels + checksums) is standard for proprietary closed-source AUR packages. The medium rating is appropriate: not clearly malicious, but the prebuilt closed-source binary from a project-controlled host with no reproducibility is a real, if typical, supply-chain concern for this class of package.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Jonian Guveli <jonian@hardpixel.eu>
2
# Contributor: Jan Magnus Brevik <janmbrevik@gmail.com>
3
# Contributor: Rubén Fdes Moreira <tmp-meteque@openmailbox.com>
4
# Contributor: Sigmund Vestergaard <sigmundv@gmail.com>
5
# Contributor: MacCyber <jonas.enge@gmail.com>
6
# Contributor: Doug Newgard <scimmia22@outlook.com>
7
# Contributor: Jonas Heinrich <onny@project-insanity.org>
8
# Contributor: Antti Hautaniemi <an7oine@me.com>
9
10
_pyver=3.10
11
_ubuntuver=22.04
12
pkgname=acestream-engine
13
pkgver=3.2.11
14
pkgrel=1
15
pkgdesc="Ace Stream engine"
16
arch=("x86_64")
17
url="https://acestream.org"
18
license=("custom:ACE Stream")
19
depends=(
20
python310
21
)
22
makedepends=(
23
python-installer
24
)
25
backup=("usr/lib/$pkgname/acestream.conf")
26
install="$pkgname.install"
27
source=(
28
"$pkgname-$pkgver.tar.gz::https://download.acestream.media/linux/acestream_${pkgver}_ubuntu_${_ubuntuver}_x86_64_py${_pyver}.tar.gz"
29
"https://files.pythonhosted.org/packages/cp310/a/apsw/apsw-3.45.3.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
30
"https://files.pythonhosted.org/packages/cp310/c/cffi/cffi-1.16.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
31
"https://files.pythonhosted.org/packages/cp310/l/lxml/lxml-5.2.1-cp310-cp310-manylinux_2_28_x86_64.whl"
32
"https://files.pythonhosted.org/packages/cp36/p/PyNaCl/PyNaCl-1.5.0-cp36-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
33
"https://files.pythonhosted.org/packages/cp35/p/pycryptodome/pycryptodome-3.20.0-cp35-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
34
"https://files.pythonhosted.org/packages/py3/s/setuptools/setuptools-69.5.1-py3-none-any.whl"
35
"$pkgname.desktop"
36
"$pkgname.service"
37
"LICENSE"
38
)
39
noextract=(
40
"apsw-3.45.3.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
41
"cffi-1.16.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
42
"lxml-5.2.1-cp310-cp310-manylinux_2_28_x86_64.whl"
43
"PyNaCl-1.5.0-cp36-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl"
44
"pycryptodome-3.20.0-cp35-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl"
45
"setuptools-69.5.1-py3-none-any.whl"
46
)
47
sha256sums=('9b6bbd76a55e5a434641afae3b9cf8e6154ce1cf392152ec3aed5ac265432b2e'
48
'c4400eaf60ab9bb33b998e81fbc404bcba5aecefc59bf7e4e5a17ea39c4b82cd'
49
'e4108df7fe9b707191e55f33efbcb2d81928e10cea45527879a4749cbe472614'
50
'a2b44bec7adf3e9305ce6cbfa47a4395667e744097faed97abb4728748ba7d47'
51
'0c84947a22519e013607c9be43706dd42513f9e6ae5d39d3613ca1e142fba44d'
52
'76cb39afede7055127e35a444c1c041d2e8d2f1f9c121ecef573757ba4cd2c3c'
53
'c636ac361bc47580504644275c9ad802c50415c7522212252c033bd15f301f32'
54
'930ba23b7d94487d51c2b43203922467ae254981d00992337ab9a057c5e0f804'
55
'a0b657b00e8cedc69d24d28591c478d5b4c3443ed1a2796f3c606ae6635cbd89'
56
'da210a9270403957864ec5c77b727bdd6d7186035af6b38c1cc74e2c6f193585')
57
58
_libsymlinks() {
59
ln -sf "/usr/lib/$pkgname/lib/lib$1.so.$2.$3" "$pkgdir/usr/lib/$pkgname/lib/lib$1.so"
60
ln -sf "/usr/lib/$pkgname/lib/lib$1.so.$2.$3" "$pkgdir/usr/lib/$pkgname/lib/lib$1.so.$2"
61
}
62
63
package() {
64
sed -i "/ROOT=/c\ROOT=\/usr/lib\/${pkgname}" "start-engine"
65
66
install -Dm755 "start-engine" "$pkgdir/usr/bin/$pkgname"
67
install -Dm644 "acestream.conf" "$pkgdir/usr/lib/$pkgname/acestream.conf"
68
install -Dm755 "acestreamengine" "$pkgdir/usr/lib/$pkgname/acestreamengine"
69
cp -a "data" "$pkgdir/usr/lib/$pkgname/"
70
cp -a "lib" "$pkgdir/usr/lib/$pkgname/"
71
install -Dm644 "data/images/streamer-32.png" "$pkgdir/usr/share/pixmaps/$pkgname.png"
72
73
install -Dm644 "$pkgname.service" "$pkgdir/usr/lib/systemd/system/$pkgname.service"
74
install -Dm644 "$pkgname.desktop" "$pkgdir/usr/share/applications/$pkgname.desktop"
75
install -Dm644 "LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
76
77
ln -sf "/usr/bin/$pkgname" "$pkgdir/usr/bin/acestreamengine"
78
79
_libsymlinks "avcodec" "58" "100.100"
80
_libsymlinks "avdevice" "58" "11.101"
81
_libsymlinks "avfilter" "7" "87.100"
82
_libsymlinks "avformat" "58" "51.100"
83
_libsymlinks "avutil" "56" "58.100"
84
_libsymlinks "fdk-aac" "2" "0.1"
85
_libsymlinks "mp3lame" "0" "0.0"
86
_libsymlinks "swresample" "3" "8.100"
87
_libsymlinks "swscale" "5" "8.100"
88
89
ln -sf "/usr/lib/$pkgname/lib/libx264.so.148" "$pkgdir/usr/lib/$pkgname/lib/libx264.so"
90
91
# acestream user
92
install -Dm644 /dev/stdin "$pkgdir/usr/lib/sysusers.d/$pkgname.conf" <<END
93
u acestream - "systemd Ace Stream Service"
94
END
95
96
# acestream service directory
97
install -Dm644 /dev/stdin "$pkgdir/usr/lib/tmpfiles.d/$pkgname.conf" <<END
98
d /var/lib/ACEStream 0755 acestream acestream -
99
END
100
101
python -m installer -d "$pkgdir" --no-compile-bytecode apsw-3.45.3.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
102
python -m installer -d "$pkgdir" --no-compile-bytecode cffi-1.16.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
103
python -m installer -d "$pkgdir" --no-compile-bytecode lxml-5.2.1-cp310-cp310-manylinux_2_28_x86_64.whl
104
python -m installer -d "$pkgdir" --no-compile-bytecode PyNaCl-1.5.0-cp36-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl
105
python -m installer -d "$pkgdir" --no-compile-bytecode pycryptodome-3.20.0-cp35-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl
106
python -m installer -d "$pkgdir" --no-compile-bytecode setuptools-69.5.1-py3-none-any.whl
107
108
# ugly hack
109
local python_version
110
python_version=$(python -c 'import sys; print(".".join(map(str, sys.version_info[:2])))')
111
mv "$pkgdir/usr/lib/python$python_version" "$pkgdir/usr/lib/python$_pyver"
112
}
113
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | MEDIUM | 2 |
| 2026-08-02 00:16:08 | MEDIUM | 2 |
| 2026-08-01 00:11:18 | MEDIUM | 2 |
| 2026-07-31 00:14:10 | MEDIUM | 2 |
| 2026-07-30 00:17:23 | MEDIUM | 2 |
| 2026-07-29 00:25:53 | MEDIUM | 2 |
| 2026-07-28 00:07:28 | MEDIUM | 2 |
| 2026-07-27 00:24:32 | MEDIUM | 2 |
| 2026-07-26 00:07:32 | MEDIUM | 2 |
| 2026-07-25 00:13:44 | MEDIUM | 2 |
| 2026-07-24 00:02:28 | MEDIUM | 2 |
| 2026-07-23 00:14:47 | MEDIUM | 2 |
| 2026-07-22 00:29:32 | MEDIUM | 2 |
| 2026-07-21 00:24:15 | MEDIUM | 2 |
| 2026-07-20 00:19:49 | MEDIUM | 2 |
| 2026-07-19 00:17:08 | MEDIUM | 2 |
| 2026-07-18 00:14:48 | MEDIUM | 2 |
| 2026-07-17 00:06:16 | MEDIUM | 2 |
| 2026-07-16 00:05:41 | MEDIUM | 2 |
| 2026-07-15 00:09:25 | MEDIUM | 2 |