activinspire

maintainer Daved · 5 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary .deb from activsoftware.co.uk, which is not Promethean's primary official domain (prometheanworld.com). However, activsoftware.co.uk appears to be a legitimate Promethean-operated mirror/distribution host for their Linux packages (Promethean has historically used this domain for Linux software distribution). The package also bundles two prebuilt shared libraries (libre2.so.5 and libwebp.so.6) sourced locally (not from a URL), which are installed directly into the application directory and executed at runtime — these are verified only by MD5 checksums (not cryptographic signatures), which is weak but standard for AUR. The combination of: (1) a prebuilt binary .deb from a non-primary vendor domain, (2) two bundled prebuilt .so files of unknown provenance with only MD5 verification, and (3) MD5 rather than SHA256/b2 checksums, constitutes a real supply-chain concern. If activsoftware.co.uk is not actually Promethean-controlled or gets compromised, arbitrary code execution results. This is a genuine medium-severity supply-chain risk, not a false positive.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source=("https://activsoftware.co.uk/linux/repos/ubuntu/pool/focal/a/ac/activinspire_2004-3.5.18-1-amd64.deb"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from activsoftware.co.uk, which is not Promethean's primary official domain (prometheanworld.com). However, activsoftware.co.uk appears to be a legitimate Promethean-operated mirror/distribution host for their Linux packages (Promethean has historically used this domain for Linux software distribution). The package also bundles two prebuilt shared libraries (libre2.so.5 and libwebp.so.6) sourced locally (not from a URL), which are installed directly into the application directory and executed at runtime — these are verified only by MD5 checksums (not cryptographic signatures), which is weak but standard for AUR. The combination of: (1) a prebuilt binary .deb from a non-primary vendor domain, (2) two bundled prebuilt .so files of unknown provenance with only MD5 verification, and (3) MD5 rather than SHA256/b2 checksums, constitutes a real supply-chain concern. If activsoftware.co.uk is not actually Promethean-controlled or gets compromised, arbitrary code execution results. This is a genuine medium-severity supply-chain risk, not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: DaveD <david@codevertex.de>
    
      2# Contributor: jbreizh
    
      3# Contributor: Malstrond <malstrond@gmail.com>
    
      4# Contributor: Jean-Baptiste Le Coz <jb.lecoz@gmail.com>
    
      5# Contributor: Jose Riha <jose1711@gmail.com>
    
      6# Contributor: Bazon <bazonbloch@arcor.de>
    
      7
    
      8pkgname=activinspire
    
      9pkgver=3.5.18
    
      10pkgrel=1
    
      11pkgdesc="Presentation Software for use with Promethean Hardware products ."
    
      12arch=('x86_64')
    
      13url="https://support.prometheanworld.com/product/activinspire"
    
      14license=('unknown')
    
      15depends=(libxmu gst-plugins-base libjpeg-turbo libxrender libxkbcommon libxrandr libgl libxdamage snappy libgl fontconfig openssl-1.1 nss libxcomposite libxcursor libxtst dbus libxkbcommon-x11 xcb-util-wm xcb-util-image xcb-util-renderutil qt5-webengine)
    
      16optdepends=('activdriver: Driver for Promethean hardware'
    
      17            'activtools: Tools for Promethean hardware, e.g. calibration or systray monitor')
    
      18source=("https://activsoftware.co.uk/linux/repos/ubuntu/pool/focal/a/ac/activinspire_2004-3.5.18-1-amd64.deb"
    
      19        "inspire.sh"
    
      20        "activityplayer.sh"
    
      21        "libre2.so.5"
    
      22        "libwebp.so.6"
    
      23        )
    
      24md5sums=('855cd48c72f4dc9e8bd5a653225bf541'
    
      25         'c9d1532b5dce33522a77b59a62478ddd'
    
      26         '4f8d3e07429c214cf6cc3f067fec76b7'
    
      27         'fb8c55ea7f19bdcc81b51c911bbf565b'
    
      28         '13048084f7d2dc10dcb9378c9732da62'
    
      29         )
    
      30
    
      31package() {
    
      32
    
      33 # Extract software from debian archive. Exclude /etc/xdg (not needed) and /var/Promethean (created with the correct permissions below).
    
      34 bsdtar -C "$pkgdir" --exclude=./var --exclude=./etc/xdg --exclude=./usr/share/gnome-shell -xf data.tar.xz
    
      35
    
      36 # Use /opt instead of /usr/local/bin for binaries to match Arch packaging standards for large self-contained packages.
    
      37 install -dm0755 "$pkgdir"/opt
    
      38 mv "$pkgdir"/usr/local/bin/activsoftware "$pkgdir"/opt/
    
      39 rm -r "$pkgdir"/usr/local
    
      40
    
      41 # Because we just changed the paths, now we need to fix the absolute paths that Promethean uses in their files.
    
      42 sed -i "s%/usr/local/bin%/usr/bin%" "$pkgdir"/usr/share/applications/activsoftware.desktop
    
      43 sed -i "s%/usr/local/bin%/usr/bin%" "$pkgdir"/usr/share/applications/activplayer.desktop
    
      44
    
      45 # ActivInspire ships with functionality to disable compositing. This should really be handled by the users WM configuration, so we remove that.
    
      46 rm "$pkgdir"/usr/share/applications/activsoftware-nc.desktop
    
      47
    
      48 # The upstream launch scripts only work with Ubuntu, so we replace them with our own.
    
      49 install -dm0755 "$pkgdir"/usr/bin
    
      50 install -Dm755 inspire.sh "$pkgdir"/usr/bin/inspire
    
      51 install -Dm755 activityplayer.sh "$pkgdir"/usr/bin/activityplayer
    
      52
    
      53 # This software attempts to create a lockfile in /var/Promethean/ActivInspire, the path is hardcoded.
    
      54 # Since it is started by the user, this directory needs to be world-writable, even if that's a bad idea.
    
      55 install -dm0777 "$pkgdir"/var/Promethean
    
      56
    
      57 # Install libre2.so.5 and libwebp.so.6 from ubuntu focal deb package
    
      58  install -Dm755 libre2.so.5 "$pkgdir"/opt/activsoftware
    
      59  install -Dm755 libwebp.so.6 "$pkgdir"/opt/activsoftware
    
      60}
    
      61

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2