adaogg

maintainer charlie5 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The source is a prebuilt zip archive downloaded from phasercat.com, which appears to be the maintainer's personal website rather than an official upstream forge (e.g., GitHub, GitLab, or a recognized Ada ecosystem host). The zip contains Ada source code that is compiled with gprbuild, so it is compiled source rather than a prebuilt binary — this is somewhat less severe than a prebuilt binary blob. However, the host is a personal/unofficial server with no verifiable connection to a canonical upstream project, meaning the source could be silently replaced at any time. The sha256sum provides integrity for the current download but does not protect against a future substitution at the same URL. The two additional files (adaogg.gpr, debug.pra) are provided inline in the PKGBUILD's source array without an upstream URL, which is unusual but not inherently malicious — they appear to be build project files. Overall this is a genuine medium-risk supply-chain concern: compiled source from a personal, non-canonical host with no independent verification path.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=(https://phasercat.com/wp-content/uploads/2020/08/adaogg_10142021.zip

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The source is a prebuilt zip archive downloaded from phasercat.com, which appears to be the maintainer's personal website rather than an official upstream forge (e.g., GitHub, GitLab, or a recognized Ada ecosystem host). The zip contains Ada source code that is compiled with gprbuild, so it is compiled source rather than a prebuilt binary — this is somewhat less severe than a prebuilt binary blob. However, the host is a personal/unofficial server with no verifiable connection to a canonical upstream project, meaning the source could be silently replaced at any time. The sha256sum provides integrity for the current download but does not protect against a future substitution at the same URL. The two additional files (adaogg.gpr, debug.pra) are provided inline in the PKGBUILD's source array without an upstream URL, which is unusual but not inherently malicious — they appear to be build project files. Overall this is a genuine medium-risk supply-chain concern: compiled source from a personal, non-canonical host with no independent verification path.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  rodakay5 @ gmail.com
    
      2
    
      3pkgname=adaogg
    
      4pkgver=2021.10.14
    
      5pkgrel=1
    
      6pkgdesc="A complete interface layer that brings the Ogg, Vorbis, and Theora libraries to the Ada 2012 programming language."
    
      7
    
      8arch=(i686 x86_64)
    
      9url=https://phasercat.com/adaogg
    
      10license=(GPL3)
    
      11
    
      12makedepends=(gprbuild)
    
      13
    
      14source=(https://phasercat.com/wp-content/uploads/2020/08/adaogg_10142021.zip
    
      15        adaogg.gpr
    
      16        debug.pra)
    
      17sha256sums=(30d2d50c3f6dc9d6998ced24dd26cb52a097c1b768e74b397ab8cfe2ae709c8a
    
      18            1d90650a88548354357f843cd3396a883493105a981492fbfefee088094ad128
    
      19            4514c213830bce24e2290046238e768daa54c7552d824afd832e018f5bcdffd9)
    
      20
    
      21prepare()
    
      22{
    
      23   cd $srcdir/adaogg
    
      24   
    
      25   cp ../adaogg.gpr .
    
      26   cp ../debug.pra  .
    
      27}
    
      28
    
      29
    
      30build()
    
      31{
    
      32   cd $srcdir/adaogg
    
      33
    
      34   gprbuild -P adaogg
    
      35}
    
      36
    
      37
    
      38package()
    
      39{
    
      40   cd $srcdir/adaogg
    
      41
    
      42   gprinstall -p -P adaogg.gpr --prefix="$pkgdir/usr"
    
      43
    
      44   # Install the license.
    
      45   #
    
      46   install -D -m644     \
    
      47      "License.txt"     \
    
      48      "$pkgdir/usr/share/licenses/$pkgname/License.txt"
    
      49}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2