aftershotpro3

maintainer ava1ar · 16 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt RPM binary from dwnld.aftershotpro.com, which is the official Corel AfterShot Pro download subdomain (Corel owns AfterShot Pro and uses this domain for trial downloads). The sha1sum is pinned, providing integrity verification. However, the URL points to a floating 'AfterShotPro3.rpm' path (not a versioned/immutable URL), meaning the file at that URL could change without the checksum catching it on a fresh download if the remote file is updated — though the pinned sha1 would then cause a mismatch and fail the build. The binary is a proprietary closed-source executable blob installed into /opt, which is a real supply-chain concern if the host were compromised or the URL silently redirected. The domain is plausibly official (Corel's trial distribution host), but it is not a standard package repository. Overall this is a legitimate medium: executed proprietary binary from a vendor-controlled but non-standard host, with a pinned checksum providing some mitigation.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=(AfterShotPro_${pkgver}.rpm::http://dwnld.aftershotpro.com/trials/3/AfterShotPro3.rpm license.txt)

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt RPM binary from dwnld.aftershotpro.com, which is the official Corel AfterShot Pro download subdomain (Corel owns AfterShot Pro and uses this domain for trial downloads). The sha1sum is pinned, providing integrity verification. However, the URL points to a floating 'AfterShotPro3.rpm' path (not a versioned/immutable URL), meaning the file at that URL could change without the checksum catching it on a fresh download if the remote file is updated — though the pinned sha1 would then cause a mismatch and fail the build. The binary is a proprietary closed-source executable blob installed into /opt, which is a real supply-chain concern if the host were compromised or the URL silently redirected. The domain is plausibly official (Corel's trial distribution host), but it is not a standard package repository. Overall this is a legitimate medium: executed proprietary binary from a vendor-controlled but non-standard host, with a pinned checksum providing some mitigation.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: ava1ar <mail@ava1ar.me>
    
      2
    
      3pkgname=aftershotpro3
    
      4pkgver=3.7.0.446
    
      5pkgrel=2
    
      6pkgdesc="Professional Workflow and RAW Conversion (3rd version)"
    
      7url="http://www.aftershotpro.com/en/products/aftershot/pro"
    
      8arch=('x86_64')
    
      9license=('custom')
    
      10depends=('gstreamer0.10-base' 'ocl-icd')
    
      11optdepends=('opencl-nvidia' 'opencl-clover-mesa' 'opencl-amd')
    
      12source=(AfterShotPro_${pkgver}.rpm::http://dwnld.aftershotpro.com/trials/3/AfterShotPro3.rpm license.txt)
    
      13sha1sums=('772b1db13ac93cf9c164b82394de3df10add4cf5'
    
      14          '564fa56309798c82852e25f204f75834ebcf08fd')
    
      15
    
      16package() {
    
      17	# coping rpm content
    
      18	mv ${srcdir}/opt ${pkgdir}/
    
      19	install -d ${pkgdir}/usr/share
    
      20	mv ${srcdir}/usr/bin ${pkgdir}/usr/
    
      21	mv ${srcdir}/usr/share/{applications,pixmaps} ${pkgdir}/usr/share/
    
      22	install -d ${pkgdir}/usr/share/mime/packages/
    
      23	mv ${srcdir}/usr/share/mime/packages/* ${pkgdir}/usr/share/mime/packages/
    
      24
    
      25	# install license
    
      26	install -Dm644 license.txt ${pkgdir}/usr/share/licenses/${pkgname}/license.txt
    
      27}
    
      28

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2