aio-creator-neo

maintainer Auerhuhn · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt Windows installer executable (.exe) from an AWS S3 bucket (mediola-download on s3-eu-west-1.amazonaws.com) and extracts it with innoextract for installation. The S3 bucket is vendor-controlled (mediola.com) and the download has a sha512sum checksum, which mitigates but does not eliminate supply-chain risk — the checksum only protects against in-transit tampering, not against the vendor silently replacing the file at the same URL. The extracted binary is then installed into /opt and run via Wine. This is a real medium-severity concern: a prebuilt proprietary executable from a cloud-hosted bucket (even a vendor-owned one) that gets executed on the user's system. The sha512sum provides integrity verification against the pinned hash, which is the standard AUR mitigation. This is a legitimate but inherently risky pattern (closed-source Windows binary repackaged for Linux via Wine), consistent with a MEDIUM rating rather than high (no obfuscation, no unofficial/personal host, checksum present) or clean (executed foreign binary from a swappable S3 URL).

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:31 "${pkgname}-${pkgver}-installer.exe::https://s3-eu-west-1.amazonaws.com/mediola-download/creator_neo/release/${_pkgver_major_minor}/${pkgver}/aioCreatorNeoInstaller.exe"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt Windows installer executable (.exe) from an AWS S3 bucket (mediola-download on s3-eu-west-1.amazonaws.com) and extracts it with innoextract for installation. The S3 bucket is vendor-controlled (mediola.com) and the download has a sha512sum checksum, which mitigates but does not eliminate supply-chain risk — the checksum only protects against in-transit tampering, not against the vendor silently replacing the file at the same URL. The extracted binary is then installed into /opt and run via Wine. This is a real medium-severity concern: a prebuilt proprietary executable from a cloud-hosted bucket (even a vendor-owned one) that gets executed on the user's system. The sha512sum provides integrity verification against the pinned hash, which is the standard AUR mitigation. This is a legitimate but inherently risky pattern (closed-source Windows binary repackaged for Linux via Wine), consistent with a MEDIUM rating rather than high (no obfuscation, no unofficial/personal host, checksum present) or clean (executed foreign binary from a swappable S3 URL).

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Claudia Pellegrino <aur ät cpellegrino.de>
    
      2
    
      3pkgname=aio-creator-neo
    
      4pkgver=3.3.0
    
      5pkgrel=1
    
      6pkgdesc='Design a custom app to control your smart home. Supports many vendors.'
    
      7arch=('x86_64')
    
      8url='https://www.mediola.com/en/products#aio-creator-neo'
    
      9license=('LicenseRef-eula')
    
      10depends=(
    
      11  'bash'
    
      12  'coreutils'
    
      13  'dxvk'
    
      14  'lib32-gnutls'
    
      15  'lib32-libxcomposite'
    
      16  'wine'
    
      17  'wine-mono'
    
      18  'wine-gecko'
    
      19  'winetricks'
    
      20  'zenity'
    
      21)
    
      22makedepends=('innoextract')
    
      23options=('!debug' '!strip')
    
      24install="${pkgname}.install"
    
      25
    
      26# The vendor’s EULA is available online. To update it, run:
    
      27# curl -L 'https://www.mediola.com/eula' | html2text --body-width=80 | awk '/^###\s.*(EULA)/,/^####$/ { print }' | head -n -2 > eula.md
    
      28
    
      29_pkgver_major_minor="$(cut -d . -f -2 <<< "${pkgver}")"
    
      30source=(
    
      31  "${pkgname}-${pkgver}-installer.exe::https://s3-eu-west-1.amazonaws.com/mediola-download/creator_neo/release/${_pkgver_major_minor}/${pkgver}/aioCreatorNeoInstaller.exe"
    
      32  "${pkgname}.bash"
    
      33  'eula.md'
    
      34)
    
      35
    
      36sha512sums=('4465187fea388e81b13cd1347eb29485138b2d80379a2b589c6770282e43c4503ff874047fb710d026ec20dedd6b0a460dd976ba1d07e066e0d2b11e6cb70b67'
    
      37            '9193c75fc94b5ed357eb7be603760a9bd881aac1f00270573a431d756935308317290dd5b34bd4f0c22cf0959b7a10cdeec14bfcb253d9a9a13aa3b6ae13b303'
    
      38            'c9110733aa9269fba458cb06b676f425455d4d1f0181b69e1a26345216802ae1ca2010915f75d3692dbb1ef5df9ac92986c3ee34322d9b9c96acf6e618c6ba5f')
    
      39
    
      40prepare() {
    
      41  innoextract -d "${srcdir}" "${pkgname}-${pkgver}-installer.exe"
    
      42}
    
      43
    
      44package() {
    
      45  echo >&2 'Packaging credits.html'
    
      46  install -D -m 644 -t "${pkgdir}/usr/share/doc/${pkgname}" \
    
      47    "${srcdir}/app/aio_creator_neo/credits.html"
    
      48
    
      49  echo >&2 'Packaging license files'
    
      50  install -D -m 644 -t "${pkgdir}/usr/share/licenses/${pkgname}" \
    
      51    'eula.md' \
    
      52    "${srcdir}/app/aio_creator_neo/licenses/files"/*
    
      53
    
      54  echo >&2 'Packaging the executable'
    
      55  install -D -m 755 -T "${srcdir}/aio-creator-neo.bash" \
    
      56    "${pkgdir}/usr/bin/aio-creator-neo"
    
      57
    
      58  echo >&2 'Packaging app files'
    
      59  mkdir -p "${pkgdir}/opt/${pkgname}"
    
      60  cp -r --preserve=mode "${srcdir}/app" "${srcdir}/commonappdata" \
    
      61    "${pkgdir}/opt/${pkgname}/"
    
      62}
    
      63

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2