akvis-alivecolors-bin

maintainer sfs · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD has several genuine supply-chain concerns: (1) The source URL is set dynamically inside prepare() rather than in the top-level source=() array, bypassing makepkg's integrity verification entirely. (2) sha256sums is set to 'SKIP', so even if the source array were used correctly, no checksum verification would occur. (3) The binary .deb is downloaded from a DigitalOcean Spaces bucket (akvis-deb.sfo2.cdn.digitaloceanspaces.com) which, while plausibly operated by the AKVIS vendor, is not an official distribution channel that can be independently verified. (4) The version is determined dynamically by scraping the bucket listing at build time, meaning the actual binary installed could change between builds without any integrity check. The combination of a prebuilt binary, no checksum, and a non-standard CDN host with dynamic version resolution constitutes a real supply-chain risk. This is not clearly malicious but represents a genuine medium-severity concern.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:19 _pkgver="`wget -q --output-document=- https://akvis-deb.sfo2.cdn.digitaloceanspaces.com/ |tr ">" "\n" |grep "</Key" |grep akvis-alivecolors-bin_1 |awk -F_ '{print $2}' |tail -1`"

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 source=("https://akvis-deb.sfo2.cdn.digitaloceanspaces.com/pool/non-free/a/akvis-alivecolors-bin/akvis-alivecolors-bin_10.0+svn4853.29044-jks351_amd64.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): This PKGBUILD has several genuine supply-chain concerns: (1) The source URL is set dynamically inside prepare() rather than in the top-level source=() array, bypassing makepkg's integrity verification entirely. (2) sha256sums is set to 'SKIP', so even if the source array were used correctly, no checksum verification would occur. (3) The binary .deb is downloaded from a DigitalOcean Spaces bucket (akvis-deb.sfo2.cdn.digitaloceanspaces.com) which, while plausibly operated by the AKVIS vendor, is not an official distribution channel that can be independently verified. (4) The version is determined dynamically by scraping the bucket listing at build time, meaning the actual binary installed could change between builds without any integrity check. The combination of a prebuilt binary, no checksum, and a non-standard CDN host with dynamic version resolution constitutes a real supply-chain risk. This is not clearly malicious but represents a genuine medium-severity concern.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: sfs <sfslinux@gmail.com>
    
      2
    
      3pkgname=akvis-alivecolors-bin
    
      4pkgver=10.0+svn4853.29044_jks351
    
      5pkgrel=1
    
      6pkgdesc="Powerful photo/image editing tool by AKVIS Lab"
    
      7arch=('x86_64')
    
      8url="https://alivecolors.com"
    
      9license=('custom')
    
      10depends=('glibc' 'gcc-libs' 'mesa' 'libglvnd' 'qt-akvis2')
    
      11makedepends=('wget' 'tar' 'libarchive')
    
      12sha256sums=('SKIP')
    
      13
    
      14pkgver() {
    
      15    echo ${_pkgver} |sed 's/-/_/'
    
      16}
    
      17
    
      18prepare() {
    
      19    _pkgver="`wget -q --output-document=- https://akvis-deb.sfo2.cdn.digitaloceanspaces.com/ |tr ">" "\n" |grep "</Key" |grep akvis-alivecolors-bin_1 |awk -F_ '{print $2}' |tail -1`"
    
      20    source=("https://akvis-deb.sfo2.cdn.digitaloceanspaces.com/pool/non-free/a/akvis-alivecolors-bin/akvis-alivecolors-bin_10.0+svn4853.29044-jks351_amd64.deb")
    
      21    wget "$source" -O ${pkgname}-${_pkgver}-1.deb &&
    
      22        bsdtar -xf ${pkgname}-${_pkgver}-1.deb &&
    
      23	tar -xf data.tar.xz
    
      24}
    
      25
    
      26package() {
    
      27    cp -dr --no-preserve=ownership usr "${pkgdir}"/
    
      28}
    
      29

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 00:29:32	MEDIUM	3
2026-07-21 00:24:15	MEDIUM	3
2026-07-20 00:19:49	MEDIUM	3
2026-07-19 00:17:08	MEDIUM	3
2026-07-18 00:14:48	MEDIUM	3
2026-07-17 00:06:16	MEDIUM	3
2026-07-16 00:05:41	MEDIUM	3
2026-07-15 00:09:25	MEDIUM	3