amlite

maintainer bsvh · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The source is a shell-script-wrapped tarball downloaded from a Google Cloud Storage bucket (storage.googleapis.com) under what appears to be a vendor-controlled app-engine bucket (software-download-d79bb.appspot.com). The PKGBUILD extracts the binary payload embedded inside the shell script using sed/tar and then installs several shared libraries (libamcam.so, libamnam.so, libamsam.so, libimagepro.so) and a binary (AmLite) directly. The checksums (sha256 and b2) are present for the downloaded archive, which mitigates the 'no checksum' concern raised by the cheaper model — the SKIP only applies to the local .desktop file, not the upstream tarball. The real concern is that this is a proprietary closed-source binary and shared libraries from a non-official (GCS bucket) host rather than a distro mirror or the vendor's own CDN, and the sed-extraction pattern is unusual. However, the checksums are pinned, so substitution attacks are partially mitigated. This is a legitimate medium: closed-source executed binaries and shared libraries from a personal/vendor GCS bucket with no source code, but not an active attack.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:38 "https://storage.googleapis.com/software-download-d79bb.appspot.com/software/AmLite/Linux/${pkgver}/AmScopeAmLite.${_arch}.tar.bz2"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The source is a shell-script-wrapped tarball downloaded from a Google Cloud Storage bucket (storage.googleapis.com) under what appears to be a vendor-controlled app-engine bucket (software-download-d79bb.appspot.com). The PKGBUILD extracts the binary payload embedded inside the shell script using sed/tar and then installs several shared libraries (libamcam.so, libamnam.so, libamsam.so, libimagepro.so) and a binary (AmLite) directly. The checksums (sha256 and b2) are present for the downloaded archive, which mitigates the 'no checksum' concern raised by the cheaper model — the SKIP only applies to the local .desktop file, not the upstream tarball. The real concern is that this is a proprietary closed-source binary and shared libraries from a non-official (GCS bucket) host rather than a distro mirror or the vendor's own CDN, and the sed-extraction pattern is unusual. However, the checksums are pinned, so substitution attacks are partially mitigated. This is a legitimate medium: closed-source executed binaries and shared libraries from a personal/vendor GCS bucket with no source code, but not an active attack.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Brendan Van Hook <brendan@vastactive.com>
    
      2# Contributer: Gabriel-Andrew Pollo-Guilbert <gabrielpolloguilbert@gmail.com>
    
      3#
    
      4
    
      5pkgname=amlite
    
      6pkgver=20232603
    
      7pkgrel=1
    
      8pkgdesc='AmScope software'
    
      9arch=('i686' 'x86_64')
    
      10url='https://www.amscope.com/'
    
      11license=('custom')
    
      12
    
      13if [[ "$CARCH" == "x86_64" ]]; then
    
      14    _arch="x64"
    
      15    b2=(
    
      16	"86995550619c68533c54cf3eb9f01a5e23c3469ff9cc4bc93bef33b5e747f0e69777d8fe7ba5ebf0cdf39cb6656ea6b220a7ef6577d211ec8719a6d02a314896"
    
      17	"SKIP"
    
      18    )
    
      19    sha256sums=(
    
      20	"1b2037a20b69b0d03fa5321adb585af4fd58b4d134ade4434c023b54e71dc676"
    
      21	"SKIP"
    
      22    )
    
      23elif [[ "$CARCH" == "i686" ]]; then
    
      24    _arch="x86"
    
      25    b2=(
    
      26	"091b8f8c7674d9856caebd1daf763c90fec1be05d032dd594bb1d7b98d86302c02de76148e6eb457a03ee80a822b005450cf4b8ee7f18f81f45eda1653136464"
    
      27	"SKIP"
    
      28    )
    
      29    sha256sums=(
    
      30	"77a9c67180396bdd425474231b973ec2fe015370d5e32263cb2a45efe81fce84"
    
      31	"SKIP"
    
      32    )
    
      33else
    
      34    exit 1
    
      35fi
    
      36
    
      37source=(
    
      38    "https://storage.googleapis.com/software-download-d79bb.appspot.com/software/AmLite/Linux/${pkgver}/AmScopeAmLite.${_arch}.tar.bz2"
    
      39    "amlite.desktop"
    
      40)
    
      41
    
      42_script="AmScopeAmLite.${_arch}.sh"
    
      43
    
      44
    
      45prepare() {
    
      46    cd "$srcdir"
    
      47
    
      48    # Extract the binary package from the install script
    
      49    sed -n -e '1,/^exit 0$/!p' "$_script" > /tmp/mytar.tar.gz
    
      50    tar xzf /tmp/mytar.tar.gz
    
      51}
    
      52
    
      53package() {
    
      54    cd "$srcdir"
    
      55
    
      56    # Everything is hardcoded to  /usr/local
    
      57    install -Dm755 AmLite "${pkgdir}/usr/local/amlite/AmLite"
    
      58    cp -r i18n "${pkgdir}/usr/local/amlite/"
    
      59
    
      60    install -m755 libamcam.so "${pkgdir}/usr/local/amlite/libamcam.so"
    
      61    install -m755 libamnam.so "${pkgdir}/usr/local/amlite/libamnam.so"
    
      62    install -m755 libamsam.so "${pkgdir}/usr/local/amlite/libamsam.so"
    
      63    install -m755 libimagepro.so "${pkgdir}/usr/local/amlite/libimagepro.so"
    
      64
    
      65    install -Dm644 99-amcam.rules "${pkgdir}/usr/lib/udev/rules.d/99-amcam.rules"
    
      66
    
      67    # Make symlinks to usual places
    
      68    mkdir -p "${pkgdir}/usr/bin"
    
      69    ln -s /usr/local/amlite/AmLite "${pkgdir}/usr/bin/AmLite"
    
      70
    
      71    mkdir -p "${pkgdir}/usr/share/pixmaps"
    
      72    ln -s /usr/local/amlite/AmLite.png "${pkgdir}/usr/share/pixmaps/amlite.png"
    
      73
    
      74    cd "$srcdir"
    
      75
    
      76}
    
      77

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2