amp-locker-lv2-bin

maintainer rgh_software · 0 votes · base amp-locker · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD installs prebuilt proprietary binaries (LV2/VST3 plugins and a standalone executable) downloaded from an S3 bucket (audioassaultdownloads.s3.amazonaws.com). The S3 URL is plausibly the vendor's official distribution channel for Audio Assault's Amp Locker product, which matches the package URL (audioassault.mx/amplocker). However, S3 buckets are not immutable — the object at that path could be silently replaced without any version change, and there is no GPG signature verification, only a sha256sum. The sha256sum does provide integrity checking against the specific downloaded artifact, which mitigates the silent-swap risk somewhat. The binaries are executed directly (installed as 755). This is a standard pattern for proprietary audio plugin AUR packages (-bin suffix, EULA license, prebuilt blobs from vendor hosting), and the S3 bucket name strongly suggests it is the vendor's own distribution infrastructure. The risk is real but typical for this class of package — a medium rating is appropriate rather than high, as there is no evidence of unofficial/personal hosting or obfuscation.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 'https://audioassaultdownloads.s3.amazonaws.com/AmpLocker/AmpLocker109/AmpLockerLinux.zip')

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD installs prebuilt proprietary binaries (LV2/VST3 plugins and a standalone executable) downloaded from an S3 bucket (audioassaultdownloads.s3.amazonaws.com). The S3 URL is plausibly the vendor's official distribution channel for Audio Assault's Amp Locker product, which matches the package URL (audioassault.mx/amplocker). However, S3 buckets are not immutable — the object at that path could be silently replaced without any version change, and there is no GPG signature verification, only a sha256sum. The sha256sum does provide integrity checking against the specific downloaded artifact, which mitigates the silent-swap risk somewhat. The binaries are executed directly (installed as 755). This is a standard pattern for proprietary audio plugin AUR packages (-bin suffix, EULA license, prebuilt blobs from vendor hosting), and the S3 bucket name strongly suggests it is the vendor's own distribution infrastructure. The risk is real but typical for this class of package — a medium rating is appropriate rather than high, as there is no evidence of unofficial/personal hosting or obfuscation.

PKGBUILD

1 offending line(s) highlighted

      1pkgbase=amp-locker
    
      2pkgname=(${pkgbase}-{data,standalone,lv2,vst3}-bin)
    
      3pkgver=1.4.5
    
      4pkgrel=1
    
      5arch=('x86_64')
    
      6url="https://audioassault.mx/amplocker"
    
      7license=('EULA')
    
      8depends=('alsa-lib' 'bzip2' 'brotli' 'freetype2' 'glibc' 'graphite' 'harfbuzz' 'keyutils' 'krb5' 'libcurl-gnutls' 'libffi' 'libnghttp2' 'libidn2' 'libp11-kit' 'libpng' 'libpsl' 'libssh2' 'libtasn1' 'libunistring' 'libxau' 'libxcb' 'libx11' 'nettle' 'openssl' 'pcre2' 'zlib' 'zstd')
    
      9makedepends=('xdg-user-dirs')
    
      10provides=('amp-locker')
    
      11source=('Amp Locker.desktop'
    
      12	'Amp Locker Linker'
    
      13	'amp-locker.png'
    
      14	'https://audioassaultdownloads.s3.amazonaws.com/AmpLocker/AmpLocker109/AmpLockerLinux.zip')
    
      15sha256sums=('bbeb596d62ed9943294ee5025ba690def02e263b5c9b3b88304ee84607c52f53'
    
      16	'7784d4c4cf7bd953b52c34268cfd92dae1e23028e15c77b8e9e3ebd4970d0e80'
    
      17	'2ccb54d693ba09c2f86750891f2d1ea090f74fe282c3268617d1519b58f79ad5'
    
      18	'80f717c60e10b275a5bf7c9b6951c3816990c4fedac1c9e9d2b8830be7c784ec')
    
      19
    
      20package_amp-locker-data-bin() {
    
      21	## Install Asset Data
    
      22	pkgdesc="Audio Assault Multiamp Simulator (Data Assets)"
    
      23	groups=('pro-audio')
    
      24
    
      25	## Make data assets dir
    
      26	mkdir -p "$pkgdir/usr/lib/AmpLockerData"
    
      27
    
      28	## Copy assets to data directory
    
      29	cp -r "$srcdir/AmpLockerData/"* "$pkgdir/usr/lib/AmpLockerData"
    
      30
    
      31	## Install Amp Locker Linker Script
    
      32	install -Dm755 "$srcdir/Amp Locker Linker" "$pkgdir/usr/bin/Amp Locker Linker"
    
      33}
    
      34
    
      35package_amp-locker-lv2-bin() {
    
      36	## Install LV2 Plugin
    
      37	pkgdesc="Audio Assault Multiamp Simulator (LV2)"
    
      38	depends=('amp-locker-data-bin')
    
      39	groups=('pro-audio' 'lv2-plugins')
    
      40	install -Dm755 "$srcdir/Amp Locker.lv2/Amp Locker.so" "$pkgdir/usr/lib/lv2/Amp Locker.lv2/Amp Locker.so"
    
      41	install -Dm644 "$srcdir/Amp Locker.lv2/dsp.ttl" "$pkgdir/usr/lib/lv2/Amp Locker.lv2/dsp.ttl"
    
      42	install -Dm644 "$srcdir/Amp Locker.lv2/manifest.ttl" "$pkgdir/usr/lib/lv2/Amp Locker.lv2/manifest.ttl"
    
      43	install -Dm644 "$srcdir/Amp Locker.lv2/ui.ttl" "$pkgdir/usr/lib/lv2/Amp Locker.lv2/ui.ttl"
    
      44}
    
      45
    
      46package_amp-locker-vst3-bin() {
    
      47	## Install VST3 Plugin
    
      48	pkgdesc="Audio Assault Multiamp Simulator (VST3)"
    
      49	depends=('amp-locker-data-bin')
    
      50	groups=('pro-audio' 'vst3-plugins')
    
      51	install -Dm755 "$srcdir/Amp Locker.vst3/Contents/x86_64-linux/Amp Locker.so" "$pkgdir/usr/lib/vst3/Amp Locker.vst3/Contents/x86_64-linux/Amp Locker.so"
    
      52}
    
      53
    
      54package_amp-locker-standalone-bin() {
    
      55	## Install Standalone Binary
    
      56	pkgdesc="Audio Assault Multiamp Simulator (Standalone)"
    
      57	depends=('amp-locker-data-bin')
    
      58	groups=('pro-audio')
    
      59	install -Dm644 "$srcdir/Amp Locker.desktop" "$pkgdir/usr/share/applications/Amp Locker.desktop"
    
      60	install -Dm644 "$srcdir/amp-locker.png" "$pkgdir/usr/share/icons/hicolor/192x192/apps/amp-locker.png"
    
      61	install -Dm755 "$srcdir/Amp Locker Standalone" "$pkgdir/usr/bin/Amp Locker Standalone"
    
      62}
    
      63

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2