arachnotron-bin

maintainer agvantibo · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads and installs a prebuilt binary (arachnotron) from nephrite.uk, which is the project's own personal/unofficial website rather than a recognized release platform like GitHub releases. The binary is executed directly on the user's system. While a sha256sum is provided (offering some integrity protection against transit tampering), the trust anchor is entirely the maintainer's personal web server — if that host is compromised or the maintainer is malicious, the checksum in the PKGBUILD would also be updated to match a malicious binary. There is no GPG signature verification. This is a classic supply-chain concern: an executed binary from an unofficial/personal host with no independent verification mechanism. The cheaper model's MEDIUM rating is correct.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:55 source=("http://nephrite.uk/storage/app/media/Doom/arachnotron-linux-lite-$pkgver.tar.gz" "arachnowrap")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads and installs a prebuilt binary (arachnotron) from nephrite.uk, which is the project's own personal/unofficial website rather than a recognized release platform like GitHub releases. The binary is executed directly on the user's system. While a sha256sum is provided (offering some integrity protection against transit tampering), the trust anchor is entirely the maintainer's personal web server — if that host is compromised or the maintainer is malicious, the checksum in the PKGBUILD would also be updated to match a malicious binary. There is no GPG signature verification. This is a classic supply-chain concern: an executed binary from an unofficial/personal host with no independent verification mechanism. The cheaper model's MEDIUM rating is correct.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Savchenko Dmitriy <apicalium@gmail.com>
    
      2pkgname="arachnotron-bin"
    
      3pkgver="1.1.4"
    
      4pkgrel=2
    
      5pkgdesc="Cross platform, advanced Doom launcher built with QT."
    
      6arch=('x86_64')
    
      7url="http://nephrite.uk/arachnotron"
    
      8license=('custom')
    
      9groups=()
    
      10depends=(
    
      11	'brotli'
    
      12	'bzip2'
    
      13	'double-conversion'
    
      14	'e2fsprogs'
    
      15	'freetype2'
    
      16	'gcc-libs'
    
      17	'glib2'
    
      18	'glibc'
    
      19	'graphite'
    
      20	'harfbuzz'
    
      21	'icu'
    
      22	'keyutils'
    
      23	'krb5'
    
      24	'libcap'
    
      25	'libgcrypt'
    
      26	'libglvnd'
    
      27	'libgpg-error'
    
      28	'libpng'
    
      29	'libx11'
    
      30	'libxau'
    
      31	'libxcb'
    
      32	'libxdmcp'
    
      33	'lz4'
    
      34	'md4c'
    
      35	'pcre2'
    
      36	'qt5-base'
    
      37	'qt5-declarative'
    
      38	'systemd-libs'
    
      39	'xz'
    
      40	'zlib'
    
      41	'zstd'
    
      42	'qt5-graphicaleffects'
    
      43	'qt5-quickcontrols'
    
      44	'qt5-quickcontrols2'
    
      45)
    
      46makedepends=('bash')
    
      47optdepends=()
    
      48provides=('arachnotron')
    
      49conflicts=('arachnotron-git')
    
      50replaces=()
    
      51backup=()
    
      52options=()
    
      53install=
    
      54changelog=
    
      55source=("http://nephrite.uk/storage/app/media/Doom/arachnotron-linux-lite-$pkgver.tar.gz" "arachnowrap")
    
      56noextract=()
    
      57sha256sums=('2653fcad69a97a7d3f9b96f6e0d80797f315592ffd15f1ab0d7045050fb935cf'
    
      58            'f2bf987cbedbb4b4c8afe72b5f714291628f74ae1cc1d05d3d953dfac2605feb')
    
      59
    
      60package() {
    
      61	cd "$srcdir"
    
      62	sed -i 's+/home/richard/Doom/IWADs/+USERPATH+g' config/settings.json
    
      63  	mkdir -pm 755 $pkgdir/opt/arachnotron
    
      64  	install -m 755 arachnotron $pkgdir/opt/arachnotron
    
      65  	cp -r --no-preserve=mode,ownership config $pkgdir/opt/arachnotron
    
      66  	install -D -m 755 arachnowrap $pkgdir/usr/bin/arachnotron
    
      67}
    
      68

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2