arachnotron-bin

MEDIUM

maintainer agvantibo 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The PKGBUILD downloads and installs a prebuilt binary (arachnotron) from nephrite.uk, which is the project's own personal/unofficial website rather than a recognized release platform like GitHub releases. The binary is executed directly on the user's system. While a sha256sum is provided (offering some integrity protection against transit tampering), the trust anchor is entirely the maintainer's personal web server — if that host is compromised or the maintainer is malicious, the checksum in the PKGBUILD would also be updated to match a malicious binary. There is no GPG signature verification. This is a classic supply-chain concern: an executed binary from an unofficial/personal host with no independent verification mechanism. The cheaper model's MEDIUM rating is correct.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:55 source=("http://nephrite.uk/storage/app/media/Doom/arachnotron-linux-lite-$pkgver.tar.gz" "arachnowrap")

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads and installs a prebuilt binary (arachnotron) from nephrite.uk, which is the project's own personal/unofficial website rather than a recognized release platform like GitHub releases. The binary is executed directly on the user's system. While a sha256sum is provided (offering some integrity protection against transit tampering), the trust anchor is entirely the maintainer's personal web server — if that host is compromised or the maintainer is malicious, the checksum in the PKGBUILD would also be updated to match a malicious binary. There is no GPG signature verification. This is a classic supply-chain concern: an executed binary from an unofficial/personal host with no independent verification mechanism. The cheaper model's MEDIUM rating is correct.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Savchenko Dmitriy <apicalium@gmail.com>
    
      2pkgname="arachnotron-bin"
    
      3pkgver="1.1.4"
    
      4pkgrel=2
    
      5pkgdesc="Cross platform, advanced Doom launcher built with QT."
    
      6arch=('x86_64')
    
      7url="http://nephrite.uk/arachnotron"
    
      8license=('custom')
    
      9groups=()
    
      10depends=(
    
      11	'brotli'
    
      12	'bzip2'
    
      13	'double-conversion'
    
      14	'e2fsprogs'
    
      15	'freetype2'
    
      16	'gcc-libs'
    
      17	'glib2'
    
      18	'glibc'
    
      19	'graphite'
    
      20	'harfbuzz'
    
      21	'icu'
    
      22	'keyutils'
    
      23	'krb5'
    
      24	'libcap'
    
      25	'libgcrypt'
    
      26	'libglvnd'
    
      27	'libgpg-error'
    
      28	'libpng'
    
      29	'libx11'
    
      30	'libxau'
    
      31	'libxcb'
    
      32	'libxdmcp'
    
      33	'lz4'
    
      34	'md4c'
    
      35	'pcre2'
    
      36	'qt5-base'
    
      37	'qt5-declarative'
    
      38	'systemd-libs'
    
      39	'xz'
    
      40	'zlib'
    
      41	'zstd'
    
      42	'qt5-graphicaleffects'
    
      43	'qt5-quickcontrols'
    
      44	'qt5-quickcontrols2'
    
      45)
    
      46makedepends=('bash')
    
      47optdepends=()
    
      48provides=('arachnotron')
    
      49conflicts=('arachnotron-git')
    
      50replaces=()
    
      51backup=()
    
      52options=()
    
      53install=
    
      54changelog=
    
      55source=("http://nephrite.uk/storage/app/media/Doom/arachnotron-linux-lite-$pkgver.tar.gz" "arachnowrap")
    
      56noextract=()
    
      57sha256sums=('2653fcad69a97a7d3f9b96f6e0d80797f315592ffd15f1ab0d7045050fb935cf'
    
      58            'f2bf987cbedbb4b4c8afe72b5f714291628f74ae1cc1d05d3d953dfac2605feb')
    
      59
    
      60package() {
    
      61	cd "$srcdir"
    
      62	sed -i 's+/home/richard/Doom/IWADs/+USERPATH+g' config/settings.json
    
      63  	mkdir -pm 755 $pkgdir/opt/arachnotron
    
      64  	install -m 755 arachnotron $pkgdir/opt/arachnotron
    
      65  	cp -r --no-preserve=mode,ownership config $pkgdir/opt/arachnotron
    
      66  	install -D -m 755 arachnowrap $pkgdir/usr/bin/arachnotron
    
      67}
    
      68

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2