arctimepro

maintainer fansuregrin · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary archive (containing a JAR, shell scripts, and bundled ffmpeg/ffprobe binaries) from t.arctime.cn, which is a subdomain of the official arctime.org project domain. This is not a random personal host — it appears to be the vendor's own CDN/download server. The SHA256 checksums are present and pinned, which mitigates substitution risk. However, the source is still a prebuilt binary blob (not source-built), and the host is an unofficial download URL rather than a well-known forge. The bundled ffmpeg binaries are executed at runtime, and the JAR is run directly. This is a classic medium-risk pattern: legitimate-looking vendor binary distribution from a non-standard URL with no reproducibility. The cheaper model's assessment is correct in classification, though the risk is somewhat mitigated by the checksums and the domain being vendor-controlled.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 "ARCTIME_PRO_${pkgver}_LINUX.7z::https://t.arctime.cn/nap2x"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary archive (containing a JAR, shell scripts, and bundled ffmpeg/ffprobe binaries) from t.arctime.cn, which is a subdomain of the official arctime.org project domain. This is not a random personal host — it appears to be the vendor's own CDN/download server. The SHA256 checksums are present and pinned, which mitigates substitution risk. However, the source is still a prebuilt binary blob (not source-built), and the host is an unofficial download URL rather than a well-known forge. The bundled ffmpeg binaries are executed at runtime, and the JAR is run directly. This is a classic medium-risk pattern: legitimate-looking vendor binary distribution from a non-standard URL with no reproducibility. The cheaper model's assessment is correct in classification, though the risk is somewhat mitigated by the checksums and the domain being vendor-controlled.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: fansuregrin <fansuregrin@outlook.com>
    
      2# Contributor: qaz <fkxxyz@163.com>
    
      3# Contributor: fansuregrin <fansuregrin@outlook.com>
    
      4pkgname=arctimepro
    
      5pkgver=4.1
    
      6pkgrel=2
    
      7pkgdesc="A Simple, powerful and efficient cross-platform subtitle production software"
    
      8arch=("i686" "x86_64")
    
      9url="https://arctime.org"
    
      10license=('custom')
    
      11depends=('hicolor-icon-theme' 'jre8-openjdk' 'vlc' 'sed')
    
      12conflicts=('arctime')
    
      13sha256sums=('9990e860ced9cd5bc50bfe66f84f2828e7c2af2c2dbfda90c304a01686ed96cb'
    
      14            '9f490a4fc4d4f15e31b15e84717e11ce794e908055484f22d02aa0a166093677'
    
      15            '406a3953b7b5d54814f6613f23badc0eff04909688d67295371aeeead862ae85'
    
      16            'fcd6ecf0a786658968d0c8747b860b5238c0df73c873642dd7ce5fca186d2122'
    
      17            'c9bc9ac2ffdc703b672c1f918ea4d48479693bdc69dfd346a077547de47ce7d1'
    
      18            'ccfbc0b0387dc2cefd4cad0653aa825226165f5890ff469605bb55d39b5b4992')
    
      19source=(
    
      20  "ARCTIME_PRO_${pkgver}_LINUX.7z::https://t.arctime.cn/nap2x"
    
      21  16x16.png
    
      22  24x24.png
    
      23  32x32.png
    
      24  48x48.png
    
      25  ${pkgname}.desktop
    
      26)
    
      27package() {
    
      28  # install icons
    
      29  for icon in *.png; do
    
      30    install -Dm 644 ${icon} "${pkgdir}/usr/share/icons/hicolor/${icon%.*}/apps/${pkgname}.png"
    
      31  done
    
      32  
    
      33  # install .desktop file 
    
      34  install -Dm 644 ${pkgname}.desktop "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      35  
    
      36  # install app resources and executable file
    
      37  cd "${srcdir}/ARCTIME_PRO_${pkgver}_LINUX"	
    
      38  install -dm 755 "${pkgdir}/opt/${pkgname}"
    
      39  cp -r "./ArcTime_lib" "${pkgdir}/opt/${pkgname}/"
    
      40  cp -r "./resources" "${pkgdir}/opt/${pkgname}/"
    
      41  cp -r "./tools" "${pkgdir}/opt/${pkgname}/"
    
      42  install -D "./run.sh" "${pkgdir}/opt/${pkgname}/run.sh"
    
      43  sed -i '2,6d' "${pkgdir}/opt/${pkgname}/run.sh"
    
      44  sed -i "3 icd /opt/${pkgname}/" "${pkgdir}/opt/${pkgname}/run.sh"
    
      45  sed -i 's/java-8-openjdk-amd64/java-8-openjdk/g' "${pkgdir}/opt/${pkgname}/run.sh"
    
      46  install -D "./bin.jar" "${pkgdir}/opt/${pkgname}/bin.jar"
    
      47
    
      48  # change permissions
    
      49  chmod 755 "${pkgdir}/opt/${pkgname}/tools/x86/ffmpeg-linux32"
    
      50  chmod 755 "${pkgdir}/opt/${pkgname}/tools/x86/ffprobe-linux32"
    
      51  chmod 755 "${pkgdir}/opt/${pkgname}/tools/x64/ffmpeg-linux64"
    
      52  chmod 755 "${pkgdir}/opt/${pkgname}/tools/x64/ffprobe-linux64"
    
      53  for res in ${pkgdir}/opt/${pkgname}/resources/*; do
    
      54    chmod 644 ${res};
    
      55  done
    
      56  for lib in ${pkgdir}/opt/${pkgname}/ArcTime_lib/*;do
    
      57    chmod 644 ${lib};
    
      58  done
    
      59
    
      60  # make softlink
    
      61  install -dm 755 "${pkgdir}/usr/bin"
    
      62  ln -sf "/opt/${pkgname}/run.sh" "${pkgdir}/usr/bin/${pkgname}"
    
      63}
    
      64

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2