artiphon-instrument-one-editor

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt Windows installer (.exe) from a Google Cloud Storage bucket (storage.googleapis.com/artiphon-preset-editor/), which is the vendor's own GCS bucket used for distribution — this is a common pattern for small hardware/software vendors who use GCS as a CDN. The exe is unpacked with 7z, and the app.asar (Electron application archive) is extracted and installed to run under electron4. The sha256sum is pinned, which mitigates silent substitution risk. The main concern is that an .asar file (which contains executable JavaScript) is extracted from a Windows binary and run directly under Electron on Linux — this is an executed artifact from a non-standard host. While the GCS bucket appears to be the official Artiphon distribution channel (matching the vendor URL artiphon.com/pages/downloads), it is not a verifiable official Linux package source, and the .asar content is opaque JS code that runs with Electron privileges. This is a genuine medium-severity supply-chain concern: executed code from an unofficial/vendor-controlled binary host, not a false positive, but also not clearly malicious.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("https://storage.googleapis.com/artiphon-preset-editor/Artiphon%20INSTRUMENT%201%20Editor%20Setup%20${pkgver}.exe")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt Windows installer (.exe) from a Google Cloud Storage bucket (storage.googleapis.com/artiphon-preset-editor/), which is the vendor's own GCS bucket used for distribution — this is a common pattern for small hardware/software vendors who use GCS as a CDN. The exe is unpacked with 7z, and the app.asar (Electron application archive) is extracted and installed to run under electron4. The sha256sum is pinned, which mitigates silent substitution risk. The main concern is that an .asar file (which contains executable JavaScript) is extracted from a Windows binary and run directly under Electron on Linux — this is an executed artifact from a non-standard host. While the GCS bucket appears to be the official Artiphon distribution channel (matching the vendor URL artiphon.com/pages/downloads), it is not a verifiable official Linux package source, and the .asar content is opaque JS code that runs with Electron privileges. This is a genuine medium-severity supply-chain concern: executed code from an unofficial/vendor-controlled binary host, not a false positive, but also not clearly malicious.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: BrainDamage
    
      2
    
      3pkgname=artiphon-instrument-one-editor
    
      4pkgver=1.0.20
    
      5pkgrel=1
    
      6pkgdesc="is an interface for customizing the settings of your INSTRUMENT 1."
    
      7arch=('any')
    
      8url="https://artiphon.com/pages/downloads"
    
      9license=('custom:commercial')
    
      10depends=('electron4')
    
      11makedepends=('p7zip' 'icoutils' 'imagemagick')
    
      12source=("https://storage.googleapis.com/artiphon-preset-editor/Artiphon%20INSTRUMENT%201%20Editor%20Setup%20${pkgver}.exe")
    
      13sha256sums=('ae07e6be3803bc8339cd250c0681b2c11f5a8cc24fdafa8cc5beedbb85dd4ec8')
    
      14
    
      15build() {
    
      16	cd "${srcdir}"
    
      17
    
      18	7z -y e "Artiphon%20INSTRUMENT%201%20Editor%20Setup%20${pkgver}.exe"
    
      19	7z -y e "app-64.7z" -o"${pkgname}-data"
    
      20
    
      21	cat - > "${pkgname}" <<- EOF
    
      22		#!/bin/env sh
    
      23		exec electron4 "/usr/share/${pkgname}/app.asar"
    
      24	EOF
    
      25
    
      26	wrestool -x -t 3 -n 1 -R "${pkgname}-data/Artiphon INSTRUMENT 1 Editor.exe" > "${pkgname}.png"
    
      27	for size in 16 32 64 256; do
    
      28		convert "${pkgname}.png" -resize "${size}x${size}" "${pkgname}-${size}x${size}.png"
    
      29	done
    
      30
    
      31	cat - > "${pkgname}.desktop" <<- EOF
    
      32		[Desktop Entry]
    
      33		Type=Application
    
      34		Name=Artiphon Instrument One Editor
    
      35		Comment=The Artiphon INSTRUMENT 1 Editor is an interface for customizing the settings of your INSTRUMENT 1.
    
      36		Exec="${pkgname}"
    
      37		Icon="${pkgname}"
    
      38		Categories=Music;Audio;Multimedia;
    
      39	EOF
    
      40}
    
      41
    
      42package() {
    
      43	cd "${srcdir}"
    
      44
    
      45	mkdir -pv "${pkgdir}/usr/bin"
    
      46	install -Dvm 755 "${pkgname}" -t "${pkgdir}/usr/bin"
    
      47
    
      48	mkdir -pv "${pkgdir}/usr/share/${pkgname}"
    
      49	find "${pkgname}-data" -iname '*.asar' -exec install -Dvm 644 {} -t "${pkgdir}/usr/share/${pkgname}" \;
    
      50
    
      51	mkdir -pv "${pkgdir}/usr/share/applications"
    
      52	install -Dvm 644 "${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
    
      53
    
      54	for size in 16 32 64 256; do
    
      55		mkdir -pv "${pkgdir}/usr/share/icons/hicolor/${size}x${size}/apps"
    
      56		install -Dvm 644 "${pkgname}-${size}x${size}.png" "${pkgdir}/usr/share/icons/hicolor/${size}x${size}/apps/${pkgname}.png"
    
      57	done
    
      58}
    
      59

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2