asset-hoard-bin

maintainer assethoard · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary package from a non-whitelisted host (releases.assethoard.com), which could be swapped by an attacker; although PGP signature is checked, the checksum for the signature is skipped, reducing assurance.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 "https://releases.assethoard.com/v${pkgver}/asset-hoard_${pkgver}_x86_64.pkg.tar.zst"

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt binary package from a non-whitelisted host (releases.assethoard.com), which could be swapped by an attacker; although PGP signature is checked, the checksum for the signature is skipped, reducing assurance.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Asset Hoard <support@assethoard.com>
    
      2pkgname=asset-hoard-bin
    
      3_pkgname=asset-hoard
    
      4pkgver=0.1.20
    
      5pkgrel=1
    
      6pkgdesc="Game asset manager for organizing models, textures, sprites, and audio"
    
      7arch=('x86_64')
    
      8url="https://assethoard.com"
    
      9license=('custom:Proprietary')
    
      10depends=('webkit2gtk-4.1' 'gtk3' 'libappindicator-gtk3' 'librsvg' 'openssl' 'glib2' 'cairo' 'pango' 'gdk-pixbuf2' 'alsa-lib')
    
      11provides=('asset-hoard')
    
      12conflicts=('asset-hoard')
    
      13source=(
    
      14  "https://releases.assethoard.com/v${pkgver}/asset-hoard_${pkgver}_x86_64.pkg.tar.zst"
    
      15  "https://releases.assethoard.com/v${pkgver}/asset-hoard_${pkgver}_x86_64.pkg.tar.zst.sig"
    
      16)
    
      17sha256sums=('3ab96418efd66ff07bf0d36d74bc8f1e11869fa28e54eb37062fa00efb4b7270' 'SKIP')
    
      18validpgpkeys=('2FE350A912F4525659E418CAA9B027A1392E7305')
    
      19options=('!strip')
    
      20
    
      21package() {
    
      22  cd "$srcdir"
    
      23  bsdtar -x -f "asset-hoard_${pkgver}_x86_64.pkg.tar.zst" -C "$pkgdir" \
    
      24    --exclude .BUILDINFO --exclude .MTREE --exclude .PKGINFO
    
      25}
    
      26

Changes since previous scan

--- PKGBUILD @ 2026-07-31 00:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,7 +1,7 @@
 # Maintainer: Asset Hoard <support@assethoard.com>
 pkgname=asset-hoard-bin
 _pkgname=asset-hoard
-pkgver=0.1.19
+pkgver=0.1.20
 pkgrel=1
 pkgdesc="Game asset manager for organizing models, textures, sprites, and audio"
 arch=('x86_64')
@@ -14,7 +14,7 @@
   "https://releases.assethoard.com/v${pkgver}/asset-hoard_${pkgver}_x86_64.pkg.tar.zst"
   "https://releases.assethoard.com/v${pkgver}/asset-hoard_${pkgver}_x86_64.pkg.tar.zst.sig"
 )
-sha256sums=('174fa4df3c85b28d273783f31d8af26ea6fb6873c44220178fa8a1e579ced977' 'SKIP')
+sha256sums=('3ab96418efd66ff07bf0d36d74bc8f1e11869fa28e54eb37062fa00efb4b7270' 'SKIP')
 validpgpkeys=('2FE350A912F4525659E418CAA9B027A1392E7305')
 options=('!strip')
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 07:17:22	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 11:54:34	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2