astrocrop

maintainer cernyhonza · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary Debian package (.deb) from astrodmx-capture.org.uk, which is the project's own website (matching the url= field), not a random personal host. The site is a known Linux astronomy imaging project. However, the package is still a prebuilt binary blob with a single sha256sum for integrity verification, no GPG signature, and the binary is executed directly on the user's system. The sha256sum provides some protection against accidental corruption but not against a compromised upstream host serving a malicious binary. This is a legitimate medium-risk concern: a prebuilt binary from a small, unofficial project site with no code signing. The cheaper model's characterization of it as a 'personal project site' is roughly accurate — it's a small niche project, not a major vendor with reproducible builds or signed releases. The risk is real but not elevated to high since there's no evidence of malice, the host matches the declared upstream URL, and the sha256sum is present.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source=("https://www.astrodmx-capture.org.uk/downloads/other-software/astrocrop_${pkgver}_amd64.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary Debian package (.deb) from astrodmx-capture.org.uk, which is the project's own website (matching the url= field), not a random personal host. The site is a known Linux astronomy imaging project. However, the package is still a prebuilt binary blob with a single sha256sum for integrity verification, no GPG signature, and the binary is executed directly on the user's system. The sha256sum provides some protection against accidental corruption but not against a compromised upstream host serving a malicious binary. This is a legitimate medium-risk concern: a prebuilt binary from a small, unofficial project site with no code signing. The cheaper model's characterization of it as a 'personal project site' is roughly accurate — it's a small niche project, not a major vendor with reproducible builds or signed releases. The risk is real but not elevated to high since there's no evidence of malice, the host matches the declared upstream URL, and the sha256sum is present.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jan Cerny <cernyhonza at gmail com>
    
      2
    
      3
    
      4pkgname=astrocrop
    
      5pkgver=1.1.1a
    
      6pkgrel=1
    
      7pkgdesc="Astronomical image preprocessing tool"
    
      8arch=('x86_64')
    
      9url="https://www.astrodmx-capture.org.uk/"
    
      10# No licence file available in package, see https://www.linux-astro-imaging.uk/linux/astronomy/linux-downloads
    
      11# for details.
    
      12license=(custom)
    
      13options=(!strip)
    
      14install=$pkgname.install
    
      15depends=('libxxf86vm' 'at-spi2-core' 'gtk2')
    
      16
    
      17source=("https://www.astrodmx-capture.org.uk/downloads/other-software/astrocrop_${pkgver}_amd64.deb")
    
      18sha256sums=("d0ac01222721d63b41da0177696f161b73ae293285836b19ee577670359da193")
    
      19
    
      20_instdir="/usr/local/AstroCrop"
    
      21_prefix="AstroCrop-${pkgver}-manual"
    
      22
    
      23
    
      24prepare() {
    
      25    mkdir ${_prefix}
    
      26    tar -xvf data.tar.xz -C ${_prefix}
    
      27}
    
      28
    
      29package() {
    
      30    # create the desitination folder
    
      31    mkdir -p "${pkgdir}${_instdir}"
    
      32
    
      33    # copy over the linux 64 bit files
    
      34    cp --recursive ${_prefix}/usr/local/AstroCrop/* "${pkgdir}${_instdir}"
    
      35
    
      36    # copy usr share
    
      37    mkdir -p "${pkgdir}/usr/share/"
    
      38    cp -r ${_prefix}/usr/share/* "${pkgdir}/usr/share/"
    
      39
    
      40    # create a profile file to add an alias for astrodmx
    
      41    mkdir -p "${pkgdir}/etc/profile.d"
    
      42    echo "alias astrocrop=\"${_instdir}/bin/launcher.sh\"" > "${pkgdir}/etc/profile.d/${pkgname}.sh"
    
      43}
    
      44

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2