autopanogiga

maintainer Emeric · 7 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary tarball (AutopanoGiga_Linux64_442_2018-09-10.tar.xz) from emeric.io, which is the maintainer's personal domain rather than the official Kolor/Autopano distribution channel (the official site is now archived). The package installs this binary directly into /opt and /usr/bin. While a sha256sum is provided (mitigating accidental corruption), the host is not an official vendor mirror — it is a personal server controlled by the maintainer. If that host were compromised or the file silently replaced, users would execute arbitrary code. The original upstream (kolor.com) is defunct, so there is no official source to compare against, which is a legitimate reason to self-host, but it still constitutes a supply-chain risk by AUR standards. This is a genuine medium-severity concern: an executed binary from a non-official/personal host.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("https://emeric.io/CI/kolor/AutopanoGiga_Linux64_442_2018-09-10.tar.xz"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt binary tarball (AutopanoGiga_Linux64_442_2018-09-10.tar.xz) from emeric.io, which is the maintainer's personal domain rather than the official Kolor/Autopano distribution channel (the official site is now archived). The package installs this binary directly into /opt and /usr/bin. While a sha256sum is provided (mitigating accidental corruption), the host is not an official vendor mirror — it is a personal server controlled by the maintainer. If that host were compromised or the file silently replaced, users would execute arbitrary code. The original upstream (kolor.com) is defunct, so there is no official source to compare against, which is a legitimate reason to self-host, but it still constitutes a supply-chain risk by AUR standards. This is a genuine medium-severity concern: an executed binary from a non-official/personal host.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Emeric <emeric.grange@gmail.com>
    
      2# MaintContributorainer: FoolEcho <foolecho at gmail dot com>
    
      3# Contributor: dracorp
    
      4# Contributor: Piotr Rogoża <rogoza dot piotr at gmail dot com>
    
      5# Created: 18/03/2011
    
      6pkgname=autopanogiga
    
      7pkgver=4.4.2
    
      8pkgrel=5
    
      9pkgdesc='Create beautiful panoramas by stitching multiple photos automatically with Autopano Giga.'
    
      10arch=('x86_64')
    
      11url='https://web.archive.org/web/20180822070241/http://kolor.com/autopano/'
    
      12license=('custom: "commercial"')
    
      13install="$pkgname.install"
    
      14changelog=ChangeLog
    
      15
    
      16source=("https://emeric.io/CI/kolor/AutopanoGiga_Linux64_442_2018-09-10.tar.xz"
    
      17        "$pkgname"
    
      18        "$pkgname.png"
    
      19        "$pkgname.desktop")
    
      20
    
      21sha256sums=('a2546989f5d02fbcced61a81c65988c592af3a904eda0da4c5fad8a45a7af230'
    
      22            '80114777faed6326764d14143f533efb473695d99e1771b2fdfbae89f3942fad'
    
      23            '0ea1b5efe83ef091c629cf9615df306440131586235f1ae7b41856c9b6ddcd6b'
    
      24            'a7456db2e25dc33952ee42202edf31b070493e157945d40a4645187a1d49336b')
    
      25
    
      26package() {
    
      27  cd "$srcdir/AutopanoGiga"
    
      28  install -dm755 $pkgdir/{opt/kolor/,usr/share/licenses/$pkgname/}
    
      29  cp -r $srcdir/AutopanoGiga $pkgdir/opt/kolor/$pkgname
    
      30  cp $srcdir/$pkgname.png $pkgdir/opt/kolor/$pkgname/Resources/UI/autopano_giga.png
    
      31  mv $pkgdir/opt/kolor/$pkgname/copyright $pkgdir/usr/share/licenses/$pkgname/
    
      32  install -Dm755 $srcdir/$pkgname $pkgdir/usr/bin/$pkgname
    
      33  install -Dm644 "$srcdir/$pkgname.desktop" "$pkgdir/usr/share/applications/$pkgname.desktop"
    
      34}
    
      35
    
      36

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2