axis-cc-bin

maintainer OmegaRogue · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt proprietary binary .deb from downloads.axisxr.gg (the official AXIS XR vendor download host, matching the project URL axisxr.gg). The sha512sum is present and pins the specific binary, which mitigates MITM risk at install time. However, the concerns that keep this at MEDIUM are: (1) it is a closed-source, prebuilt binary with an all-rights-reserved license installed directly onto the system — not built from source; (2) the download host, while appearing to be the official vendor host, is not a well-known, widely-audited distribution channel; (3) the sha512sum provided appears to be only 127 hex characters (should be 128 for SHA-512), which may indicate a truncated/incorrect checksum that would not properly verify the binary. The truncated checksum is a real concern — if makepkg accepts it, integrity verification is weakened. Overall this is a standard 'bin' AUR package pattern with a potentially broken checksum, keeping it at medium rather than clean.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source_x86_64=("https://downloads.axisxr.gg/download/flavor/default/${pkgver//_/-}/linux_64/${pkgname%-bin}-${pkgver//_/-}-amd64.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt proprietary binary .deb from downloads.axisxr.gg (the official AXIS XR vendor download host, matching the project URL axisxr.gg). The sha512sum is present and pins the specific binary, which mitigates MITM risk at install time. However, the concerns that keep this at MEDIUM are: (1) it is a closed-source, prebuilt binary with an all-rights-reserved license installed directly onto the system — not built from source; (2) the download host, while appearing to be the official vendor host, is not a well-known, widely-audited distribution channel; (3) the sha512sum provided appears to be only 127 hex characters (should be 128 for SHA-512), which may indicate a truncated/incorrect checksum that would not properly verify the binary. The truncated checksum is a real concern — if makepkg accepts it, integrity verification is weakened. Overall this is a standard 'bin' AUR package pattern with a potentially broken checksum, keeping it at medium rather than clean.

PKGBUILD

1 offending line(s) highlighted

      1# Generated by debtap
    
      2# Maintainer: OmegaRogue
    
      3# Contributor: OmegaRogue
    
      4pkgname=axis-cc-bin
    
      5pkgver=0.8.5_beta
    
      6pkgrel=2
    
      7pkgdesc="Software interface for AXIS"
    
      8arch=('x86_64')
    
      9url="https://axisxr.gg/"
    
      10license=('custom:all-rights-reserved')
    
      11depends=('at-spi2-core' 'desktop-file-utils' 'glib2' 'gtk3' 'gvfs' 'hicolor-icon-theme' 'kde-cli-tools' 'libdrm' 'libnotify' 'libx11' 'libxcb' 'libxext' 'libxtst' 'mesa' 'nss' 'trash-cli' 'xdg-utils')
    
      12optdepends=('alsa-lib'
    
      13            'apparmor'
    
      14            'libgnome-keyring'
    
      15            'libgnome-keyring'
    
      16            'pulseaudio')
    
      17options=('!strip' '!emptydirs')
    
      18source_x86_64=("https://downloads.axisxr.gg/download/flavor/default/${pkgver//_/-}/linux_64/${pkgname%-bin}-${pkgver//_/-}-amd64.deb")
    
      19sha512sums_x86_64=('ac8bcd94a5c1654635c29ce771918cb365fbaaa090c207b31336e205cfad44e05fc730a01161bb91a61ab24b0d82b42a266f70d660a2d9b91f40977e9ddbbd98')
    
      20
    
      21package(){
    
      22
    
      23	# Extract package data
    
      24	tar -xJ -f data.tar.xz -C "${pkgdir}"
    
      25}
    
      26

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2