bbmp-bin

maintainer dgrisham · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary from grish.haus, a personal domain, rather than from the project's official GitHub releases (github.com/dgrisham/bbmp). While the maintainer's email (dmgrisham@gmail.com) and the domain name (grish.haus) suggest the same person, this is still a personal hosting arrangement outside of any auditable release infrastructure. The binary is directly installed as an executable at /usr/bin/bbmp with no build step. A sha256sum is present, which provides integrity checking against the specific file, but does not protect against the host owner substituting the file and updating the checksum in the PKGBUILD. The real concern is that this is an executed binary from a non-standard personal host rather than an official release channel like GitHub Releases, making it a genuine supply-chain risk if the domain is compromised or transferred. This is a textbook medium-severity case.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:9 source=("https://grish.haus/bin/bbmp/${pkgver}/bbmp")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 80%): The PKGBUILD downloads a prebuilt binary from grish.haus, a personal domain, rather than from the project's official GitHub releases (github.com/dgrisham/bbmp). While the maintainer's email (dmgrisham@gmail.com) and the domain name (grish.haus) suggest the same person, this is still a personal hosting arrangement outside of any auditable release infrastructure. The binary is directly installed as an executable at /usr/bin/bbmp with no build step. A sha256sum is present, which provides integrity checking against the specific file, but does not protect against the host owner substituting the file and updating the checksum in the PKGBUILD. The real concern is that this is an executed binary from a non-standard personal host rather than an official release channel like GitHub Releases, making it a genuine supply-chain risk if the domain is compromised or transferred. This is a textbook medium-severity case.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: David Grisham <dmgrisham@gmail.com>
    
      2pkgname=bbmp-bin
    
      3pkgver=v0.1.4
    
      4pkgrel=1
    
      5pkgdesc="Based Black Music Player"
    
      6arch=(x86_64)
    
      7url="https://github.com/dgrisham/bbmp"
    
      8license=('GPL')
    
      9source=("https://grish.haus/bin/bbmp/${pkgver}/bbmp")
    
      10depends=()
    
      11sha256sums=('7f455328abb1719e75d569864bf339bbe107953a87a88fdd0e1a545a2ea88760')
    
      12
    
      13package() {
    
      14	install -Dm0755 "$srcdir/bbmp" "$pkgdir/usr/bin/bbmp"
    
      15}
    
      16

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2