bibfilex-gtk

maintainer orphaned · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary .deb from Google Sites (sites.google.com), which is a personal/project hosting page rather than an official distribution channel or well-known vendor mirror. The binary is then extracted and installed directly. While Google Sites is a legitimate hosting platform and not inherently malicious, it is an unofficial host where the maintainer (or anyone who gains control of that Google account) can silently replace the binary at any time. The md5sums assignment is also broken — it only applies to the x86_64 case and is set as a variable assignment inside the if-block rather than as a proper array, and no checksum is defined for i686. The combination of an executed binary from a personal/unofficial host with weak/incomplete integrity verification constitutes a genuine supply-chain concern, consistent with a MEDIUM rating.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 source=("https://sites.google.com/site/bibfilex/download/${pkgname}_${pkgver}_${ARCH}.deb?attredirects=0&d=1")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt binary .deb from Google Sites (sites.google.com), which is a personal/project hosting page rather than an official distribution channel or well-known vendor mirror. The binary is then extracted and installed directly. While Google Sites is a legitimate hosting platform and not inherently malicious, it is an unofficial host where the maintainer (or anyone who gains control of that Google account) can silently replace the binary at any time. The md5sums assignment is also broken — it only applies to the x86_64 case and is set as a variable assignment inside the if-block rather than as a proper array, and no checksum is defined for i686. The combination of an executed binary from a personal/unofficial host with weak/incomplete integrity verification constitutes a genuine supply-chain concern, consistent with a MEDIUM rating.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=bibfilex-gtk
    
      2name=bibfilex-gtk
    
      3pkgver=1.2.8.0
    
      4pkgrel=1
    
      5pkgdesc="A free bibliographic manager for GNU/Linux"
    
      6arch=('i686' 'x86_64')
    
      7url="https://sites.google.com/site/bibfilex/home"
    
      8license=('GPLv3')
    
      9depends=('gtk3')
    
      10
    
      11if [ ! -z "${DEVARCH}" ]; then
    
      12  CARCH=$DEVARCH
    
      13fi
    
      14
    
      15if [ "${CARCH}" = 'x86_64' ]; then
    
      16    ARCH='amd64'
    
      17md5sums=('b91685d13f4a0a445199af6aed119dc3')
    
      18elif [ "${CARCH}" = 'i686' ]; then
    
      19    ARCH='i386'
    
      20fi
    
      21
    
      22source=("https://sites.google.com/site/bibfilex/download/${pkgname}_${pkgver}_${ARCH}.deb?attredirects=0&d=1")
    
      23
    
      24build() {
    
      25  echo "Nothing to do."
    
      26}
    
      27
    
      28package() {
    
      29  cd ${pkgdir}
    
      30  tar -xvf ${startdir}/src/data.tar.xz
    
      31  mv -v opt/bibfilex opt/${pkgname}
    
      32  mv -v usr/share/applications/Bibfilex.desktop usr/share/applications/${pkgname}.desktop
    
      33  mv -v usr/share/doc/bibfilex usr/share/doc/${pkgname}
    
      34}
    
      35

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2