bibfilex-qt

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary .deb from Google Sites (sites.google.com), which is a personal/project hosting page rather than an official distribution channel with verifiable provenance. The binary is executed directly (extracted and installed). Google Sites URLs can be updated by the site owner at any time, meaning the binary payload could be silently replaced. Additionally, the md5sums array is only defined for x86_64 (inside the if block) and never assigned for i686, so integrity checking is incomplete. MD5 is also a weak hash. The source is the official project URL listed in the package metadata, and Google Sites was a common hosting platform for small open-source projects, so this is not clearly malicious — but it is a genuine supply-chain concern: an unverifiable, mutable binary from a personal host with weak/incomplete integrity checking. This matches the medium severity definition.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 source=("https://sites.google.com/site/bibfilex/download/${pkgname}_${pkgver}_${ARCH}.deb?attredirects=0&d=1")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from Google Sites (sites.google.com), which is a personal/project hosting page rather than an official distribution channel with verifiable provenance. The binary is executed directly (extracted and installed). Google Sites URLs can be updated by the site owner at any time, meaning the binary payload could be silently replaced. Additionally, the md5sums array is only defined for x86_64 (inside the if block) and never assigned for i686, so integrity checking is incomplete. MD5 is also a weak hash. The source is the official project URL listed in the package metadata, and Google Sites was a common hosting platform for small open-source projects, so this is not clearly malicious — but it is a genuine supply-chain concern: an unverifiable, mutable binary from a personal host with weak/incomplete integrity checking. This matches the medium severity definition.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=bibfilex-qt
    
      2name=bibfilex-qt
    
      3pkgver=1.2.8.0
    
      4pkgrel=1
    
      5pkgdesc="A free bibliographic manager for GNU/Linux"
    
      6arch=('i686' 'x86_64')
    
      7url="https://sites.google.com/site/bibfilex/home"
    
      8license=('GPLv3')
    
      9depends=('qt5-base')
    
      10
    
      11if [ ! -z "${DEVARCH}" ]; then
    
      12  CARCH=$DEVARCH
    
      13fi
    
      14
    
      15if [ "${CARCH}" = 'x86_64' ]; then
    
      16    ARCH='amd64'
    
      17md5sums=('3a6f25e400c6c9cdebad59cff8b992ba')
    
      18elif [ "${CARCH}" = 'i686' ]; then
    
      19    ARCH='i386'
    
      20fi
    
      21
    
      22source=("https://sites.google.com/site/bibfilex/download/${pkgname}_${pkgver}_${ARCH}.deb?attredirects=0&d=1")
    
      23
    
      24build() {
    
      25  echo "Nothing to do."
    
      26}
    
      27
    
      28package() {
    
      29  cd ${pkgdir}
    
      30  tar -xvf ${startdir}/src/data.tar.xz
    
      31  mv -v opt/bibfilex opt/${pkgname}
    
      32  mv -v usr/share/applications/Bibfilex.desktop usr/share/applications/${pkgname}.desktop
    
      33  mv -v usr/share/doc/bibfilex usr/share/doc/${pkgname}
    
      34}
    
      35

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2