bitronics-studio-5-bin

maintainer v.prokopyev · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The main payload is a prebuilt .deb fetched from the vendor's own subdomain (download.bitronicslab.com) with a sha512 checksum provided. The LICENSE.pdf is fetched from Dropbox, which is an unusual but not inherently malicious host for a PDF document; it is pure data (a PDF license agreement), not executed code. The URL is percent-encoded Cyrillic text ('Лицензионный договор-оферта BiTronics Studio.pdf'), which is not obfuscation — it is standard URL encoding of a Russian filename. A sha512 checksum is also provided for the PDF. The only real concern is that Dropbox links can be changed by the owner without the PKGBUILD being updated, but since the file is a non-executed PDF and has a checksum, the actual security risk is minimal. The binary itself comes from the vendor's domain with integrity verification. This does not rise to a medium supply-chain concern.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 82%): The main payload is a prebuilt .deb fetched from the vendor's own subdomain (download.bitronicslab.com) with a sha512 checksum provided. The LICENSE.pdf is fetched from Dropbox, which is an unusual but not inherently malicious host for a PDF document; it is pure data (a PDF license agreement), not executed code. The URL is percent-encoded Cyrillic text ('Лицензионный договор-оферта BiTronics Studio.pdf'), which is not obfuscation — it is standard URL encoding of a Russian filename. A sha512 checksum is also provided for the PDF. The only real concern is that Dropbox links can be changed by the owner without the PKGBUILD being updated, but since the file is a non-executed PDF and has a checksum, the actual security risk is minimal. The binary itself comes from the vendor's domain with integrity verification. This does not rise to a medium supply-chain concern.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:27 source=("https://www.download.bitronicslab.com/YN/soft/BS_YN/linux/BTStudio5JN-5.3.8.deb"
PKGBUILD:28 "LICENSE.pdf::https://www.dropbox.com/s/0cddobko2i7cp6z/%D0%9B%D0%B8%D1%86%D0%B5%D0%BD%D0%B7%D0%B8%D0%BE%D0%BD%D0%BD%D1%8B%D0%B9%20%D0%B4%D0%BE%D0%B3%D0%BE%D0%B2%D0%BE%D1%80-%D0%BE%D1%84%D0%B5%D1%80%D1%82%D0%B0%20BiTronics%20Studio.pdf?dl=1")

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Vasilly Prokopyev <Vasilly.Prokopyev at google mail>
    
      2
    
      3pkgname=bitronics-studio-5-bin
    
      4pkgver=5.3.8
    
      5pkgrel=3
    
      6pkgdesc="Software for \"Юный Нейромоделист\" setup by BiTronicsLab."
    
      7arch=('x86_64')
    
      8url="https://bitronicslab.com"
    
      9license=('custom')
    
      10depends=('fontconfig>=2.11.0'
    
      11         'freetype2>=2.6'
    
      12         'glibc>=2.17'
    
      13         'libdrm>=2.4.62'
    
      14         'libglvnd>=1.6.0' # debtap considered 'libegl>=7.8.1' for file /usr/lib/libEGL.so.1
    
      15         'libgl'
    
      16         'libx11'
    
      17         'libxcb>=1.10'
    
      18         'libxkbcommon>=0.5.0'
    
      19         'libxkbcommon-x11>=0.5.0'
    
      20         'gcc-libs'
    
      21         'xcb-util-image>=0.2.1'
    
      22         'xcb-util-keysyms>=0.4.0'
    
      23         'xcb-util-renderutil'
    
      24         'xcb-util-wm>=0.4.1'
    
      25         'zlib>=1.2.3.4')
    
      26install="${pkgname}.install"
    
      27source=("https://www.download.bitronicslab.com/YN/soft/BS_YN/linux/BTStudio5JN-5.3.8.deb"
    
      28        "LICENSE.pdf::https://www.dropbox.com/s/0cddobko2i7cp6z/%D0%9B%D0%B8%D1%86%D0%B5%D0%BD%D0%B7%D0%B8%D0%BE%D0%BD%D0%BD%D1%8B%D0%B9%20%D0%B4%D0%BE%D0%B3%D0%BE%D0%B2%D0%BE%D1%80-%D0%BE%D1%84%D0%B5%D1%80%D1%82%D0%B0%20BiTronics%20Studio.pdf?dl=1")
    
      29sha512sums=('6bada78349ebc602baa2535cc02b4f75b8d50d570ab1b3c32a7cedf8f4ce3c2f6fd841230a2a0957e83e764de3d27ec0f87e029a3169c9a595232fca07799fd3'
    
      30            '673a619e8e75167cf8bb1da97bef806965c215955df697b44691e27b57544168c156d01d4c6e74109a3e221af619a697cee8139007e1ef15263d062a8cda8d91')
    
      31
    
      32package(){
    
      33    # Extract package data
    
      34    mkdir -p "${srcdir}/data"
    
      35    tar -xJ -f data.tar.xz -C "${srcdir}/data" --no-same-owner
    
      36
    
      37    # to ensure correct permissions we will install all files separately
    
      38    install -D -t "${pkgdir}/usr/bin" "${srcdir}/data/usr/bin/btstudio5jn"
    
      39    install -D -t "${pkgdir}/usr/share/applications" "${srcdir}/data/usr/share/applications/BTStudio5JN.desktop"
    
      40    install -m 0644 -D -t "${pkgdir}/usr/share/icons" "${srcdir}/data/usr/share/icons/btstudio5_jn.png"
    
      41    install -m 0644 -D -t "${pkgdir}/opt/BTStudio5/" "${srcdir}/data/opt/BTStudio5/BiTronics Studio user manual.pdf"
    
      42    install -m 0644 -D -t "${pkgdir}/usr/share/licenses/bitronics-studio-5-bin/" "${srcdir}/LICENSE.pdf"
    
      43}
    
      44

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2