boot-repair

maintainer FraV1982 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt Debian .deb from gwdg.de (a German academic mirror that does host Linux Mint packages, so it is not a random personal host, but it is still a third-party mirror rather than the upstream project's own release infrastructure). The package is then extracted and its contents copied directly into the package directory. All three checksums are set to SKIP, meaning there is no integrity verification whatsoever — any file served at that URL would be silently accepted and installed. Boot-repair is a system-level tool that runs as root and modifies bootloaders, so a tampered binary would have full RCE/privilege impact. The combination of (1) a third-party mirror rather than an official upstream release host, (2) completely skipped checksums, and (3) a prebuilt binary that gets executed with root privileges constitutes a genuine supply-chain risk, even if there is no evidence of active malice. This is a textbook medium-severity concern.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=(https://ftp5.gwdg.de/pub/linux/debian/mint/packages/pool/import/b/boot-repair/boot-repair_4ppa200_all.deb)

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt Debian .deb from gwdg.de (a German academic mirror that does host Linux Mint packages, so it is not a random personal host, but it is still a third-party mirror rather than the upstream project's own release infrastructure). The package is then extracted and its contents copied directly into the package directory. All three checksums are set to SKIP, meaning there is no integrity verification whatsoever — any file served at that URL would be silently accepted and installed. Boot-repair is a system-level tool that runs as root and modifies bootloaders, so a tampered binary would have full RCE/privilege impact. The combination of (1) a third-party mirror rather than an official upstream release host, (2) completely skipped checksums, and (3) a prebuilt binary that gets executed with root privileges constitutes a genuine supply-chain risk, even if there is no evidence of active malice. This is a textbook medium-severity concern.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: FraV1982 <consulenza dot vangi at outlook dot com>
    
      2
    
      3pkgname=boot-repair
    
      4pkgver=4ppa200
    
      5pkgrel=1
    
      6pkgdesc="A little software for MBR and Boot Record recovery."
    
      7arch=(x86_64 aarch64 armv6h armv7h i686)
    
      8url="https://sourceforge.net/p/boot-repair/home/Home/"
    
      9license=('GPL')
    
      10depends=('boot-sav')
    
      11options=("!emptydirs" "!strip")
    
      12
    
      13_debname=boot-repair_4ppa200_all.deb
    
      14
    
      15source=(https://ftp5.gwdg.de/pub/linux/debian/mint/packages/pool/import/b/boot-repair/boot-repair_4ppa200_all.deb)
    
      16md5sums=('SKIP')
    
      17sha256sums=('SKIP')
    
      18sha512sums=('SKIP')
    
      19
    
      20prepare() {
    
      21    cd "$srcdir"
    
      22    msg2 "Decompressing Debian package boot-repair..."
    
      23    ar xv "${_debname}" > /dev/null
    
      24    tar -xf data.tar.xz > /dev/null
    
      25
    
      26    find ./etc -type d -exec chmod 755 '{}' \;
    
      27    find ./usr -type d -exec chmod 755 '{}' \;
    
      28}
    
      29
    
      30package() {
    
      31    cd "$srcdir"
    
      32    cp -dpr --no-preserve=ownership {etc,usr} "$pkgdir"
    
      33}
    
      34

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2