boot-sav

maintainer FraV1982 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt Debian .deb binary package from gwdg.de (a German academic mirror that does host Linux Mint packages, so it is not a random personal host, but it is still a third-party mirror rather than the upstream project's own release infrastructure). The .deb is extracted and its contents installed directly into the package tree. All checksums are SKIP'd, meaning there is no integrity verification whatsoever — if the file at that URL were replaced or tampered with, pacman would install the compromised binary without any warning. The combination of (1) executed/installed binary code, (2) sourced from a non-upstream third-party mirror, and (3) zero checksum verification constitutes a genuine supply-chain risk. This is a textbook MEDIUM: not clearly malicious, but a real concern. The gwdg.de host is a legitimate academic mirror for Debian/Mint packages, which slightly reduces the probability of active compromise compared to a personal host, but the absence of any checksum means the risk cannot be dismissed.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=(https://ftp5.gwdg.de/pub/linux/debian/mint/packages/pool/import/b/boot-repair/boot-sav_4ppa200_all.deb)

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt Debian .deb binary package from gwdg.de (a German academic mirror that does host Linux Mint packages, so it is not a random personal host, but it is still a third-party mirror rather than the upstream project's own release infrastructure). The .deb is extracted and its contents installed directly into the package tree. All checksums are SKIP'd, meaning there is no integrity verification whatsoever — if the file at that URL were replaced or tampered with, pacman would install the compromised binary without any warning. The combination of (1) executed/installed binary code, (2) sourced from a non-upstream third-party mirror, and (3) zero checksum verification constitutes a genuine supply-chain risk. This is a textbook MEDIUM: not clearly malicious, but a real concern. The gwdg.de host is a legitimate academic mirror for Debian/Mint packages, which slightly reduces the probability of active compromise compared to a personal host, but the absence of any checksum means the risk cannot be dismissed.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: FraV1982 <consulenza dot vangi at outlook dot com>
    
      2
    
      3pkgname=boot-sav
    
      4pkgver=4ppa200
    
      5pkgrel=1
    
      6pkgdesc="Library for different packages. Required from OS-Uninstaller, Boot-Repair, etc..."
    
      7arch=(x86_64 aarch64 armv6h armv7h i686)
    
      8url=""
    
      9license=('custom')
    
      10depends=('gawk' 'gettext' 'lsb-release' 'lzip' 'mawk' 'parted' 'xdg-utils' 'xz' 'zenity' 'glade2script')
    
      11options=("!emptydirs" "!strip")
    
      12
    
      13_debname=boot-sav_4ppa200_all.deb
    
      14
    
      15source=(https://ftp5.gwdg.de/pub/linux/debian/mint/packages/pool/import/b/boot-repair/boot-sav_4ppa200_all.deb)
    
      16md5sums=('SKIP')
    
      17sha256sums=('SKIP')
    
      18sha512sums=('SKIP')
    
      19
    
      20prepare() {
    
      21    cd "$srcdir"
    
      22    msg2 "Decompressing Debian package boot-sav..."
    
      23    ar xv "${_debname}" > /dev/null
    
      24    tar -xf data.tar.xz > /dev/null
    
      25
    
      26    find ./usr -type d -exec chmod 755 '{}' \;
    
      27}
    
      28
    
      29package() {
    
      30    cd "$srcdir"
    
      31    cp -dpr --no-preserve=ownership ./usr "$pkgdir"
    
      32}
    
      33

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2