chitubox-free-beta-bin

maintainer Auerhuhn · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary installer (.run file) from sac.chitubox.com, which is the official CHITUBOX download/CDN subdomain for the legitimate CHITUBOX slicer software (CBD Technology). The domain is not a random personal host — it is the vendor's own distribution infrastructure. A sha512 checksum is provided, which mitigates substitution attacks at the network level. However, the package executes the .run installer binary directly during the package() phase, which is a genuine supply-chain concern: if the upstream binary is ever replaced (the checksum would catch this for a pinned version, but future updates may not), arbitrary code runs during packaging. The pattern of executing a downloaded binary installer is inherently medium-risk by AUR standards, even from a legitimate vendor, because it bypasses normal source inspection. This is a real but common pattern for proprietary Linux software distributed as self-extracting installers (similar to many other -bin AUR packages). The risk is real but not elevated beyond the standard medium for executed proprietary binaries from a vendor host.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:51 "${pkgname}-${pkgver}.tar.gz::https://sac.chitubox.com/software/download.do?softwareId=17839&softwareVersionId=v${pkgver}&fileName=CHITUBOX_Basic_Linux_Installer_V${_pkgver_major_minor}_Beta.tar.gz"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary installer (.run file) from sac.chitubox.com, which is the official CHITUBOX download/CDN subdomain for the legitimate CHITUBOX slicer software (CBD Technology). The domain is not a random personal host — it is the vendor's own distribution infrastructure. A sha512 checksum is provided, which mitigates substitution attacks at the network level. However, the package executes the .run installer binary directly during the package() phase, which is a genuine supply-chain concern: if the upstream binary is ever replaced (the checksum would catch this for a pinned version, but future updates may not), arbitrary code runs during packaging. The pattern of executing a downloaded binary installer is inherently medium-risk by AUR standards, even from a legitimate vendor, because it bypasses normal source inspection. This is a real but common pattern for proprietary Linux software distributed as self-extracting installers (similar to many other -bin AUR packages). The risk is real but not elevated beyond the standard medium for executed proprietary binaries from a vendor host.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Claudia Pellegrino <aur ät cpellegrino.de>
    
      2# Contributor: Martin Rys <rys.rs/contact>
    
      3# Contributor: Brian Li <brian14708@gmail.com>
    
      4# Contributor: Denys Zariaiev <denys.zariaiev@gmail.com>
    
      5
    
      6pkgname=chitubox-free-beta-bin
    
      7pkgver=2.2.0
    
      8pkgrel=1
    
      9pkgdesc='All-in-one SLA/DLP/LCD Slicer, Beta version'
    
      10arch=('x86_64')
    
      11url='https://www.chitubox.com/download.html'
    
      12license=('LicenseRef-CHITUBOX')
    
      13depends=(
    
      14  'bash'
    
      15  'dbus'
    
      16  'expat'
    
      17  'fontconfig'
    
      18  'freetype2'
    
      19  'gcc-libs'
    
      20  'glib2'
    
      21  'glibc'
    
      22  'hicolor-icon-theme'
    
      23  'java-runtime'
    
      24  'krb5'
    
      25  'libdrm'
    
      26  'libglvnd'
    
      27  'libx11'
    
      28  'libxcb'
    
      29  'libxext'
    
      30  'libxfixes'
    
      31  'libxkbcommon'
    
      32  'libxkbcommon-x11'
    
      33  'libxshmfence'
    
      34  'nspr'
    
      35  'nss'
    
      36  'qt6-base'
    
      37  'qt6-declarative'
    
      38  'wayland'
    
      39  'xcb-util-image'
    
      40  'xcb-util-keysyms'
    
      41  'xcb-util-renderutil'
    
      42  'xcb-util-wm'
    
      43  'zlib'
    
      44)
    
      45makedepends=('icoutils')
    
      46options=('!debug' '!strip')
    
      47
    
      48_pkgver_major_minor="$(cut -d . -f -2 <<< "${pkgver}")"
    
      49
    
      50source=(
    
      51  "${pkgname}-${pkgver}.tar.gz::https://sac.chitubox.com/software/download.do?softwareId=17839&softwareVersionId=v${pkgver}&fileName=CHITUBOX_Basic_Linux_Installer_V${_pkgver_major_minor}_Beta.tar.gz"
    
      52  'chitubox-basic-beta.desktop'
    
      53  'chitubox-basic-beta.xml'
    
      54)
    
      55
    
      56sha512sums=(
    
      57  'bacbbddff6d1c5ca8e8d26e633050523360285880276d21b6b93c88c6458d20874c1cbfa6c7c25197d79cc6951af1f3df9d45079ecc839fb6e95088dedcd68fe'
    
      58  'b9127c965f503ac256c0faa9761035996aa259b66248d9c6dd3ce4b3df9cb5fea129b68d84b8e3f256b47daa0cb5db6f86127d5bea410e6bffd0f2b924e73819'
    
      59  '658997d9569f9fa4b2d4d33867e925dc4542b69e1a2cb362fe1ad5598600f4853053777649790a89e452646fbacb245ca3a584924b89f6d2dbd89a16c8f45b19'
    
      60)
    
      61
    
      62package() {
    
      63  # Use a path close to the default in the installer
    
      64  INSTALL_ROOT="${srcdir}/opt/CHITUBOX_Basic_Beta"
    
      65  OPT_DIR="${pkgdir}/opt"
    
      66  APP_DIR="${OPT_DIR}/CHITUBOX_Basic_Beta"
    
      67
    
      68  # Run installer, which unfortunately doesn't run without root privileges. So it's not possible to put the install in build().
    
      69  echo >&2 'Running the installer'
    
      70  "${srcdir}/CHITUBOX_Basic_Linux_Installer_V${_pkgver_major_minor}_Beta.run" \
    
      71    --root "${INSTALL_ROOT}" --accept-licenses --no-size-checking \
    
      72    --accept-messages --confirm-command install
    
      73
    
      74  echo >&2 'Cleaning up'
    
      75  rm "${INSTALL_ROOT}/Uninstall"*
    
      76  rm "${INSTALL_ROOT}/InstallationLog.txt"
    
      77  rm "${INSTALL_ROOT}"/bin/Resources/DependentSoftware/recordOrShot/*.exe
    
      78
    
      79  echo >&2 'Packaging the license'
    
      80  install -D -m 644 -t "${pkgdir}/usr/share/licenses/${pkgname}" \
    
      81    "${INSTALL_ROOT}/Licenses/LICENSE.txt"
    
      82
    
      83  echo >&2 'Packaging binary data'
    
      84  install -d "${pkgdir}"/opt
    
      85  mv "${INSTALL_ROOT}" "${OPT_DIR}/"
    
      86
    
      87  echo >&2 'Packaging the launcher'
    
      88  install -d "${pkgdir}"/usr/bin
    
      89  ln -s /opt/CHITUBOX_Basic_Beta/CHITUBOX_Basic.sh \
    
      90    "${pkgdir}/usr/bin/chitubox-basic-beta"
    
      91
    
      92  echo >&2 'Packaging the desktop file'
    
      93  install -D -m 644 -t "${pkgdir}/usr/share/applications" \
    
      94    chitubox-basic-beta.desktop
    
      95
    
      96  echo >&2 'Extracting and packaging the icon'
    
      97  icotool --extract \
    
      98    "${APP_DIR}/bin/Resources/Image/SoftwareIcon/freeIcon.ico" \
    
      99    --output .
    
      100  install -D -m 644 freeIcon_1_256x256x32.png \
    
      101    "${pkgdir}/usr/share/icons/hicolor/256x256/apps/chitubox-basic-beta.png"
    
      102
    
      103  echo >&2 'Packaging the MIME associations'
    
      104  install -D -m 644 -t "${pkgdir}/usr/share/mime/packages" \
    
      105    chitubox-basic-beta.xml
    
      106}
    
      107

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2