chitubox-free-bin

maintainer C0rn3j · 15 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt installer from a chitubox.com subdomain for the official CHITUBOX software; while the host is not a standard one, it is plausibly part of the vendor's infrastructure, and the software is legitimate, making the risk low despite the non-standard URL.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt installer from a chitubox.com subdomain for the official CHITUBOX software; while the host is not a standard one, it is plausibly part of the vendor's infrastructure, and the software is legitimate, making the risk low despite the non-standard URL.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:57 "${pkgname}-${pkgver}::https://sac.chitubox.com/software/download.do?installerUrl=https%3A%2F%2Fdownload.chitubox.com%2F17839%2Fv2.3.1%2FCHITUBOX_Basic_linux_Installer_2.3.1&softwareId=17839&softwareVersionId=v2.3.1"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Martin Rys <https://rys.rs/contact>
    
      2# Contributor: Brian Li <brian14708@gmail.com>
    
      3# Contributor: Denys Zariaiev <denys.zariaiev@gmail.com>
    
      4
    
      5# TODO 2.0.0 - they're using trying to copy Sphere.stl and others with wrong capitalization...
    
      6#Error copying file: boost::filesystem::copy_file: No such file or directory [system:2]: "Resources/Model/ExampleModel/sphere.stl", "/home/c0rn3j/.local/share/chituboxResource/sphere.stl"
    
      7#Error copying file: boost::filesystem::copy_file: No such file or directory [system:2]: "Resources/Model/ExampleModel/cylinder.STL", "/home/c0rn3j/.local/share/chituboxResource/cylinder.STL"
    
      8
    
      9# TODO - maybe patch out whatever version check this thing is trying to run
    
      10#SOFTWARE_VERSION_ID: v2.0.0
    
      11#urlPath:https://sac.chitubox.com/PCVersionUpdate/getInfo.do6?softwareType=17839&platform=4&majorVersion=2.0.0&silentVersion=0.0.0&login=0&customerMail=0startOpt 172 QSqlError("1555", "Unable to fetch row", "UNIQUE constraint failed: AdnormalTable.pid")
    
      12
    
      13pkgname=chitubox-free-bin
    
      14pkgver=2.3.1
    
      15pkgrel=2
    
      16_RUNFILE='chitubox-free-bin-2.3.1'
    
      17
    
      18pkgdesc='All-in-one SLA/DLP/LCD Slicer'
    
      19
    
      20depends=(
    
      21	'dbus'
    
      22	'glib2'
    
      23	'hicolor-icon-theme'
    
      24	'zlib'
    
      25)
    
      26makedepends=(
    
      27	'fontconfig'
    
      28	'freetype2'
    
      29	'icoutils'
    
      30	'libx11'
    
      31	'libxkbcommon-x11'
    
      32	'xcb-util-keysyms'
    
      33	'xcb-util-image'
    
      34	'xcb-util-renderutil'
    
      35	'xcb-util-wm'
    
      36)
    
      37
    
      38url='https://www.chitubox.com/download.html'
    
      39arch=('x86_64')
    
      40license=('LicenseRef-CHITUBOX')
    
      41
    
      42options=(!strip)
    
      43
    
      44# Free - https://sac.chitubox.com/getSoftwareBySoftwareId.do2?softwareId=17839
    
      45#    "stableVersion":  "v2.3.0",
    
      46#    "bateVersion":    "v2.2.0",
    
      47#    "stableLinuxUrl": "https://download.chitubox.com/17839/v2.3.0/CHITUBOX_Basic_Linux_Installer_V2.3.tar.gz",
    
      48#    "betaLinuxUrl":   "https://download.chitubox.com/17839/v2.2.0/CHITUBOX_Basic_Linux_Installer_V2.2_Beta.tar.gz",
    
      49
    
      50# Pro - https://sac.chitubox.com/getSoftwareBySoftwareId.do2?softwareId=17842
    
      51#    "stableVersion": "v2.0.8",
    
      52#    "bateVersion":   "v2.0.7",
    
      53
    
      54source=(
    
      55	# Annoying to get when new URL when it changes due to using window.open, just hog the connection and quickly CTRL+L & CTRL+C when the tab opens before it closes
    
      56	# Smarter solutions welcome
    
      57	"${pkgname}-${pkgver}::https://sac.chitubox.com/software/download.do?installerUrl=https%3A%2F%2Fdownload.chitubox.com%2F17839%2Fv2.3.1%2FCHITUBOX_Basic_linux_Installer_2.3.1&softwareId=17839&softwareVersionId=v2.3.1"
    
      58	'local://chitubox-basic.desktop'
    
      59	'local://chitubox-basic.xml'
    
      60)
    
      61
    
      62sha256sums=('397e058de53b692e1db61657929e1ce9f88f090cb973c8c20fde5b0d4dfa6268'
    
      63            'f3cb140e804119201d7efff6f23558eaa48278c213cb37848fb3ff1afc30deac'
    
      64            'fede9c1383063dbfade24289c1adeda505f2333b1206865a6696f0a9f6c7390b')
    
      65
    
      66package()
    
      67{
    
      68	# Use a path close to the default in the installer
    
      69	_INSTALL_ROOT="${srcdir}/opt/CHITUBOX_Basic"
    
      70	_OPT_DIR="${pkgdir}/opt"
    
      71	_APP_DIR="${_OPT_DIR}/CHITUBOX_Basic"
    
      72
    
      73	# Run installer, which unfortunately doesn't run without root privileges. So it's not possible to put the install in build().
    
      74	chmod +x "${srcdir}/${_RUNFILE}"
    
      75	"${srcdir}/${_RUNFILE}" --root "${_INSTALL_ROOT}" --accept-licenses --no-size-checking --accept-messages --confirm-command install
    
      76
    
      77	## Clean up
    
      78	# Nice 35MB Uninstall binary and some other garbage
    
      79	rm "${_INSTALL_ROOT}/Uninstall"*
    
      80	rm "${_INSTALL_ROOT}/InstallationLog.txt"
    
      81	# Installer installs everything for Linux, macOS and Windows, including 330MB of ffmpeg .exe's
    
      82	rm "${_INSTALL_ROOT}"/bin/Resources/DependentSoftware/recordOrShot/*.exe
    
      83
    
      84	# Install License
    
      85	install -Dm644 "${_INSTALL_ROOT}/Licenses/LICENSE.txt" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      86
    
      87	# binary data
    
      88	install -d "${pkgdir}"/opt
    
      89	mv "${_INSTALL_ROOT}" "${_OPT_DIR}/"
    
      90
    
      91	# launcher
    
      92	install -d "${pkgdir}"/usr/bin
    
      93	ln -s /opt/CHITUBOX_Basic/CHITUBOX_Basic.sh "${pkgdir}/usr/bin/chitubox-basic"
    
      94
    
      95	# desktop file
    
      96	install -Dm644 chitubox-basic.desktop "${pkgdir}"/usr/share/applications/chitubox-basic.desktop
    
      97
    
      98	# Extract the included Windows ICO file into PNG(s)
    
      99	icotool --extract "${_APP_DIR}/bin/Resources/Image/SoftwareIcon/freeIcon.ico" --output .
    
      100	install -Dm644 freeIcon_1_256x256x32.png "${pkgdir}/usr/share/icons/hicolor/256x256/apps/chitubox-basic.png"
    
      101
    
      102	# mime/associations - see https://manual.chitubox.com/user-manual-pro/requirements/
    
      103	install -Dm644 chitubox-basic.xml "${pkgdir}"/usr/share/mime/packages/chitubox-basic.xml
    
      104}
    
      105

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2