chomikbox

maintainer bemxio · 3 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads prebuilt binary executables (chomikbox, configurator, crashsender) from bts.box.chomikuj.pl, which is the official Chomikuj.pl distribution host for their ChomikBox desktop client. The source is the vendor's own installer script, and the extraction method (tail -c to strip the shell wrapper and get the embedded tarball) is a well-known self-extracting archive pattern. The host appears to be the legitimate vendor CDN rather than a personal or unofficial mirror. However, the binaries are precompiled closed-source executables installed directly to the system, the source uses HTTP (not HTTPS), and there is no way to verify the binaries beyond the md5sums pinned in the PKGBUILD. MD5 is cryptographically weak. The combination of unverifiable prebuilt binaries over plain HTTP from a vendor host that could be MITM'd constitutes a real (if not clearly malicious) supply-chain concern. This is a legitimate medium: not an attack, but a genuine risk from executed closed-source binaries with weak integrity checks over an unencrypted channel.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 source_i686=("http://bts.box.chomikuj.pl/repo/all/${pkgver}/linux32/ChomikBox-pl-installer.32.sh")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads prebuilt binary executables (chomikbox, configurator, crashsender) from bts.box.chomikuj.pl, which is the official Chomikuj.pl distribution host for their ChomikBox desktop client. The source is the vendor's own installer script, and the extraction method (tail -c to strip the shell wrapper and get the embedded tarball) is a well-known self-extracting archive pattern. The host appears to be the legitimate vendor CDN rather than a personal or unofficial mirror. However, the binaries are precompiled closed-source executables installed directly to the system, the source uses HTTP (not HTTPS), and there is no way to verify the binaries beyond the md5sums pinned in the PKGBUILD. MD5 is cryptographically weak. The combination of unverifiable prebuilt binaries over plain HTTP from a vendor host that could be MITM'd constitutes a real (if not clearly malicious) supply-chain concern. This is a legitimate medium: not an attack, but a genuine risk from executed closed-source binaries with weak integrity checks over an unencrypted channel.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: bemxio <bemxiov at protonmail dot com>
    
      2
    
      3pkgname=chomikbox
    
      4pkgdesc="A desktop application for Chomikuj.pl integration"
    
      5
    
      6pkgver=2.0.5
    
      7pkgrel=7
    
      8
    
      9arch=(i686 x86_64)
    
      10
    
      11url="http://chomikuj.pl/ChomikBox.aspx"
    
      12license=("LicenseRef-ChomikBox")
    
      13
    
      14depends=(qt4 gstreamer0.10-base libxml2-legacy)
    
      15
    
      16source=("chomikbox.png" "chomikbox-music-light.png" "LICENSE.chomikbox")
    
      17md5sums=("644b11c413a5542b187e7a040b7a0d5e" "0ccd8b3e3ce7fb30a5706f80f4959b5c" "5226a506d93635a3f85bbb23826758b3")
    
      18
    
      19source_i686=("http://bts.box.chomikuj.pl/repo/all/${pkgver}/linux32/ChomikBox-pl-installer.32.sh")
    
      20source_x86_64=("http://bts.box.chomikuj.pl/repo/all/${pkgver}/linux64/ChomikBox-pl-installer.64.sh")
    
      21
    
      22md5sums_i686=("0b68fccbfeea249eb17e71375d9778c2")
    
      23md5sums_x86_64=("758911e6ffc6e3c2e83ad7b64a97c603")
    
      24
    
      25prepare() {
    
      26	# get the tarball from the shell script
    
      27	if [[ "${CARCH}" == "x86_64" ]]; then
    
      28		tail -c 24350255 ChomikBox-pl-installer.64.sh > chomikbox.tar.bz2
    
      29	elif [[ "${CARCH}" == "i686" ]]; then
    
      30		tail -c 24602730 ChomikBox-pl-installer.32.sh > chomikbox.tar.bz2
    
      31	else
    
      32		echo "Unsupported architecture: ${CARCH}" && exit 1
    
      33	fi
    
      34
    
      35	# extract files from the archive
    
      36	mkdir -p chomikbox && tar -xjf chomikbox.tar.bz2 -C chomikbox
    
      37
    
      38	# replace template literals in .desktop files
    
      39	for file in chomikbox/desktop/*; do
    
      40		sed -i "s/\${name}/ChomikBox/g" $file
    
      41		sed -i "s/\${version}/${pkgver}/g" $file
    
      42
    
      43		sed -i "s/\${title}/ChomikBox/g" $file
    
      44		sed -i "s/\${domain}/chomikuj.pl/g" $file
    
      45
    
      46		sed -i "s/\${exec}/chomikbox/g" $file
    
      47		sed -i "s/\${icon}/chomikbox.png/g" $file
    
      48	done
    
      49
    
      50	sed -i "s|\${path}/ChomikBox_music_light.png|chomikbox-music-light.png|g" chomikbox/desktop/chomikbox.musicfile.desktop
    
      51}
    
      52
    
      53package() {
    
      54	# move into the source directory
    
      55	cd chomikbox
    
      56
    
      57	# make the required directories
    
      58	mkdir -p "${pkgdir}/usr/share"
    
      59	mkdir -p "${pkgdir}/usr/bin"
    
      60
    
      61	# copy base files to the package directory
    
      62	find files -type f -exec install -Dm644 {} "${pkgdir}/usr/share/chomikbox/{}" \;
    
      63	find locale -type f -exec install -Dm644 {} "${pkgdir}/usr/share/chomikbox/{}" \;
    
      64	find skins -type f -exec install -Dm644 {} "${pkgdir}/usr/share/chomikbox/{}" \;
    
      65
    
      66	install -Dm644 base.ini "${pkgdir}/usr/share/chomikbox/base.ini"
    
      67
    
      68	install -Dm755 chomikbox "${pkgdir}/usr/share/chomikbox/chomikbox"
    
      69	install -Dm755 configurator "${pkgdir}/usr/share/chomikbox/configurator"
    
      70	install -Dm755 crashsender "${pkgdir}/usr/share/chomikbox/crashsender"
    
      71
    
      72	# copy the .desktop, .protocol and MIME files to the package directory
    
      73	install -Dm644 desktop/chomikbox.desktop "${pkgdir}/usr/share/applications/chomikbox.desktop"
    
      74
    
      75	#install -Dm644 desktop/chomikbox.musicfile.desktop "${pkgdir}/usr/share/applications/chomikbox-musicfile.desktop"
    
      76	#install -Dm644 desktop/chomikbox.uploader.desktop "${pkgdir}/usr/share/applications/chomikbox-uploader.desktop"
    
      77
    
      78	install -Dm644 desktop/chomikbox.action.desktop "${pkgdir}/usr/share/applications/chomikbox-action.desktop"
    
      79	install -Dm644 desktop/chomikbox.action.musicfile.desktop "${pkgdir}/usr/share/applications/chomikbox-action-musicfile.desktop"
    
      80
    
      81	install -Dm644 desktop/proto.chomik.mime "${pkgdir}/usr/share/mime/packages/chomikbox.xml"
    
      82
    
      83	# copy the icons to the package directory
    
      84	install -Dm644 ../chomikbox.png "${pkgdir}/usr/share/pixmaps/chomikbox.png"
    
      85	install -Dm644 ../chomikbox-music-light.png "${pkgdir}/usr/share/pixmaps/chomikbox-music-light.png"
    
      86
    
      87	# copy the license to the package directory
    
      88	install -Dm644 ../LICENSE.chomikbox "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      89
    
      90	# create a symlink to the executable
    
      91	ln -s /usr/share/chomikbox/chomikbox "${pkgdir}/usr/bin/chomikbox"
    
      92}
    
      93

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2