context

maintainer melonion · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary archive (context-linux-64.zip) from lmtx.pragma-ade.nl, which is the official Pragma ADE distribution server for ConTeXt LMTX — this is the canonical upstream source, not a personal or unofficial host. However, the checksum is SKIP, meaning no integrity verification is performed. More critically, the prepare() phase executes install.sh from the downloaded archive without any verification, and the package() phase installs all binaries from texmf-linux-64/bin/* directly into /usr/local/bin. While Pragma ADE is the legitimate upstream, the combination of SKIP checksum and executing a downloaded shell script + binaries without any integrity check represents a real supply-chain risk: if the host were compromised or the download intercepted (no HTTPS enforced in the URL — it uses plain HTTP), arbitrary code would execute during the build. The HTTP (not HTTPS) source URL makes MITM attacks trivially possible. This is a genuine medium-severity concern: executed binaries/scripts from an unverified download over plain HTTP.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("http://lmtx.pragma-ade.nl/install-lmtx/context-linux-64.zip")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt binary archive (context-linux-64.zip) from lmtx.pragma-ade.nl, which is the official Pragma ADE distribution server for ConTeXt LMTX — this is the canonical upstream source, not a personal or unofficial host. However, the checksum is SKIP, meaning no integrity verification is performed. More critically, the prepare() phase executes install.sh from the downloaded archive without any verification, and the package() phase installs all binaries from texmf-linux-64/bin/* directly into /usr/local/bin. While Pragma ADE is the legitimate upstream, the combination of SKIP checksum and executing a downloaded shell script + binaries without any integrity check represents a real supply-chain risk: if the host were compromised or the download intercepted (no HTTPS enforced in the URL — it uses plain HTTP), arbitrary code would execute during the build. The HTTP (not HTTPS) source URL makes MITM attacks trivially possible. This is a genuine medium-severity concern: executed binaries/scripts from an unverified download over plain HTTP.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: xeruf <27jf at pm dot me>
    
      2
    
      3_pkgname=context
    
      4pkgname=${_pkgname}
    
      5pkgver=2022.09.11_20.44
    
      6pkgrel=1
    
      7pkgdesc='ConTeXt LMTX, the Lean and Mean TeX eXperience with Lua, MetaPost, TeX, and XML'
    
      8arch=('x86_64')
    
      9url="https://wiki.contextgarden.net/Installation"
    
      10license=(GPL)
    
      11depends=()
    
      12replaces=(context-bin)
    
      13provides=(${_pkgname} ${_pkgname}-lmtx)
    
      14conflicts=(${_pkgname})
    
      15optdepends=()
    
      16source=("http://lmtx.pragma-ade.nl/install-lmtx/context-linux-64.zip")
    
      17sha256sums=(SKIP)
    
      18install=${_pkgname}.install
    
      19
    
      20prepare() {
    
      21  cd "${srcdir}"
    
      22  chmod +x install.sh
    
      23  ./install.sh
    
      24}
    
      25
    
      26package() {
    
      27  context="${pkgdir}/usr/share/texmf-dist"
    
      28  cd "tex"
    
      29
    
      30  install -d "$context"
    
      31  cp -r texmf texmf-context "$context"
    
      32  install -Dt "${pkgdir}/usr/local/bin" texmf-linux-64/bin/*
    
      33}
    
      34
    
      35pkgver() {
    
      36  # TODO use https://wiki.contextgarden.net/LMTX#How_to_check_for_newer_versions.3F
    
      37  cat "${srcdir}/tex/texmf-context/tex/context/base/mkxl/context.mkxl" |
    
      38    grep "def\\\\contextversion" |
    
      39    sed 's/^.*{\(.*\)}.*$/\1/' |
    
      40    tr ' :' '_.'
    
      41}
    
      42

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2