decent-sampler-bin

maintainer silverhikari · 6 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD installs a prebuilt binary (DecentSampler executable + VST/VST3 libraries) sourced from archive.org rather than the official vendor host (decentsamples.com). Archive.org is a legitimate archival service but is not the canonical distribution channel for this software — the vendor's own download page is listed in the url= field. Using archive.org as a mirror means the artifact's provenance is unverifiable: anyone can upload to archive.org, and there is no cryptographic signing (e.g. GPG) to prove the tarball came from the original developer. The sha256sums provide integrity checking against tampering in transit, but do not prove the archived file was ever the authentic vendor release. The executed binary and shared libraries (DecentSampler, DecentSampler.so, DecentSampler.vst3) run with user privileges and could contain arbitrary code. This is a genuine supply-chain concern: a prebuilt binary from a non-official host with no code-signing verification. It does not rise to 'high' because there is no evidence of active malice, obfuscation, or exfiltration — it is the classic AUR pattern of a third-party mirror for a proprietary binary, which is legitimately rated medium.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("https://archive.org/download/decent-sampler-linux-static-download-mirror/Decent_Sampler-1.23.1-Linux-Static-x86_64.tar.gz" "decent-sampler.png" "decent-sampler.desktop" "application-decent-sampler.xml")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD installs a prebuilt binary (DecentSampler executable + VST/VST3 libraries) sourced from archive.org rather than the official vendor host (decentsamples.com). Archive.org is a legitimate archival service but is not the canonical distribution channel for this software — the vendor's own download page is listed in the url= field. Using archive.org as a mirror means the artifact's provenance is unverifiable: anyone can upload to archive.org, and there is no cryptographic signing (e.g. GPG) to prove the tarball came from the original developer. The sha256sums provide integrity checking against tampering in transit, but do not prove the archived file was ever the authentic vendor release. The executed binary and shared libraries (DecentSampler, DecentSampler.so, DecentSampler.vst3) run with user privileges and could contain arbitrary code. This is a genuine supply-chain concern: a prebuilt binary from a non-official host with no code-signing verification. It does not rise to 'high' because there is no evidence of active malice, obfuscation, or exfiltration — it is the classic AUR pattern of a third-party mirror for a proprietary binary, which is legitimately rated medium.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: silverhikari <kerrickethan@gmail.com>
    
      2pkgname=decent-sampler-bin
    
      3pkgver=1.23.1
    
      4pkgrel=1
    
      5pkgdesc="a sampling plugin that allows you to play samples in the Decent Sampler format"
    
      6arch=(x86_64)
    
      7url="https://www.decentsamples.com/product/decent-sampler-plugin/"
    
      8
    
      9license=('nonfree')
    
      10depends=('alsa-lib' 'freetype2')
    
      11provides=('decent-sampler')
    
      12source=("https://archive.org/download/decent-sampler-linux-static-download-mirror/Decent_Sampler-1.23.1-Linux-Static-x86_64.tar.gz" "decent-sampler.png" "decent-sampler.desktop" "application-decent-sampler.xml")
    
      13sha256sums=('5c5189664d1083b9ac463d9a6cbd5929426c611e5966c67baf9ccfeae09a574e' 'f2eb1d90eb08cf725a139b2c05c48a3b40b245aa8c92aea34c5ec6f35630e31b' '23420f5a6839ce70c3f28fe8e3abd45b47b722be9805ebfbf5630bd4cda17ca1' 'f45eefe4e35d6973e55af2ff3a07d392273b2141dc8ff025c0f86597bbb90bb8')
    
      14
    
      15package() {
    
      16	cd "Decent_Sampler-${pkgver}-Linux-Static-x86_64"
    
      17	install -Dm755 "DecentSampler" "${pkgdir}/usr/bin/DecentSampler"
    
      18	install -Dm755 "DecentSampler.so" "${pkgdir}/usr/lib/vst/DecentSampler.so"
    
      19	install -d "${pkgdir}/usr/lib/vst3"
    
      20	cp -r "DecentSampler.vst3" "${pkgdir}/usr/lib/vst3/"
    
      21	cd "${srcdir}"
    
      22	install -Dm755 "decent-sampler.desktop" "${pkgdir}/usr/share/applications/decent-sampler.desktop"
    
      23	install -Dm755 "decent-sampler.png" "${pkgdir}/usr/share/pixmaps/decent-sampler.png"
    
      24	install -Dm755 "application-decent-sampler.xml" "${pkgdir}/usr/share/mime/packages/application-decent-sampler.xml"
    
      25}
    
      26

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2