digiflisp

maintainer hulthe · 3 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary .deb from gbgmv.se (Gothenburg Mathematics and Computer Science / GMV, a Swedish educational institution) and installs its executables directly. The URL matches the package's stated upstream URL, and both md5 and sha256 checksums are provided, which mitigates substitution risk somewhat. However, the binaries are closed-source (proprietary copyright notice), hosted on a non-major institutional domain, and installed directly as executables — this is a genuine medium supply-chain concern: if gbgmv.se is compromised or the maintainer updates the file without updating checksums, users would execute arbitrary binaries. The checksums do provide a meaningful integrity check at the time of packaging. This is a legitimate educational tool (FLIS processor IDE) from what appears to be a Swedish university/institution, not a personal blog, but it still represents the classic AUR pattern of 'binary blob from unofficial host' that warrants medium severity rather than clean.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=(http://www.gbgmv.se/dl/linux/$pkgname\_$pkgver\_amd64.deb)

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt binary .deb from gbgmv.se (Gothenburg Mathematics and Computer Science / GMV, a Swedish educational institution) and installs its executables directly. The URL matches the package's stated upstream URL, and both md5 and sha256 checksums are provided, which mitigates substitution risk somewhat. However, the binaries are closed-source (proprietary copyright notice), hosted on a non-major institutional domain, and installed directly as executables — this is a genuine medium supply-chain concern: if gbgmv.se is compromised or the maintainer updates the file without updating checksums, users would execute arbitrary binaries. The checksums do provide a meaningful integrity check at the time of packaging. This is a legitimate educational tool (FLIS processor IDE) from what appears to be a Swedish university/institution, not a personal blog, but it still represents the classic AUR pattern of 'binary blob from unofficial host' that warrants medium severity rather than clean.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Joakim Hulthe <joakim@hulthe.net>
    
      2pkgname=digiflisp
    
      3pkgver=2.08
    
      4pkgrel=1
    
      5pkgdesc="IDE for the FLIS processor and training computer"
    
      6arch=('x86_64')
    
      7url="https://www.gbgmv.se/studies.html"
    
      8license=('Copyright 2012-2025, GMV')
    
      9
    
      10makedepends=('libarchive')
    
      11
    
      12source=(http://www.gbgmv.se/dl/linux/$pkgname\_$pkgver\_amd64.deb)
    
      13md5sums=('513b51367522ac2e7c689fc88392d9bc')
    
      14sha256sums=('5d9a9c90f4e872c6f85c1e90914164a1c6c695c0c01f977b872026848f88af1d')
    
      15
    
      16prepare() {
    
msg2 "Unpacking .deb/data.tar.xz"
    
cd $srcdir
    
bsdtar -xf data.tar.xz
    
      20}
    
      21
    
      22package() {
    
depends=(
    
'at-spi2-core'
    
'brotli'
    
'bzip2'
    
'cairo'
    
'dbus'
    
'expat'
    
'fontconfig'
    
'freetype2'
    
'fribidi'
    
'gcc-libs'
    
'gdk-pixbuf2'
    
'glib2'
    
'glibc'
    
'graphite'
    
'gtk3'
    
'harfbuzz'
    
'icu'
    
'jbigkit'
    
'json-glib'
    
'libcap'
    
'libcloudproviders'
    
'libdatrie'
    
'libepoxy'
    
'libffi'
    
'libice'
    
'libjpeg-turbo'
    
'libpng'
    
'libsm'
    
'libthai'
    
'libtiff'
    
'pango'
    
'pcre2'
    
'pixman'
    
'sqlite'
    
'systemd-libs'
    
'util-linux-libs'
    
'xz'
    
'zlib'
    
'zstd'
    
)
    
      64
    
optdepends=(
    
'libx11'
    
'libxau'
    
'libxcb'
    
'libxcomposite'
    
'libxcursor'
    
'libxdamage'
    
'libxdmcp'
    
'libxext'
    
'libxfixes'
    
'libxi'
    
'libxinerama'
    
'libxkbcommon'
    
'libxml2'
    
'libxrandr'
    
'libxrender'
    
'libxxf86vm'
    
'wayland'
    
)
    
      84
    
msg2 "Moving stuff in place"
    
install -Dm755 "$srcdir/usr/share/digiflisp/digiflisp" \
    
              "$pkgdir/usr/share/digiflisp/digiflisp"
    
      88
    
install -Dm755 "$srcdir/usr/share/digiflisp/digiflisp.png" \
    
              "$pkgdir/usr/share/digiflisp/digiflisp.png"
    
      91
    
install -Dm755 "$srcdir/usr/share/digiflisp/qaflisp" \
    
              "$pkgdir/usr/share/digiflisp/qaflisp"
    

    
install -Dm644 "$srcdir/usr/share/applications/digiflisp.desktop" \
    
              "$pkgdir/usr/share/applications/digiflisp.desktop"
    

    
install -Dm644 "$srcdir/usr/share/doc/digiflisp/changelog.gz" \
    
              "$pkgdir/usr/share/doc/digiflisp/changelog.gz"
    
      100
    
install -Dm644 "$srcdir/usr/share/doc/digiflisp/copyright" \
    
              "$pkgdir/usr/share/doc/digiflisp/copyright"
    
      103
    
msg2 "Creating symlinks"
    
mkdir -p "$pkgdir/usr/bin"
    
ln -s "/usr/share/digiflisp/digiflisp" "$pkgdir/usr/bin/digiflisp"
    
ln -s "/usr/share/digiflisp/qaflisp"   "$pkgdir/usr/bin/qaflisp"
    
      108}
    
      109

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2