dream3d

maintainer orphaned · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary tarball directly from dream3d.bluequartz.net (the official DREAM.3D project host) and installs it wholesale into /opt. While bluequartz.net is the legitimate upstream vendor for DREAM.3D software, distributing and installing prebuilt binaries from any external host — even the official one — carries inherent supply-chain risk: if the host is compromised or the binary is replaced, the sha256 checksum would catch substitution only if the attacker doesn't also update the checksum (which they can't in the AUR PKGBUILD itself, so the checksum does provide meaningful protection here). The pattern of installing a prebuilt binary blob rather than building from source is the classic medium-risk AUR pattern. The host is the actual upstream project site, not a personal or random host, which reduces (but does not eliminate) concern. No obfuscation, no piracy, no exfiltration indicators present.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:10 source=(http://dream3d.bluequartz.net/binaries/DREAM3D-${pkgver}-Linux-x86_64.tar.gz

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary tarball directly from dream3d.bluequartz.net (the official DREAM.3D project host) and installs it wholesale into /opt. While bluequartz.net is the legitimate upstream vendor for DREAM.3D software, distributing and installing prebuilt binaries from any external host — even the official one — carries inherent supply-chain risk: if the host is compromised or the binary is replaced, the sha256 checksum would catch substitution only if the attacker doesn't also update the checksum (which they can't in the AUR PKGBUILD itself, so the checksum does provide meaningful protection here). The pattern of installing a prebuilt binary blob rather than building from source is the classic medium-risk AUR pattern. The host is the actual upstream project site, not a personal or random host, which reduces (but does not eliminate) concern. No obfuscation, no piracy, no exfiltration indicators present.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Martin Diehl <aur@martin-diehl.net>
    
      2pkgname=dream3d
    
      3pkgver=6.5.171
    
      4pkgrel=1
    
      5pkgdesc='Analysis tool for microstructure data'
    
      6arch=('x86_64')
    
      7url='http://dream3d.bluequartz.net'
    
      8license=('custom: DREAM.3D License')
    
      9depends=('libpng15')
    
      10source=(http://dream3d.bluequartz.net/binaries/DREAM3D-${pkgver}-Linux-x86_64.tar.gz
    
      11        dream3d.desktop)
    
      12sha256sums=('10ee14392f344a69779d370777d9ffd845226669ee5a6ea24e4a58460cdd2fce'
    
      13            'f53cf8ef2e97aa31fd41bd6723109502d5909aa43f6796ee7e734fe36ac427bc')
    
      14package() {
    
      15
    
      16  install -Dm644 "$pkgname.desktop" "$pkgdir/usr/share/applications/$pkgname.desktop"
    
      17
    
      18  cd $srcdir
    
      19
    
      20  mkdir -p "$pkgdir/usr/bin"
    
      21  mkdir -p "$pkgdir/opt/dream3d"
    
      22  mkdir -p "$pkgdir/usr/share/licenses/$pkgname/"
    
      23
    
      24  cp -r  DREAM3D-${pkgver}-Linux-x86_64/*        $pkgdir/opt/dream3d/
    
      25
    
      26  ln -s /opt/dream3d/bin/DREAM3D                 $pkgdir/usr/bin/
    
      27  ln -s /opt/dream3d/bin/PipelineRunner          $pkgdir/usr/bin/
    
      28
    
      29  install -Dm644 DREAM3D-${pkgver}-Linux-x86_64/*.txt $pkgdir/usr/share/licenses/$pkgname/
    
      30}
    
      31

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2