easy2boot

maintainer rvasilev · 3 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a password-protected zip from FossHub (a legitimate open-source hosting site), but the actual download URL is resolved dynamically at build time by scraping the FossHub HTML page, calling the FossHub API, and then fetching the real zip with wget inside prepare(). The checksum is SKIP, so there is no integrity verification of the final binary payload. The zip is then extracted with bsdtar using a hardcoded passphrase ('e2b'). The package installs several executables (bootlace.com, udefrag, defragfs, etc.) — prebuilt binaries — directly into /opt and /usr/bin. The core concern is: (1) prebuilt binaries with no checksum verification, (2) the download URL is constructed dynamically at build time via an API call, meaning the actual binary fetched is not pinned to any hash and could be substituted server-side or via MITM. FossHub is a legitimate hosting platform, but the dynamic URL resolution and SKIP checksum mean there is a genuine supply-chain risk for executed binaries. This is a real medium-severity concern, not a false positive.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:43 _url=$(wget -O- --post-data="${postData}" --header='Content-Type:application/json' https://api.fosshub.com/download/ | jq '.data.url' | sed -e 's/^"//' -e 's/"$//')

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 "fosshub.html::https://www.fosshub.com/Easy2Boot.html/${_fileName}"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a password-protected zip from FossHub (a legitimate open-source hosting site), but the actual download URL is resolved dynamically at build time by scraping the FossHub HTML page, calling the FossHub API, and then fetching the real zip with wget inside prepare(). The checksum is SKIP, so there is no integrity verification of the final binary payload. The zip is then extracted with bsdtar using a hardcoded passphrase ('e2b'). The package installs several executables (bootlace.com, udefrag, defragfs, etc.) — prebuilt binaries — directly into /opt and /usr/bin. The core concern is: (1) prebuilt binaries with no checksum verification, (2) the download URL is constructed dynamically at build time via an API call, meaning the actual binary fetched is not pinned to any hash and could be substituted server-side or via MITM. FossHub is a legitimate hosting platform, but the dynamic URL resolution and SKIP checksum mean there is a genuine supply-chain risk for executed binaries. This is a real medium-severity concern, not a false positive.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Asger Hautop Drewsen <asgerdrewsen@gmail.com>
    
      2
    
      3# You need to manually download the Easy2Boot_v1.B8 zip file from:
    
      4# https://www.fosshub.com/Easy2Boot.html?dwl=Easy2Boot_v1.B8.zip
    
      5
    
      6_grub4dos_version=0.4.5
    
      7pkgname='easy2boot'
    
      8pkgver='2.19'
    
      9pkgrel='1'
    
      10pkgdesc='Highly-configurable USB drive multiboot software with support for Secure UEFI booting'
    
      11url='http://www.easy2boot.com/'
    
      12arch=('any')
    
      13license=('custom:easy2boot license')
    
      14depends=()
    
      15makedepends=('dos2unix' 'jq')
    
      16install="$pkgname.install"
    
      17_projectName='Easy2Boot'
    
      18# _projectUri="${_projectName}.html"
    
      19# _projectId='5d01346325224d0a6d31f6d8'
    
      20_fileName="${_projectName}_v${pkgver}_password_is_e2b.zip"
    
      21source=(
    
      22  "fosshub.html::https://www.fosshub.com/Easy2Boot.html/${_fileName}"
    
      23  # "grub4dos.rar::http://dl.grub4dos.chenall.net/grub4dos-${_grub4dos_version}-2009-12-23.rar"
    
      24)
    
      25noextract=('fosshub.html')
    
      26md5sums=('SKIP')
    
      27
    
      28prepare() {
    
      29
    
      30  json=$(cat fosshub.html | sed -n 's/.*var.*settings.*=//p' | jq)
    
      31
    
      32  # projectId=$(echo ${json} | jq '{projectId: .projectId}')
    
      33
    
      34  tempJson=$(echo ${json} | jq --arg _fileName ${_fileName} '.pool.f[] | select(.n==$_fileName) | {fileName: .n, releaseId: .r}')
    
      35  tempJson2=$(echo $json | jq '.pool | {projectId: .p, source: .c, projectUri: .u}')
    
      36
    
      37  # echo ${tempJson}
    
      38
    
      39  postData=$(echo $tempJson $tempJson2 | jq -s 'add')
    
      40
    
      41  # echo $postData | jq
    
      42
    
      43  _url=$(wget -O- --post-data="${postData}" --header='Content-Type:application/json' https://api.fosshub.com/download/ | jq '.data.url' | sed -e 's/^"//' -e 's/"$//')
    
      44
    
      45  # _url=$(wget -O- --post-data="${postData}" --header='Content-Type:application/json' https://api.fosshub.com/download/ | sed -n 's/.*"data"://p' | jq '.url')
    
      46
    
      47  # _url=${_url:}
    
      48
    
      49  # echo $_url
    
      50  wget -O ${_fileName} $_url
    
      51
    
      52  bsdtar -x --passphrase e2b -f ${_fileName}
    
      53
    
      54  cd "$srcdir/_ISO"
    
      55
    
      56  bsdtar -c -v -f "CONTIG.ISO.xz" -J "CONTIG.ISO"
    
      57
    
      58  rm "CONTIG.ISO"
    
      59
    
      60
    
      61  # Use newer, working bootlace
    
      62  # unrar e grub4dos.rar grub4dos-${_grub4dos_version}/bootlace.com
    
      63  # mv bootlace.com _ISO/docs/linux_utils/bootlace.com
    
      64  # rm grub4dos.rar
    
      65}
    
      66
    
      67package() {
    
      68  rm "${_fileName}"
    
      69  rm "fosshub.html"
    
      70
    
      71  execs=(
    
      72    'add-32-bit-support.sh'
    
      73    'bootlace.com'
    
      74    'bootlace64.com'
    
      75    'CreatePersistenceFile.sh'
    
      76    'defragfs'
    
      77    'defragfs.pl'
    
      78    'fmt.sh'
    
      79    'fmt_ntfs.sh'
    
      80    'grldr.mbr'
    
      81    'ReadMe_fmt.sh.txt'
    
      82    'runfmt.sh'
    
      83    'udefrag'
    
      84  )
    
      85
    
      86  mkdir -p "${pkgdir}/usr/bin"
    
      87
    
      88  dir="${pkgdir}/opt/easy2boot"
    
      89  mkdir -p "$dir"
    
      90  cp -r . "$dir"
    
      91  for f in "${execs[@]}"; do
    
      92    d="_ISO/docs/linux_utils/$f"
    
      93    dos2unix "${dir}/$d"
    
      94    chmod +x "${dir}/$d"
    
      95    _make_wrapper "/opt/easy2boot/$d" "${pkgdir}/usr/bin/$f"
    
      96  done
    
      97
    
      98  install -Dpm644 "_ISO/docs/Licences/E2B_LICENCE.txt" -T "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      99}
    
      100
    
      101_make_wrapper() {
    
      102	cat > "$2" <<END
    
      103#!/bin/bash
    
      104exec "$1" "\$@"
    
      105END
    
      106	chmod +x "$2"
    
      107}
    
      108
    
      109

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 00:29:32	MEDIUM	3
2026-07-21 00:24:15	MEDIUM	3
2026-07-20 00:19:49	MEDIUM	3
2026-07-19 00:17:08	MEDIUM	3
2026-07-18 00:14:48	MEDIUM	3
2026-07-17 00:06:16	MEDIUM	3
2026-07-16 00:05:41	MEDIUM	3
2026-07-15 00:09:25	MEDIUM	3