easyboard

maintainer dillpickledev · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads and installs prebuilt x86 binaries (EasyBoard executables and a .pck resource file) from archive.org, which is an unofficial, user-uploaded content host rather than an official vendor release server. While the sha256sums are pinned (mitigating silent replacement to some degree), archive.org items can be re-uploaded or modified by the uploader, and there is no code-signing or other integrity guarantee beyond the hash. The binaries are directly installed and made executable, so any compromise of the archive.org item would result in arbitrary code execution on the user's system. This is a genuine medium-severity supply-chain concern: prebuilt binaries from a non-authoritative host with no vendor signing.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("https://archive.org/download/easy-board-linux-v0.1.0.tar/EasyBoard_Linux.tar.gz")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): This PKGBUILD downloads and installs prebuilt x86 binaries (EasyBoard executables and a .pck resource file) from archive.org, which is an unofficial, user-uploaded content host rather than an official vendor release server. While the sha256sums are pinned (mitigating silent replacement to some degree), archive.org items can be re-uploaded or modified by the uploader, and there is no code-signing or other integrity guarantee beyond the hash. The binaries are directly installed and made executable, so any compromise of the archive.org item would result in arbitrary code execution on the user's system. This is a genuine medium-severity supply-chain concern: prebuilt binaries from a non-authoritative host with no vendor signing.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Sahar Shulman <dillpickledev@gmail.com>
    
      2pkgname=easyboard
    
      3pkgver=0.1.0
    
      4pkgrel=2
    
      5pkgdesc="Whiteboard for Project Planning, Mind Mapping, Note Taking, and more."
    
      6arch=(x86_64 x86_32)
    
      7license=('Proprietary')
    
      8
    
      9source=()
    
      10
    
      11case "$CARCH" in
    
      12    x86_64)
    
      13    	source=("https://archive.org/download/easy-board-linux-v0.1.0.tar/EasyBoard_Linux.tar.gz")
    
      14      sha256sums+=("658da651515ff4c18cf5a19659ab4405fcec65df5741793b1e023ccbbdda0aff")
    
      15      ;;
    
      16    x86_32)
    
      17    	source=("https://archive.org/download/easy-board-linux-v0.1.0.tar/EasyBoard_Linux_x86_32.tar.gz")
    
      18			sha256sums=("a04eefb8913eb294fda810d024702c5f88bb37dd5886329781429b543055cae2")
    
      19    	;;
    
      20esac
    
      21
    
      22_executable_base_name="EasyBoard"
    
      23_executable_name="${_executable_base_name}.${CARCH}"
    
      24_pck_name="${_executable_base_name}.pck"
    
      25_install_dir="/usr/share/${pkgname}"
    
      26_bin_dir="/usr/bin"
    
      27_desktop_file_dir="/usr/share/applications"
    
      28_desktop_file_name="${pkgname}.desktop"
    
      29_icons_dir="/usr/share/icons"
    
      30_icon_filetype="png"
    
      31
    
      32_RUN_SCRIPT="#!/bin/bash
    
      33${_install_dir}/${_executable_name} \"\$@\""
    
      34
    
      35package() {
    
      36	_root_dir="${srcdir}/.."
    
      37	mkdir -p "${pkgdir}/${_install_dir}"
    
      38	cp -f "${srcdir}/${_executable_name}" "${pkgdir}/${_install_dir}"
    
      39	cp -f "${srcdir}/${_pck_name}" "${pkgdir}/${_install_dir}"
    
      40	mkdir -p "${pkgdir}/${_bin_dir}"
    
      41	echo "${_RUN_SCRIPT}" > "${pkgdir}/${_bin_dir}/${pkgname}"
    
      42	chmod +x "${pkgdir}/${_bin_dir}/${pkgname}"
    
      43	mkdir -p "${pkgdir}/${_desktop_file_dir}"
    
      44	cp "${_root_dir}/${_desktop_file_name}" "${pkgdir}/${_desktop_file_dir}/${_desktop_file_name}"
    
      45	mkdir -p "${pkgdir}/${_icons_dir}"
    
      46	cp "${_root_dir}/${pkgname}.${_icon_filetype}" "${pkgdir}/${_icons_dir}/${pkgname}.${_icon_filetype}"
    
      47}
    
      48

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2