ebus-sdk

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary SDK installer (.zip containing a .run file) from photonfocus.com (a third-party camera vendor site, not the official Pleora/eBUS SDK host listed in the url= field) and then executes it with --noexec --target to extract it. The sha512sums are present and cover the downloaded archive, which mitigates the risk of in-transit tampering, but the source host is a third-party vendor mirror rather than the official upstream (pleora.com). The extracted .run file's contents (prebuilt binaries, shared libraries) are then installed into /opt and /usr. This is a legitimate industrial machine-vision SDK packaging pattern, but the combination of executing a prebuilt binary blob from a non-primary vendor host with no reproducibility guarantees constitutes a real supply-chain concern: if photonfocus.com were compromised or served a different file, the checksums would catch it, but the binaries themselves are opaque and trusted implicitly. This is a textbook medium-severity supply-chain concern — not clearly malicious, but an executed binary from an unofficial/third-party host.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 "$pkgname-$pkgver.tar.bz2::http://www.photonfocus.com/fileadmin/web/downloads/ebus_sdk_${pkgver}_rhel-6-$CARCH.zip"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary SDK installer (.zip containing a .run file) from photonfocus.com (a third-party camera vendor site, not the official Pleora/eBUS SDK host listed in the url= field) and then executes it with --noexec --target to extract it. The sha512sums are present and cover the downloaded archive, which mitigates the risk of in-transit tampering, but the source host is a third-party vendor mirror rather than the official upstream (pleora.com). The extracted .run file's contents (prebuilt binaries, shared libraries) are then installed into /opt and /usr. This is a legitimate industrial machine-vision SDK packaging pattern, but the combination of executing a prebuilt binary blob from a non-primary vendor host with no reproducibility guarantees constitutes a real supply-chain concern: if photonfocus.com were compromised or served a different file, the checksums would catch it, but the binaries themselves are opaque and trusted implicitly. This is a textbook medium-severity supply-chain concern — not clearly malicious, but an executed binary from an unofficial/third-party host.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Maarten de Vries <maarten@de-vri.es>
    
      2pkgname=ebus-sdk
    
      3pkgdesc="toolset for digital video systems and cameras"
    
      4pkgver=3.1.14.3284
    
      5pkgrel=2
    
      6arch=(x86_64)
    
      7license=(custom)
    
      8depends=(
    
      9	curl
    
      10	log4cxx
    
      11)
    
      12optdepends=(
    
      13	'qt4: for GUI tools'
    
      14)
    
      15url='https://www.pleora.com/products/ebus-sdk/'
    
      16
    
      17source=(
    
      18	"$pkgname-$pkgver.tar.bz2::http://www.photonfocus.com/fileadmin/web/downloads/ebus_sdk_${pkgver}_rhel-6-$CARCH.zip"
    
      19	"ebus-sdk-config.cmake"
    
      20	"ebus-sdk-config-version.cmake"
    
      21)
    
      22
    
      23sha512sums=('3f10ae59550f7358088c048200c10a336d95d365549d861da12fa03fbfea14b507268bf3ba8db40f290aafbcb9b5430f2158fbadaeeda40cdd11fa5a20edce75'
    
      24            'c001730965a5cc01e292b2e6768bd9d44f6ab763f51b486be29b0b5e5b40e1d3333a3e3f9cd1deb762967ea4e873e5af36fe796f89ca159429973cce96385dc7'
    
      25            'f2e263c1a4521fb323091237227c8be5bd9186a18aca3e96ab7f82bf767e88ce677078a5ba0d30fb9c2624d9721af6c16fa0b2d02e59ca61b3d7af26676a7993')
    
      26
    
      27_install_dir() {
    
      28	local source_root="$1"
    
      29	local target_root="$2"
    
      30	local mode="$3"
    
      31
    
      32
    
      33	for file in $(find "$source_root" -type f -o -type l); do
    
      34		local target_file="$target_root/${file#${source_root}/}"
    
      35		local target_dir="$(dirname "$target_file")"
    
      36		mkdir -p "$target_dir"
    
      37		cp -nP "$file" "$target_file" || return 1
    
      38		[[ -f "$target_file" ]] && chmod "$mode" "$target_file"
    
      39	done
    
      40}
    
      41
    
      42_shrink_rpaths() {
    
      43	for file in "$@"; do
    
      44		local type="$(file -hb "$file")"
    
      45		[[ "${type:0:4}" = "ELF " ]] || continue
    
      46		patchelf --shrink-rpath "$file"
    
      47	done
    
      48}
    
      49
    
      50prepare() {
    
      51	"$srcdir/eBUS_SDK_${pkgver}_RHEL-6-$CARCH.run" --noexec --target "$srcdir"
    
      52}
    
      53
    
      54package() {
    
      55	local dir="$srcdir"
    
      56	local target_dir="$pkgdir/opt/ebus-sdk"
    
      57
    
      58	_install_dir  "$dir/include" "$target_dir/include/ebus-sdk" 644
    
      59	_install_dir  "$dir/bin"     "$target_dir/bin"              755
    
      60	_install_dir  "$dir/lib"     "$target_dir/lib"              755
    
      61	_install_dir  "$dir/share"   "$target_dir/share"            644
    
      62
    
      63	find "$pkgdir" -name '.svn' -prune -exec rm -rf '{}' ';'
    
      64
    
      65	_shrink_rpaths "$target_dir/lib/"*
    
      66	_shrink_rpaths "$target_dir/lib/genicam/bin/Linux64_x64/"*
    
      67	_shrink_rpaths "$target_dir/lib/genicam/bin/Linux64_x64/GenApi/Generic/"*
    
      68
    
      69	install -m 644 -Dt "$pkgdir/usr/lib/cmake/$pkgname" "$srcdir/$pkgname-config.cmake"
    
      70	install -m 644 -Dt "$pkgdir/usr/lib/cmake/$pkgname" "$srcdir/$pkgname-config-version.cmake"
    
      71}
    
      72

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2