echoverb-vst3-bin

maintainer orphaned · 0 votes · base echoverb · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary (EchoVerbLinux.zip) from a personal/vendor S3 bucket (5db5public.s3.amazonaws.com) and installs the extracted shared libraries (.so files) directly as LV2/VST3 plugins. The sha256sums are present and pin the content, which mitigates silent substitution at build time. However, the host is an unofficial S3 bucket rather than a canonical distribution channel (e.g., GitHub releases tied to a verified upstream repo), and the installed artifacts are executed native code (.so libraries loaded by audio hosts). The vendor URL (audioassault.mx) appears to be a real commercial audio plugin developer, and '5db5' matches the bucket name pattern suggesting it is their own storage. This is a legitimate medium-risk pattern: prebuilt proprietary binaries from a vendor-controlled but non-canonical host, with checksums present. Not clearly malicious, but a genuine supply-chain concern since the S3 bucket could be taken over or the objects replaced without changing the URL.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 'https://5db5public.s3.amazonaws.com/EchoVerbLinux.zip')

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary (EchoVerbLinux.zip) from a personal/vendor S3 bucket (5db5public.s3.amazonaws.com) and installs the extracted shared libraries (.so files) directly as LV2/VST3 plugins. The sha256sums are present and pin the content, which mitigates silent substitution at build time. However, the host is an unofficial S3 bucket rather than a canonical distribution channel (e.g., GitHub releases tied to a verified upstream repo), and the installed artifacts are executed native code (.so libraries loaded by audio hosts). The vendor URL (audioassault.mx) appears to be a real commercial audio plugin developer, and '5db5' matches the bucket name pattern suggesting it is their own storage. This is a legitimate medium-risk pattern: prebuilt proprietary binaries from a vendor-controlled but non-canonical host, with checksums present. Not clearly malicious, but a genuine supply-chain concern since the S3 bucket could be taken over or the objects replaced without changing the URL.

PKGBUILD

1 offending line(s) highlighted

      1pkgbase=echoverb
    
      2pkgname=('echoverb-data-bin' 'echoverb-lv2-bin' 'echoverb-vst3-bin')
    
      3pkgver=1.0.1
    
      4pkgrel=3
    
      5arch=('x86_64')
    
      6url="https://audioassault.mx/plugin/EchoVerb"
    
      7license=('EULA')
    
      8depends=('alsa-lib' 'bzip2' 'brotli' 'freetype2' 'glibc' 'graphite' 'harfbuzz' 'keyutils' 'krb5' 'libcurl-gnutls' 'libffi' 'libnghttp2' 'libidn2' 'libp11-kit' 'libpng' 'libpsl' 'libssh2' 'libtasn1' 'libunistring' 'libxau' 'libxcb' 'libx11' 'nettle' 'openssl' 'pcre2' 'zlib' 'zstd')
    
      9makedepends=('xdg-user-dirs' 'unzip')
    
      10provides=('echoverb')
    
      11source=('EchoVerb Linker'
    
      12        'https://5db5public.s3.amazonaws.com/EchoVerbLinux.zip')
    
      13sha256sums=('341fb36de011892344b656a3da21e7a20ff1910052ccb488757fd40252390def'
    
      14            'bb256bd4043e88bbc95144e3681897ff20b246a837937cd0e33e7c0bad2a237e')
    
      15
    
      16
    
      17package_echoverb-data-bin() {
    
      18    ## Install Asset Data
    
      19    pkgdesc="Original Algorithmic Reverb Plugin (Data Assets)"
    
      20    groups=('pro-audio')
    
      21
    
      22    ## Make data assets dir
    
      23    mkdir -p "$pkgdir/usr/lib/5db5/EchoVerb/Presets"
    
      24
    
      25    ## Copy assets to data directory
    
      26    cp -r "$srcdir/Presets"/* "$pkgdir/usr/lib/5db5/EchoVerb/Presets"
    
      27
    
      28    ## Install EchoVerb Linker Script
    
      29    install -Dm755 "$srcdir/EchoVerb Linker" "$pkgdir/usr/bin/EchoVerb Linker"
    
      30}
    
      31
    
      32package_echoverb-lv2-bin() {
    
      33    ## Install LV2 Plugin
    
      34    pkgdesc="Original Algorithmic Reverb Plugin (LV2)"
    
      35    depends=('echoverb-data-bin')
    
      36    groups=('pro-audio' 'lv2-plugins')
    
      37    install -Dm755 "$srcdir/EchoVerb.lv2/EchoVerb.so" "$pkgdir/usr/lib/lv2/EchoVerb.lv2/EchoVerb.so"
    
      38    install -Dm644 "$srcdir/EchoVerb.lv2/dsp.ttl" "$pkgdir/usr/lib/lv2/EchoVerb.lv2/dsp.ttl"
    
      39    install -Dm644 "$srcdir/EchoVerb.lv2/manifest.ttl" "$pkgdir/usr/lib/lv2/EchoVerb.lv2/manifest.ttl"
    
      40    install -Dm644 "$srcdir/EchoVerb.lv2/ui.ttl" "$pkgdir/usr/lib/lv2/EchoVerb.lv2/ui.ttl"
    
      41}
    
      42
    
      43package_echoverb-vst3-bin() {
    
      44    ## Install VST3 Plugin
    
      45    pkgdesc="Original Algorithmic Reverb Plugin (VST3)"
    
      46    depends=('echoverb-data-bin')
    
      47    groups=('pro-audio' 'vst3-plugins')
    
      48    install -Dm755 "$srcdir/EchoVerb.vst3/Contents/Resources/moduleinfo.json" "$pkgdir/usr/lib/vst3/EchoVerb.vst3/Contents/Resources/moduleinfo.json"
    
      49    install -Dm755 "$srcdir/EchoVerb.vst3/Contents/x86_64-linux/EchoVerb.so" "$pkgdir/usr/lib/vst3/EchoVerb.vst3/Contents/x86_64-linux/EchoVerb.so"
    
      50}
    
      51

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2