edrawinfo-bin

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary .run installer (compressed with gzip) from edrawsoft.com, which is the official vendor site for EdrawSoft software. The source has a sha256sum checksum, providing integrity verification against the pinned hash. The prepare() function extracts a self-extracting archive by parsing the embedded line offset and unpacking a tarball from within the .run file — this is a standard pattern for makeself-style installers. The resulting binary is then installed to /opt and symlinked into /usr/bin. The concern is that this is a prebuilt proprietary binary from a vendor host with no reproducibility or source audit possible, and the sha256sum only pins one specific version — if edrawsoft.com were to serve a different binary at the same URL (e.g. after a silent update), the checksum would catch it, but only if the URL remains stable. The host is the legitimate upstream vendor (edrawsoft.com), not a personal or unofficial mirror, which reduces but does not eliminate supply-chain risk. Overall this is a standard -bin package pattern for proprietary software: a prebuilt binary from the official vendor, checksummed, installed to /opt. This is medium risk by AUR standards (executed binary, no source audit), but not elevated beyond that.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:8 url="https://www.edrawsoft.com/archives/${pkgname/-bin/}-${arch/x86_/}.run.gz"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt binary .run installer (compressed with gzip) from edrawsoft.com, which is the official vendor site for EdrawSoft software. The source has a sha256sum checksum, providing integrity verification against the pinned hash. The prepare() function extracts a self-extracting archive by parsing the embedded line offset and unpacking a tarball from within the .run file — this is a standard pattern for makeself-style installers. The resulting binary is then installed to /opt and symlinked into /usr/bin. The concern is that this is a prebuilt proprietary binary from a vendor host with no reproducibility or source audit possible, and the sha256sum only pins one specific version — if edrawsoft.com were to serve a different binary at the same URL (e.g. after a silent update), the checksum would catch it, but only if the URL remains stable. The host is the legitimate upstream vendor (edrawsoft.com), not a personal or unofficial mirror, which reduces but does not eliminate supply-chain risk. Overall this is a standard -bin package pattern for proprietary software: a prebuilt binary from the official vendor, checksummed, installed to /opt. This is medium risk by AUR standards (executed binary, no source audit), but not elevated beyond that.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: dszryan <dszryan@local>
    
      2pkgname=edrawinfo-bin
    
      3pkgver=8.6
    
      4pkgrel=3
    
      5epoch=1
    
      6pkgdesc="Edraw Infographic is a graphic design and data visualization software compatible with different OS."
    
      7arch=('x86_64')
    
      8url="https://www.edrawsoft.com/archives/${pkgname/-bin/}-${arch/x86_/}.run.gz"
    
      9license=('custom:"Copyright EdrawSoft 2004-2018; All Rights Reserved."')
    
      10groups=()
    
      11depends=(qt5-base)
    
      12makedepends=()
    
      13checkdepends=()
    
      14optdepends=()
    
      15provides=()
    
      16conflicts=()
    
      17replaces=()
    
      18backup=()
    
      19options=(!strip)
    
      20install=
    
      21changelog=
    
      22source=(
    
      23  https://www.edrawsoft.com/archives/${pkgname/-bin/}-${arch/x86_/}.run.gz)
    
      24sha256sums=(
    
      25  '6ff695c83de59e3964d607aa52c6ab75321472600013d3877f3fa9d5cf4d4deb')
    
      26
    
      27prepare() {
    
      28  echo "Extracting files..."
    
      29  cd "${srcdir}" && mkdir -p "${srcdir}/$pkgname-$pkgver"
    
      30  grep -a "line=" "${pkgname/-bin/}-${arch/x86_/}.run" | sed "s|line=||g" | xargs -I {} tail -n +{} "${pkgname/-bin/}-${arch/x86_/}.run" > "${pkgname/-bin/}-${arch/x86_/}.tar.gz"
    
      31  tar zxf "${pkgname/-bin/}-${arch/x86_/}.tar.gz" --directory "${srcdir}/$pkgname-$pkgver" --strip 1
    
      32}
    
      33
    
      34check() {
    
      35  cd "${srcdir}/$pkgname-$pkgver"
    
      36}
    
      37
    
      38package() {
    
      39  mkdir -p \
    
      40    "$pkgdir/opt/${pkgname/-bin/}" \
    
      41    "$pkgdir/usr/share/applications/" \
    
      42    "$pkgdir/usr/share/mime/packages/" \
    
      43    "$pkgdir/usr/share/icons/gnome/scalable/mimetypes/" \
    
      44    "$pkgdir/usr/bin/"
    
      45
    
      46  cp  -R  "${srcdir}/$pkgname-$pkgver/."                                 "$pkgdir/opt/${pkgname/-bin/}/"
    
      47  cp  -f  "${srcdir}/$pkgname-$pkgver/${pkgname/-bin/}.desktop"          "$pkgdir/usr/share/applications/"
    
      48  cp  -f  "${srcdir}/$pkgname-$pkgver/${pkgname/-bin/}.png"              "$pkgdir/usr/share/icons/edinfo.png"
    
      49  cp  -f  "${srcdir}/$pkgname-$pkgver/eddx.svg"                          "$pkgdir/usr/share/icons/gnome/scalable/mimetypes/edinfo.svg"
    
      50  cp  -f  "${srcdir}/$pkgname-$pkgver/${pkgname/-bin/}.xml"              "$pkgdir/usr/share/mime/packages/"
    
      51  ln  -fs "/opt/${pkgname/-bin/}/EdrawInfo"                              "$pkgdir/usr/bin/${pkgname/-bin/}"
    
      52  sed -i  's|eddx|edinfo|g'                                              "$pkgdir/usr/share/mime/packages/${pkgname/-bin/}.xml"
    
      53  sed -iE 's|eddx|edinfo|g; s|Icon.*|Icon=/usr/share/icons/edinfo.png|g' "$pkgdir/usr/share/applications/${pkgname/-bin/}.desktop"
    
      54}
    
      55
    
      56post_install() {
    
      57  update-desktop-database   /usr/share/applications
    
      58  update-mime-database      /usr/share/mime
    
      59  gtk-update-icon-cache -f  /usr/share/icons/gnome/
    
      60  ldconfig
    
      61}
    
      62
    
      63post_upgrade() {
    
      64  update-desktop-database   /usr/share/applications
    
      65  update-mime-database      /usr/share/mime
    
      66  gtk-update-icon-cache -f  /usr/share/icons/gnome/
    
      67  ldconfig
    
      68}
    
      69
    
      70# vim:set ts=2 sw=2 et:
    
      71

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2