edrawproject-en

maintainer taotieren · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt .deb binary from download.edrawsoft.com (the official EdrawSoft vendor download host) and installs it directly. While download.edrawsoft.com is the legitimate vendor's distribution server (not a personal or unofficial host), the use of sha256sums_x86_64=('SKIP') means there is no integrity verification of the downloaded binary. A prebuilt proprietary binary with no checksum verification represents a real supply-chain concern: if the remote file is replaced or the host is compromised, arbitrary code would be executed on the user's system with no detection. The host itself appears to be the official vendor, which reduces (but does not eliminate) the risk compared to a truly unofficial host. The medium rating is appropriate due to the combination of an executed binary and absent checksum verification.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source_x86_64=("${pkgname}-${pkgver}.deb::https://download.edrawsoft.com/archives/edrawproject_en_full5372.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt .deb binary from download.edrawsoft.com (the official EdrawSoft vendor download host) and installs it directly. While download.edrawsoft.com is the legitimate vendor's distribution server (not a personal or unofficial host), the use of sha256sums_x86_64=('SKIP') means there is no integrity verification of the downloaded binary. A prebuilt proprietary binary with no checksum verification represents a real supply-chain concern: if the remote file is replaced or the host is compromised, arbitrary code would be executed on the user's system with no detection. The host itself appears to be the official vendor, which reduces (but does not eliminate) the risk compared to a truly unofficial host. The medium rating is appropriate due to the combination of an executed binary and absent checksum verification.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: taotieren <admin@taotieren.com>
    
      2# edrawproject global edition
    
      3
    
      4pkgname=edrawproject-en
    
      5_pkgname=EdrawProj-3
    
      6pkgver=3.7.0
    
      7pkgrel=1
    
      8arch=('x86_64')
    
      9options=(!strip)
    
      10provides=("edrawproject")
    
      11conflicts=("edrawproject")
    
      12pkgdesc="EdrawProj - A professional Gantt chart tool to plan, manage and track you projects,process and resourecs. -- Global Edition"
    
      13license=('Commercial')
    
      14url="https://www.edrawsoft.com/edraw-project/"
    
      15source_x86_64=("${pkgname}-${pkgver}.deb::https://download.edrawsoft.com/archives/edrawproject_en_full5372.deb")
    
      16sha256sums_x86_64=('SKIP')
    
      17
    
      18prepare() {
    
      19    #     ar -x *.deb
    
      20    mkdir -pv "$srcdir/$pkgname"
    
      21    tar -xf "$srcdir/data.tar.xz" --xattrs-include='*' --numeric-owner -C "$pkgname"
    
      22}
    
      23package() {
    
      24    #    export LC_CTYPE="zh_CN.UTF-8"
    
      25    cp -r ${srcdir}/${pkgname}/* ${pkgdir}
    
      26
    
      27    install -dm755 "${pkgdir}/usr/bin/" \
    
      28        "${pkgdir}/usr/share/icons/"
    
      29
    
      30    ln -sf "/opt/${_pkgname}/edrawproj.sh" "${pkgdir}/usr/bin/edrawproject"
    
      31    ln -sf "/opt/${_pkgname}/edrawproject.png" "${pkgdir}/usr/share/icons/edrawproject.png"
    
      32
    
      33    rm -rf ${pkgdir}/usr/share/applications/.*
    
      34}
    
      35

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2