eezupnp

maintainer blackhole · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary zip (a Linux GTK executable application) from eezupnp.de, which is the upstream vendor's own website (matching the package URL), and extracts it directly into /opt. The sha256sum for the binary zip is 'SKIP', meaning integrity is not verified. While eezupnp.de appears to be the legitimate upstream vendor site for this UPnP control point application, the combination of: (1) a prebuilt executable from a small personal/vendor host rather than a major forge, (2) no checksum verification on the binary, and (3) direct extraction of the binary into the system constitutes a real supply-chain risk. If the host were compromised or the file replaced, users would execute arbitrary code with no integrity check. This is a genuine medium-severity concern — not a false positive — though there is no evidence of active malice.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("http://www.eezupnp.de/archives/eezupnp-$pkgver.linux.gtk.x86_64.zip" "License.txt" "eezUPnP.desktop")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt binary zip (a Linux GTK executable application) from eezupnp.de, which is the upstream vendor's own website (matching the package URL), and extracts it directly into /opt. The sha256sum for the binary zip is 'SKIP', meaning integrity is not verified. While eezupnp.de appears to be the legitimate upstream vendor site for this UPnP control point application, the combination of: (1) a prebuilt executable from a small personal/vendor host rather than a major forge, (2) no checksum verification on the binary, and (3) direct extraction of the binary into the system constitutes a real supply-chain risk. If the host were compromised or the file replaced, users would execute arbitrary code with no integrity check. This is a genuine medium-severity concern — not a false positive — though there is no evidence of active malice.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: AudioLinux  <audiolinux AT fastmail DOT fm>
    
      2
    
      3pkgname=eezupnp
    
      4pkgver=4.0.0
    
      5pkgrel=1
    
      6pkgdesc="UPnP Audio control point"
    
      7arch=('x86_64')
    
      8url="http://www.eezupnp.de/"
    
      9license=('custom:eezupnp')
    
      10depends=('jre8-openjdk' 'gtk2')
    
      11source=("http://www.eezupnp.de/archives/eezupnp-$pkgver.linux.gtk.x86_64.zip" "License.txt" "eezUPnP.desktop")
    
      12sha256sums=('SKIP' 'fc44b250ee98341818d6c76dd8787f02378c61b2d33970555a1fac8511710fb1' 'SKIP')
    
      13options=(!strip)
    
      14
    
      15package() {
    
      16  cd "$srcdir"
    
      17  mkdir -p ${pkgdir}/opt/
    
      18  bsdtar xf eezupnp-$pkgver.linux.gtk.x86_64.zip -C "$pkgdir/opt"
    
      19  install -Dm644 "eezUPnP.desktop" "$pkgdir/opt/eezUPnP"
    
      20  install -Dm644 "License.txt" \
    
      21  "$pkgdir/usr/share/licenses/$pkgname/COPYING"
    
      22}
    
      23

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2