enlightenment-dr13

MEDIUM

maintainer somekool 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

Two concerns here: (1) The main source is from a personal GitHub repo (mathieujobin/enlightenment-13) rather than any official Enlightenment project repository — this is compiled C code executed as a window manager/X session, so supply-chain risk is real. (2) A theme archive is pulled from a personal domain (somekool.net) over plain HTTP with only an MD5 checksum (weak, collision-prone). The compiled binary (e13) is installed as an X session entry point, meaning it runs with full user privileges at login. The maintainer's GitHub handle matches the email domain, suggesting self-hosting, but the code is still unverifiable third-party C compiled and executed. The combination of unofficial C source + personal binary host + weak integrity check (MD5 only, no SHA) + HTTP (no TLS for the theme archive) constitutes a genuine medium supply-chain concern. The cheaper model's assessment is correct: this is MEDIUM, not clean.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("${pkgver}-${pkgrel}.tar.gz"::"https://github.com/mathieujobin/enlightenment-13/archive/refs/tags/${pkgver}-${pkgrel}.tar.gz" "enl-0.13-themes.tar.gz"::"http://www.somekool.net/HTML/smk2k3/stuff/enl-0.13-themes.tar.gz")

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): Two concerns here: (1) The main source is from a personal GitHub repo (mathieujobin/enlightenment-13) rather than any official Enlightenment project repository — this is compiled C code executed as a window manager/X session, so supply-chain risk is real. (2) A theme archive is pulled from a personal domain (somekool.net) over plain HTTP with only an MD5 checksum (weak, collision-prone). The compiled binary (e13) is installed as an X session entry point, meaning it runs with full user privileges at login. The maintainer's GitHub handle matches the email domain, suggesting self-hosting, but the code is still unverifiable third-party C compiled and executed. The combination of unofficial C source + personal binary host + weak integrity check (MD5 only, no SHA) + HTTP (no TLS for the theme archive) constitutes a genuine medium supply-chain concern. The cheaper model's assessment is correct: this is MEDIUM, not clean.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: somekool <somekool _ at _ gmail _ dot _com>
    
      2
    
      3pkgname=enlightenment-dr13
    
      4pkgver=v0.13.3
    
      5pkgrel=20230302
    
      6pkgdesc="Enlightenment BETA 0.13.3."
    
      7arch=('i686' 'x86_64')
    
      8url="http://enlightenment.org"
    
      9license=('GPLv2')
    
      10depends=('imlib')
    
      11optdepends=()
    
      12makedepends=('git' 'scons' 'cmake' 'libxext' 'libpng' 'giflib' 'libjpeg')
    
      13source=("${pkgver}-${pkgrel}.tar.gz"::"https://github.com/mathieujobin/enlightenment-13/archive/refs/tags/${pkgver}-${pkgrel}.tar.gz" "enl-0.13-themes.tar.gz"::"http://www.somekool.net/HTML/smk2k3/stuff/enl-0.13-themes.tar.gz")
    
      14md5sums=('91b757e066c61def2f581f188ea1fcf3' '817a338117d52505bb50cfb63a18a96a')
    
      15
    
      16build() {
    
      17  cd ${srcdir}/enlightenment-13-${pkgver:1}-${pkgrel}
    
      18  gcc -w -o e13 *.c -lImlib -lX11 -lXext -ltiff -ljpeg -lgif -lpng
    
      19  echo ======================== build completed ========================
    
      20}
    
      21
    
      22package() {
    
      23  ls ${srcdir}
    
      24  mkdir -p ${pkgdir}/usr/local/enlightenment/bin/
    
      25  mv ${srcdir}/enlightenment-13-${pkgver:1}-${pkgrel}/e13 ${pkgdir}/usr/local/enlightenment/bin/e-13.3
    
      26  mkdir -p ${pkgdir}/usr/local/enlightenment/themes/
    
      27  mv ${srcdir}/enl-0.13-themes/[DE]* ${pkgdir}/usr/local/enlightenment/themes/
    
      28  mkdir -p ${pkgdir}/usr/share/xsessions/
    
      29  cat << EOF > ${pkgdir}/usr/share/xsessions/e13.desktop
    
      30[Desktop Entry]
    
      31Encoding=UTF-8
    
      32Name=Enlightenment DR13.3
    
      33Comment=Enlightenment BETA 0.13.3 (02/15/98)
    
      34Exec=/usr/local/enlightenment/bin/e-13.3
    
      35Icon=e
    
      36Type=Application
    
      37
    
      38EOF
    
      39
    
      40  echo ======================== package completed ========================
    
      41}
    
      42
    
      43

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2