enlightenment-dr13

maintainer somekool · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged Two concerns here: (1) The main source is from a personal GitHub repo (mathieujobin/enlightenment-13) rather than any official Enlightenment project repository — this is compiled C code executed as a window manager/X session, so supply-chain risk is real. (2) A theme archive is pulled from a personal domain (somekool.net) over plain HTTP with only an MD5 checksum (weak, collision-prone). The compiled binary (e13) is installed as an X session entry point, meaning it runs with full user privileges at login. The maintainer's GitHub handle matches the email domain, suggesting self-hosting, but the code is still unverifiable third-party C compiled and executed. The combination of unofficial C source + personal binary host + weak integrity check (MD5 only, no SHA) + HTTP (no TLS for the theme archive) constitutes a genuine medium supply-chain concern. The cheaper model's assessment is correct: this is MEDIUM, not clean.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("${pkgver}-${pkgrel}.tar.gz"::"https://github.com/mathieujobin/enlightenment-13/archive/refs/tags/${pkgver}-${pkgrel}.tar.gz" "enl-0.13-themes.tar.gz"::"http://www.somekool.net/HTML/smk2k3/stuff/enl-0.13-themes.tar.gz")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): Two concerns here: (1) The main source is from a personal GitHub repo (mathieujobin/enlightenment-13) rather than any official Enlightenment project repository — this is compiled C code executed as a window manager/X session, so supply-chain risk is real. (2) A theme archive is pulled from a personal domain (somekool.net) over plain HTTP with only an MD5 checksum (weak, collision-prone). The compiled binary (e13) is installed as an X session entry point, meaning it runs with full user privileges at login. The maintainer's GitHub handle matches the email domain, suggesting self-hosting, but the code is still unverifiable third-party C compiled and executed. The combination of unofficial C source + personal binary host + weak integrity check (MD5 only, no SHA) + HTTP (no TLS for the theme archive) constitutes a genuine medium supply-chain concern. The cheaper model's assessment is correct: this is MEDIUM, not clean.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: somekool <somekool _ at _ gmail _ dot _com>
    
      2
    
      3pkgname=enlightenment-dr13
    
      4pkgver=v0.13.3
    
      5pkgrel=20230302
    
      6pkgdesc="Enlightenment BETA 0.13.3."
    
      7arch=('i686' 'x86_64')
    
      8url="http://enlightenment.org"
    
      9license=('GPLv2')
    
      10depends=('imlib')
    
      11optdepends=()
    
      12makedepends=('git' 'scons' 'cmake' 'libxext' 'libpng' 'giflib' 'libjpeg')
    
      13source=("${pkgver}-${pkgrel}.tar.gz"::"https://github.com/mathieujobin/enlightenment-13/archive/refs/tags/${pkgver}-${pkgrel}.tar.gz" "enl-0.13-themes.tar.gz"::"http://www.somekool.net/HTML/smk2k3/stuff/enl-0.13-themes.tar.gz")
    
      14md5sums=('91b757e066c61def2f581f188ea1fcf3' '817a338117d52505bb50cfb63a18a96a')
    
      15
    
      16build() {
    
      17  cd ${srcdir}/enlightenment-13-${pkgver:1}-${pkgrel}
    
      18  gcc -w -o e13 *.c -lImlib -lX11 -lXext -ltiff -ljpeg -lgif -lpng
    
      19  echo ======================== build completed ========================
    
      20}
    
      21
    
      22package() {
    
      23  ls ${srcdir}
    
      24  mkdir -p ${pkgdir}/usr/local/enlightenment/bin/
    
      25  mv ${srcdir}/enlightenment-13-${pkgver:1}-${pkgrel}/e13 ${pkgdir}/usr/local/enlightenment/bin/e-13.3
    
      26  mkdir -p ${pkgdir}/usr/local/enlightenment/themes/
    
      27  mv ${srcdir}/enl-0.13-themes/[DE]* ${pkgdir}/usr/local/enlightenment/themes/
    
      28  mkdir -p ${pkgdir}/usr/share/xsessions/
    
      29  cat << EOF > ${pkgdir}/usr/share/xsessions/e13.desktop
    
      30[Desktop Entry]
    
      31Encoding=UTF-8
    
      32Name=Enlightenment DR13.3
    
      33Comment=Enlightenment BETA 0.13.3 (02/15/98)
    
      34Exec=/usr/local/enlightenment/bin/e-13.3
    
      35Icon=e
    
      36Type=Application
    
      37
    
      38EOF
    
      39
    
      40  echo ======================== package completed ========================
    
      41}
    
      42
    
      43

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2