exact-audio-copy

maintainer HMK · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged Two concerns: (1) The main EAC installer is downloaded from the official vendor domain (exactaudiocopy.de), which is legitimate. The sha512sum is present and pins the file, mitigating supply-chain risk for that component. (2) However, a cygwin1.dll is fetched at build time from web.archive.org (a Wayback Machine snapshot of a cygwin.com snapshot) using curl without any integrity check — no checksum, no verification. This DLL is then placed into the CDRDAO directory and ultimately installed into /opt/exact-audio-copy. A DLL executed under Wine from an unverified source with no integrity check is a genuine supply-chain concern: if the archive.org snapshot URL is ever altered or the snapshot tampered with, a malicious DLL could be silently substituted. This is a real medium-severity issue: an executed binary (Windows DLL run via Wine) pulled from a non-primary host with no integrity verification.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:8 source=('eac.exe::https://www.exactaudiocopy.de/eac-1.8.exe')

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): Two concerns: (1) The main EAC installer is downloaded from the official vendor domain (exactaudiocopy.de), which is legitimate. The sha512sum is present and pins the file, mitigating supply-chain risk for that component. (2) However, a cygwin1.dll is fetched at build time from web.archive.org (a Wayback Machine snapshot of a cygwin.com snapshot) using curl without any integrity check — no checksum, no verification. This DLL is then placed into the CDRDAO directory and ultimately installed into /opt/exact-audio-copy. A DLL executed under Wine from an unverified source with no integrity check is a genuine supply-chain concern: if the archive.org snapshot URL is ever altered or the snapshot tampered with, a malicious DLL could be silently substituted. This is a real medium-severity issue: an executed binary (Windows DLL run via Wine) pulled from a non-primary host with no integrity verification.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Herbert Knapp Name <herbert.knapp edu.uni-graz.at>
    
      2pkgname=exact-audio-copy
    
      3pkgver=1.8
    
      4pkgrel=3
    
      5pkgdesc='A precise CD audio grabber for creating perfect quality rips using CD and DVD drives'
    
      6arch=('any')
    
      7url='https://www.exactaudiocopy.de/en/'
    
      8source=('eac.exe::https://www.exactaudiocopy.de/eac-1.8.exe')
    
      9sha512sums=('89822966d57f5f89d40cb8b4bf5c1e1e169983d5b4dfdfa4559dd2b69a49dc6234e3e336452ec9220530e5ed228f656a58c346950cd2ce84d8edc200e38bad4b')
    
      10license=('unknown')
    
      11depends=('wine')
    
      12makedepends=('imagemagick' 'p7zip')
    
      13
    
      14prepare() {
    
      15  _tmp=$(mktemp -d)
    
      16  cd ${_tmp}
    
      17  mkdir eac "$srcdir/eac/"
    
      18  cd eac
    
      19  7z x -aoa "$srcdir/eac.exe"
    
      20  chmod -R 755 .
    
      21  CYG_LATEST='https://web.archive.org/web/20240925225100if_/https://cygwin.com/snapshots/x86/cygwin1-20220301.dll.xz'
    
      22  curl -s ${CYG_LATEST} > cygwin1.dll.xz
    
      23  xz --decompress cygwin1.dll.xz
    
      24  mv cygwin1.dll CDRDAO/
    
      25  cp -r * "$srcdir/eac/"
    
      26  7z x EAC.exe
    
      27  convert .rsrc/1033/ICON/29.ico -thumbnail 128x128 -alpha on -background none -flatten "$srcdir/eac/eac.ico.128.png"
    
      28  rm -r ${_tmp}
    
      29}
    
      30
    
      31package() {
    
      32  mkdir -p "$pkgdir/usr/bin" "$pkgdir/usr/share/applications" "$pkgdir/opt"
    
      33  mv "$srcdir/eac" "$pkgdir/opt/exact-audio-copy"
    
      34
    
      35  _launcher="$pkgdir/usr/bin/eac"
    
      36  {
    
      37    echo '#!/bin/sh'
    
      38    echo 'mkdir -p ~/.exact-audio-copy'
    
      39    echo '[[ -d ~/.exact-audio-copy/eac ]] || cp -r /opt/exact-audio-copy ~/.exact-audio-copy/eac'
    
      40    echo 'cd ~/.exact-audio-copy/eac'
    
      41    echo 'if [[ ! -f ~/.exact-audio-copy/dotnet48_installed ]]; then date > ~/.exact-audio-copy/dotnet48_installed && WINEDLLOVERRIDES="mscoree=" WINEDEBUG=-all WINEPREFIX=~/.exact-audio-copy winetricks -q dotnet48 & fi'
    
      42    echo 'WINEDLLOVERRIDES="mscoree=" WINEDEBUG=-all WINEPREFIX=~/.exact-audio-copy wine EAC.exe; wait'
    
      43  } > "${_launcher}"
    
      44  chmod +x "${_launcher}"
    
      45  ln -s "/usr/bin/eac" "$pkgdir/usr/bin/exact-audio-copy"
    
      46  
    
      47  _desktop="${pkgdir}/usr/share/applications/eac.desktop"
    
      48  {
    
      49    echo '[Desktop Entry]'
    
      50    echo 'Type=Application'
    
      51    echo "Name=Exact Audio Copy ${pkgver}"
    
      52    echo "Comment=${pkgdesc}"
    
      53    echo 'Path=/opt/exact-audio-copy'
    
      54    echo 'Exec=/usr/bin/eac'
    
      55    echo 'Icon=/opt/exact-audio-copy/eac.ico.128.png'
    
      56    echo 'Terminal=false'
    
      57    echo 'Categories=AudioVideo;Audio;'
    
      58  } > ${_desktop}
    
      59}
    
      60
    
      61

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2