filebot47

maintainer carolinedroz · 14 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The primary source (FileBot_4.7.9-portable.tar.xz) is downloaded from a personal Backblaze B2 bucket (f002.backblazeb2.com/file/AUR-Store/) rather than the official FileBot SourceForge or project release host. This is a non-official, maintainer-controlled storage bucket. The tarball contains FileBot.jar which is directly installed and executed as a Java application — this is executed code, not mere data. While md5sums are present, MD5 is cryptographically weak and the hash itself is provided by the same maintainer who controls the B2 bucket, offering no independent verification. The JNA source comes from the official GitHub (java-native-access/jna), which is fine. The concern is specifically the FileBot jar from an unofficial personal host: if the B2 bucket is compromised or the maintainer substitutes the file, users would execute arbitrary Java code. This is a genuine supply-chain risk for executed code from a non-official host, consistent with a MEDIUM rating.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:27 source=(https://f002.backblazeb2.com/file/AUR-Store/$pkgname/FileBot_$pkgver-portable.tar.xz

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The primary source (FileBot_4.7.9-portable.tar.xz) is downloaded from a personal Backblaze B2 bucket (f002.backblazeb2.com/file/AUR-Store/) rather than the official FileBot SourceForge or project release host. This is a non-official, maintainer-controlled storage bucket. The tarball contains FileBot.jar which is directly installed and executed as a Java application — this is executed code, not mere data. While md5sums are present, MD5 is cryptographically weak and the hash itself is provided by the same maintainer who controls the B2 bucket, offering no independent verification. The JNA source comes from the official GitHub (java-native-access/jna), which is fine. The concern is specifically the FileBot jar from an unofficial personal host: if the B2 bucket is compromised or the maintainer substitutes the file, users would execute arbitrary Java code. This is a genuine supply-chain risk for executed code from a non-official host, consistent with a MEDIUM rating.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Roman Vasilev <2rvasilev@live.ru>
    
      2# Maintainer: max.bra <max dot bra at alice dot it>
    
      3# Contributor: said
    
      4# Contributor:  Kaurin <milos dot kaurin at gmail>
    
      5# Contributor: Nathan Owe <ndowens04 at gmail>
    
      6
    
      7pkgname=filebot47
    
      8pkgver=4.7.9
    
      9pkgrel=4
    
      10_jnaver=4.3.0
    
      11pkgdesc="[Newer but paid version exist] The ultimate tool to rename TV/anime shows, download subtitles, and validate checksums."
    
      12arch=('i686' 'x86_64' 'arm' 'armv6h' 'armv7h')
    
      13url="http://filebot.sourceforge.net/"
    
      14license=('GPL')
    
      15install=$pkgname.install
    
      16depends=('java8-openjfx' 'jre8-openjdk' 'fontconfig' 'chromaprint')
    
      17makedepends=('unzip')
    
      18provides=('filebot')
    
      19conflicts=('filebot' 'filebot-git')
    
      20
    
      21[[ $CARCH == "i686" ]]   && _intarch=x86
    
      22[[ $CARCH == "x86_64" ]] && _intarch=x86-64
    
      23[[ $CARCH == "arm" ]]    && _intarch=arm
    
      24[[ $CARCH == "armv6h" ]] && _intarch=arm
    
      25[[ $CARCH == "armv7h" ]] && _intarch=arm
    
      26
    
      27source=(https://f002.backblazeb2.com/file/AUR-Store/$pkgname/FileBot_$pkgver-portable.tar.xz
    
      28        https://github.com/java-native-access/jna/archive/$_jnaver.tar.gz
    
      29        filebot-arch.sh filebot.svg filebot.desktop)
    
      30
    
      31md5sums=('961dbdb7d6c62c133952df2f9f427d96'
    
      32         '2de8ba99fc91809935e6c2ab02f49a82'
    
      33         '8bc100f98f3dffba33f8e0a37245fcba'
    
      34         '04f46be047049448dba3f0de29fe192d'
    
      35         'f37edd0bba7570904d28ab1681c7a7f3')
    
      36
    
      37optdepends=('libzen: Support for additional subtitle search engines (Sublight)'
    
      38	    'libmediainfo: Episode naming / Sublight usage'
    
      39	    'java-p7zip-binding: Extract archives'
    
      40	    'gvfs: gvfs backends')
    
      41
    
      42#noextract=($(for i in ${source[@]}; do basename $i; done))
    
      43
    
      44build() {
    
      45  /bin/true
    
      46}
    
      47
    
      48prepare() {
    
      49  cd jna-$_jnaver/lib/native/
    
      50  unzip linux-$_intarch.jar 2>&1 >/dev/null
    
      51}
    
      52
    
      53package() {
    
      54  install -Dm644 FileBot.jar "$pkgdir/usr/share/java/filebot/filebot.jar"
    
      55  install -Dm644 jna-$_jnaver/lib/native/libjnidispatch.so "$pkgdir/usr/share/java/filebot/libjnidispatch.so"
    
      56  install -Dm755 filebot-arch.sh "$pkgdir/usr/bin/filebot"
    
      57  install -Dm644 filebot.svg "$pkgdir/usr/share/pixmaps/filebot.svg"
    
      58  install -Dm644 filebot.desktop "$pkgdir/usr/share/applications/filebot.desktop"
    
      59}
    
      60

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2