flooxs

maintainer weingo2 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary tarball (flooxs-2024.0.0-Linux.tar.gz) directly from flooxs.org and installs the binary `bin/flooxs` into /usr/bin without any build step. The source is the official project website (flooxs.org is the canonical URL listed in the `url=` field, matching the download host), and a fixed sha256 checksum is provided. However, the core concern remains: a prebuilt, opaque binary is being fetched from a relatively obscure academic/research project host and installed as an executable. There is no source build, no reproducibility, and no independent verification beyond the checksum. If flooxs.org were compromised or the tarball replaced (with the same checksum being updated in the PKGBUILD), users would execute arbitrary code. This is a classic medium-severity supply-chain pattern — not clearly malicious, but an executed binary from a non-major, non-ecosystem-standard host with no source build available.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("${pkgname}-${pkgver}-Linux.tar.gz::http://flooxs.org/packages/${pkgname}-${pkgver}-Linux.tar.gz")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt binary tarball (flooxs-2024.0.0-Linux.tar.gz) directly from flooxs.org and installs the binary `bin/flooxs` into /usr/bin without any build step. The source is the official project website (flooxs.org is the canonical URL listed in the `url=` field, matching the download host), and a fixed sha256 checksum is provided. However, the core concern remains: a prebuilt, opaque binary is being fetched from a relatively obscure academic/research project host and installed as an executable. There is no source build, no reproducibility, and no independent verification beyond the checksum. If flooxs.org were compromised or the tarball replaced (with the same checksum being updated in the PKGBUILD), users would execute arbitrary code. This is a classic medium-severity supply-chain pattern — not clearly malicious, but an executed binary from a non-major, non-ecosystem-standard host with no source build available.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Thomas Weingartner <tom@weingoworks.com>
    
      2pkgname=flooxs
    
      3pkgver=2024.0.0
    
      4pkgrel=1
    
      5pkgdesc="FLorida Object-Oriented Process/Device Simulator"
    
      6arch=('x86_64')
    
      7url="https://flooxs.org/"
    
      8options=(!lto)
    
      9license=('Special')
    
      10depends=(
    
      11  'plplot'
    
      12  'suitesparse'
    
      13)
    
      14source=("${pkgname}-${pkgver}-Linux.tar.gz::http://flooxs.org/packages/${pkgname}-${pkgver}-Linux.tar.gz")
    
      15sha256sums=('e6f4329f6b5826d01e3093fcf5cf576d130d6ca54db8e4b658bd0dd94efd6e68')
    
      16
    
      17# build() {
    
      18#   export GOPATH="$srcdir"/gopath
    
      19#   export CGO_CPPFLAGS="${CPPFLAGS}"
    
      20#   export CGO_CFLAGS="${CFLAGS}"
    
      21#   export CGO_CXXFLAGS="${CXXFLAGS}"
    
      22#   export CGO_LDFLAGS="${LDFLAGS}"
    
      23#   export CGO_ENABLED=1
    
      24# 
    
      25#   cd "$srcdir/$pkgname-$pkgver"
    
      26#   make VERSION=$pkgver DESTDIR="$pkgdir" PREFIX="/usr" build
    
      27# }
    
      28
    
      29package() {
    
      30  cd "$srcdir/$pkgname-$pkgver-Linux"
    
      31  install -d $pkgdir/usr/bin
    
      32  install bin/flooxs $pkgdir/usr/bin
    
      33  for i in $(find share -type f)
    
      34  do
    
      35          install -d $pkgdir/usr/$(dirname $i)
    
      36          install -m 644 $i $pkgdir/usr/$(dirname $i)
    
      37  done
    
      38  # cp $startdir/install.sh .
    
      39  # ./install.sh
    
      40}
    
      41

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2