flymaster

maintainer cavernico · 0 votes · scanned 2026-08-03 00:08:14.047287

HIGH

Why flagged The PKGBUILD downloads a prebuilt binary installer from dnl.flymaster.net and executes it directly inside the package() function with no sandboxing, no integrity verification beyond a single MD5 sum (trivially collisible), and no installation into $pkgdir — it just runs the binary on the build host. Running an arbitrary installer binary during makepkg is a direct code-execution risk on the user's machine. Additionally, the binary is not versioned in the URL (no version string in the filename), meaning the remote host can silently replace it with any payload at any time while the MD5 remains stale. This is a genuine supply-chain and RCE concern: any compromise of dnl.flymaster.net, or a MITM on plain HTTP (the URL uses HTTPS but the filename has no version pinning), results in arbitrary code execution as the build user. The severity is high because the threat model is active code execution, not merely a data download from an unofficial host.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:9 source=("https://dnl.flymaster.net/FlymasterDesignerInstaller64")

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed it and judged it HIGH (confidence 92%): The PKGBUILD downloads a prebuilt binary installer from dnl.flymaster.net and executes it directly inside the package() function with no sandboxing, no integrity verification beyond a single MD5 sum (trivially collisible), and no installation into $pkgdir — it just runs the binary on the build host. Running an arbitrary installer binary during makepkg is a direct code-execution risk on the user's machine. Additionally, the binary is not versioned in the URL (no version string in the filename), meaning the remote host can silently replace it with any payload at any time while the MD5 remains stale. This is a genuine supply-chain and RCE concern: any compromise of dnl.flymaster.net, or a MITM on plain HTTP (the URL uses HTTPS but the filename has no version pinning), results in arbitrary code execution as the build user. The severity is high because the threat model is active code execution, not merely a data download from an unofficial host.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Your Name <Nicolas>
    
      2pkgname=flymaster
    
      3pkgver=2.02c
    
      4pkgrel=1
    
      5pkgdesc="un programa para disenar contenido flymaster"
    
      6arch=('any')
    
      7url="https://www.flymaster.net/downloads#"
    
      8license=('GPL')
    
      9source=("https://dnl.flymaster.net/FlymasterDesignerInstaller64")
    
      10md5sums=('aac0a258cb987ee6073207765a626170')
    
      11
    
      12prepare() {
    
      13	chmod +x FlymasterDesignerInstaller64
    
      14	
    
      15}
    
      16
    
      17
    
      18
    
      19package() {
    
      20	./FlymasterDesignerInstaller64
    
      21	
    
      22}
    
      23

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 00:11:18	HIGH	2
2026-07-31 00:14:10	HIGH	2
2026-07-30 00:17:23	HIGH	2
2026-07-29 00:25:53	HIGH	2
2026-07-28 00:07:28	HIGH	2
2026-07-27 00:24:32	HIGH	2
2026-07-26 00:07:32	HIGH	2
2026-07-25 00:13:44	HIGH	2
2026-07-24 00:02:28	HIGH	2
2026-07-23 00:14:47	HIGH	2
2026-07-22 00:29:32	HIGH	2
2026-07-21 00:24:15	HIGH	2
2026-07-20 00:19:49	HIGH	2
2026-07-19 00:17:08	HIGH	2
2026-07-18 00:14:48	HIGH	2
2026-07-17 00:06:16	HIGH	2
2026-07-16 00:05:41	HIGH	2
2026-07-15 00:09:25	HIGH	2