fortify

maintainer esteve · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary archive (containing Fortify.x86, a compiled x86 executable, and Fortify_Data) from a personal Dropbox link and installs it as an executable. This is a genuine supply-chain concern: Dropbox is not an official vendor distribution channel, the link can be silently replaced at any time by whoever controls that Dropbox account, and there is no way to verify the binary's provenance beyond the sha256sum (which only guards against accidental corruption, not intentional substitution if the file is swapped). The binary is a Mono/.NET application run directly on the user's system. The sha256sum provides a snapshot integrity check but not authenticity. This is a textbook medium-severity AUR concern: an executed binary from an unofficial/personal host.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:9 source=('https://www.dropbox.com/s/l552wcn9iu3nyqm/Fortify1_54linux.zip?dl=1')

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 80%): The PKGBUILD downloads a prebuilt binary archive (containing Fortify.x86, a compiled x86 executable, and Fortify_Data) from a personal Dropbox link and installs it as an executable. This is a genuine supply-chain concern: Dropbox is not an official vendor distribution channel, the link can be silently replaced at any time by whoever controls that Dropbox account, and there is no way to verify the binary's provenance beyond the sha256sum (which only guards against accidental corruption, not intentional substitution if the file is swapped). The binary is a Mono/.NET application run directly on the user's system. The sha256sum provides a snapshot integrity check but not authenticity. This is a textbook medium-severity AUR concern: an executed binary from an unofficial/personal host.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=fortify
    
      2pkgdesc='Fortify Rust Builder is a 3D base design tool for the game Rust (http://playrust.com)'
    
      3pkgver=1.5.4
    
      4pkgrel=1
    
      5arch=('any')
    
      6url='https://rustwiki.info/39/fortify-rust-builder-download/'
    
      7license=('custom')
    
      8depends=('mono')
    
      9source=('https://www.dropbox.com/s/l552wcn9iu3nyqm/Fortify1_54linux.zip?dl=1')
    
      10sha256sums=('f195dac64416688901c5c22d0cca9f60734a11f7ac2d4277731443351c985c41')
    
      11
    
      12package() {
    
      13    fortifySDest="/opt/fortify"
    
      14    fortifyDest="${pkgdir}${fortifySDest}"
    
      15    install -m 0755 -d "$fortifyDest"
    
      16    cp -r "${srcdir}/Fortify_Data" "${srcdir}/Fortify.x86" "$fortifyDest"
    
      17    chmod +x "${fortifyDest}/Fortify.x86"
    
      18
    
      19    # Include symlink in system bin directory
    
      20    install -m 0755 -d "${pkgdir}/usr/bin"
    
      21    echo "!/bin/sh" > "${pkgdir}/usr/bin/fortify"
    
      22    echo "$fortifySDest/Fortify.x86" >> "${pkgdir}/usr/bin/fortify"
    
      23    chmod +x "${pkgdir}/usr/bin/fortify"
    
      24}
    
      25

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2