front-panel-designer-eu

MEDIUM

maintainer orphaned 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The PKGBUILD downloads a prebuilt AppImage binary from assets.schaeffer-ag.de, which appears to be the official CDN/asset host for Schaeffer AG (the vendor of Front Panel Designer). The binary is executed during build (--appimage-extract, then repackaged with appimagetool) and installed as a setuid-capable executable. The integrity check is only MD5 (weak, collision-prone), not SHA256 or a cryptographic signature. While assets.schaeffer-ag.de is plausibly the legitimate vendor host (schaeffer-ag.de is the official domain), it is not a well-known package registry, and there is no GPG signature verification. The pattern of downloading and executing a prebuilt binary with only MD5 verification from a corporate asset CDN is a genuine supply-chain concern (medium), not a clear attack. The cheaper model's assessment is correct in classification.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 "https://assets.schaeffer-ag.de/fpd/Version-$pkgver/FrontDesign-EU-$pkgver-amd64.AppImage"

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt AppImage binary from assets.schaeffer-ag.de, which appears to be the official CDN/asset host for Schaeffer AG (the vendor of Front Panel Designer). The binary is executed during build (--appimage-extract, then repackaged with appimagetool) and installed as a setuid-capable executable. The integrity check is only MD5 (weak, collision-prone), not SHA256 or a cryptographic signature. While assets.schaeffer-ag.de is plausibly the legitimate vendor host (schaeffer-ag.de is the official domain), it is not a well-known package registry, and there is no GPG signature verification. The pattern of downloading and executing a prebuilt binary with only MD5 verification from a corporate asset CDN is a genuine supply-chain concern (medium), not a clear attack. The cheaper model's assessment is correct in classification.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Nicolas Goy <kuon@goyman.com>
    
      2
    
      3pkgname=front-panel-designer-eu
    
      4pkgver=6.3.6
    
      5pkgrel=2
    
      6epoch=
    
      7pkgdesc="Free CAD software for front panel design"
    
      8arch=("any")
    
      9url="http://www.schaeffer-ag.de/en/"
    
      10license=('custom')
    
      11groups=()
    
      12depends=(libpng12)
    
      13makedepends=(appimagetool)
    
      14options=(!strip)
    
      15source_x86_64=(
    
      16"https://assets.schaeffer-ag.de/fpd/Version-$pkgver/FrontDesign-EU-$pkgver-amd64.AppImage"
    
      17"front-panel-express-eu.desktop")
    
      18md5sums_x86_64=("95268b130b2fa2b1af0289f639920998" "d34b7ed5d87a206fe8b50fd4a8f8e167")
    
      19noextract=("FrontDesign-EU-$pkgver-amd64.AppImage")
    
      20
    
      21
    
      22prepare() {
    
      23    rm FrontDesign-EU-$pkgver-amd64.AppImage
    
      24    cp -L ../FrontDesign-EU-$pkgver-amd64.AppImage .
    
      25}
    
      26
    
      27build() {
    
      28    chmod a+x FrontDesign-EU-$pkgver-amd64.AppImage
    
      29    rm -rf tmp
    
      30    mkdir tmp
    
      31    cd tmp
    
      32    ../FrontDesign-EU-$pkgver-amd64.AppImage --appimage-extract
    
      33
    
      34    # fix AppImage
    
      35    rm squashfs-root/usr/lib/libgmodule-2.0.so.0
    
      36
    
      37    # save and unset SOURCE_DATE_EPOCH for appimagetool
    
      38    _SOURCE_DATE_EPOCH=$SOURCE_DATE_EPOCH
    
      39    unset SOURCE_DATE_EPOCH
    
      40
    
      41    appimagetool squashfs-root ../FrontDesign-EU-$pkgver-amd64.AppImage
    
      42
    
      43    # restore SOURCE_DATE_EPOCH
    
      44    export SOURCE_DATE_EPOCH=$_SOURCE_DATE_EPOCH
    
      45}
    
      46
    
      47package() {
    
      48  install -Dm 755 \
    
      49       "$srcdir/FrontDesign-EU-$pkgver-amd64.AppImage" \
    
      50       "$pkgdir/opt/FrontDesignEU/FrontDesignEU.AppImage"
    
      51
    
      52  mkdir -p "$pkgdir/usr/bin"
    
      53  ln -s "/opt/FrontDesignEU/FrontDesignEU.AppImage" "$pkgdir/usr/bin/FrontDesignEU"
    
      54
    
      55  install -Dm 644 \
    
      56      "$srcdir/front-panel-express-eu.desktop" \
    
      57      "$pkgdir/usr/share/applications/front-panel-express-eu.desktop"
    
      58}
    
      59

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2