front-panel-designer-eu

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt AppImage binary from assets.schaeffer-ag.de, which appears to be the official CDN/asset host for Schaeffer AG (the vendor of Front Panel Designer). The binary is executed during build (--appimage-extract, then repackaged with appimagetool) and installed as a setuid-capable executable. The integrity check is only MD5 (weak, collision-prone), not SHA256 or a cryptographic signature. While assets.schaeffer-ag.de is plausibly the legitimate vendor host (schaeffer-ag.de is the official domain), it is not a well-known package registry, and there is no GPG signature verification. The pattern of downloading and executing a prebuilt binary with only MD5 verification from a corporate asset CDN is a genuine supply-chain concern (medium), not a clear attack. The cheaper model's assessment is correct in classification.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 "https://assets.schaeffer-ag.de/fpd/Version-$pkgver/FrontDesign-EU-$pkgver-amd64.AppImage"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt AppImage binary from assets.schaeffer-ag.de, which appears to be the official CDN/asset host for Schaeffer AG (the vendor of Front Panel Designer). The binary is executed during build (--appimage-extract, then repackaged with appimagetool) and installed as a setuid-capable executable. The integrity check is only MD5 (weak, collision-prone), not SHA256 or a cryptographic signature. While assets.schaeffer-ag.de is plausibly the legitimate vendor host (schaeffer-ag.de is the official domain), it is not a well-known package registry, and there is no GPG signature verification. The pattern of downloading and executing a prebuilt binary with only MD5 verification from a corporate asset CDN is a genuine supply-chain concern (medium), not a clear attack. The cheaper model's assessment is correct in classification.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Nicolas Goy <kuon@goyman.com>
    
      2
    
      3pkgname=front-panel-designer-eu
    
      4pkgver=6.3.6
    
      5pkgrel=2
    
      6epoch=
    
      7pkgdesc="Free CAD software for front panel design"
    
      8arch=("any")
    
      9url="http://www.schaeffer-ag.de/en/"
    
      10license=('custom')
    
      11groups=()
    
      12depends=(libpng12)
    
      13makedepends=(appimagetool)
    
      14options=(!strip)
    
      15source_x86_64=(
    
      16"https://assets.schaeffer-ag.de/fpd/Version-$pkgver/FrontDesign-EU-$pkgver-amd64.AppImage"
    
      17"front-panel-express-eu.desktop")
    
      18md5sums_x86_64=("95268b130b2fa2b1af0289f639920998" "d34b7ed5d87a206fe8b50fd4a8f8e167")
    
      19noextract=("FrontDesign-EU-$pkgver-amd64.AppImage")
    
      20
    
      21
    
      22prepare() {
    
      23    rm FrontDesign-EU-$pkgver-amd64.AppImage
    
      24    cp -L ../FrontDesign-EU-$pkgver-amd64.AppImage .
    
      25}
    
      26
    
      27build() {
    
      28    chmod a+x FrontDesign-EU-$pkgver-amd64.AppImage
    
      29    rm -rf tmp
    
      30    mkdir tmp
    
      31    cd tmp
    
      32    ../FrontDesign-EU-$pkgver-amd64.AppImage --appimage-extract
    
      33
    
      34    # fix AppImage
    
      35    rm squashfs-root/usr/lib/libgmodule-2.0.so.0
    
      36
    
      37    # save and unset SOURCE_DATE_EPOCH for appimagetool
    
      38    _SOURCE_DATE_EPOCH=$SOURCE_DATE_EPOCH
    
      39    unset SOURCE_DATE_EPOCH
    
      40
    
      41    appimagetool squashfs-root ../FrontDesign-EU-$pkgver-amd64.AppImage
    
      42
    
      43    # restore SOURCE_DATE_EPOCH
    
      44    export SOURCE_DATE_EPOCH=$_SOURCE_DATE_EPOCH
    
      45}
    
      46
    
      47package() {
    
      48  install -Dm 755 \
    
      49       "$srcdir/FrontDesign-EU-$pkgver-amd64.AppImage" \
    
      50       "$pkgdir/opt/FrontDesignEU/FrontDesignEU.AppImage"
    
      51
    
      52  mkdir -p "$pkgdir/usr/bin"
    
      53  ln -s "/opt/FrontDesignEU/FrontDesignEU.AppImage" "$pkgdir/usr/bin/FrontDesignEU"
    
      54
    
      55  install -Dm 644 \
    
      56      "$srcdir/front-panel-express-eu.desktop" \
    
      57      "$pkgdir/usr/share/applications/front-panel-express-eu.desktop"
    
      58}
    
      59

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2