glade2script-python3

maintainer FraV1982 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt Debian .deb from a Linux Mint mirror (ftp5.gwdg.de), which is a known public mirror but not the official upstream source. More critically, all checksums are set to 'SKIP', meaning there is zero integrity verification of the downloaded binary package. The .deb is then extracted and its contents (Python scripts and configuration files) are installed directly. While ftp5.gwdg.de is a legitimate mirror site and the package appears to be pure Python (architecture-independent 'all' .deb), the combination of: (1) sourcing from a third-party mirror rather than the upstream project, (2) completely skipped checksum verification, and (3) installing executed code (Python scripts) constitutes a real supply-chain concern. Any compromise or silent substitution of the file on that mirror would go undetected. This is a genuine medium-severity concern rather than a false positive.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=(https://ftp5.gwdg.de/pub/linux/debian/mint/packages/pool/import/g/glade2script/glade2script-python3_3.2.4~ppa23_all.deb)

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt Debian .deb from a Linux Mint mirror (ftp5.gwdg.de), which is a known public mirror but not the official upstream source. More critically, all checksums are set to 'SKIP', meaning there is zero integrity verification of the downloaded binary package. The .deb is then extracted and its contents (Python scripts and configuration files) are installed directly. While ftp5.gwdg.de is a legitimate mirror site and the package appears to be pure Python (architecture-independent 'all' .deb), the combination of: (1) sourcing from a third-party mirror rather than the upstream project, (2) completely skipped checksum verification, and (3) installing executed code (Python scripts) constitutes a real supply-chain concern. Any compromise or silent substitution of the file on that mirror would go undetected. This is a genuine medium-severity concern rather than a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: FraV1982 <consulenza dot vangi at outlook dot com>
    
      2
    
      3pkgname=glade2script-python3
    
      4pkgver=3.2.4~ppa23
    
      5pkgrel=1
    
      6pkgdesc="Glade interface engine for scripts (Python3 version)"
    
      7arch=(x86_64 aarch64 armv6h armv7h i686)
    
      8url=""
    
      9license=('custom')
    
      10depends=('python')
    
      11options=("!emptydirs" "!strip")
    
      12
    
      13_debname=glade2script-python3_3.2.4~ppa23_all.deb
    
      14
    
      15source=(https://ftp5.gwdg.de/pub/linux/debian/mint/packages/pool/import/g/glade2script/glade2script-python3_3.2.4~ppa23_all.deb)
    
      16md5sums=('SKIP')
    
      17sha256sums=('SKIP')
    
      18sha512sums=('SKIP')
    
      19
    
      20prepare() {
    
      21    cd "$srcdir"
    
      22    msg2 "Decompressing Debian package glade2script-python3..."
    
      23    ar xv "${_debname}" > /dev/null
    
      24    tar -xf data.tar.xz > /dev/null
    
      25
    
      26    find ./etc -type d -exec chmod 755 '{}' \;
    
      27    find ./usr -type d -exec chmod 755 '{}' \;
    
      28}
    
      29
    
      30package() {
    
      31    cd "$srcdir"
    
      32    cp -dpr --no-preserve=ownership {etc,usr} "$pkgdir"
    
      33}
    
      34

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2