gourou-bin

maintainer orphaned · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD installs prebuilt binaries (acsmdownloader, adept_activate, adept_remove, adept_loan_mgt) and shared libraries (lib*) downloaded from forge.soutade.fr, which is the upstream developer's own self-hosted Gitea/Forgejo instance rather than a major release platform like GitHub or GitLab. The project (libgourou) is a legitimate, well-known open-source tool for handling Adobe DRM ACSM files, and the host is the canonical upstream source — not a random personal host. However, the binaries are prebuilt and executed directly, and the host is a self-hosted forge with no independent verification mechanism beyond the sha512sums provided in the PKGBUILD. The checksums are present and appear correctly formatted (though one appears to be 127 hex chars rather than 128 — possible truncation in the displayed PKGBUILD, which could indicate a broken checksum). The supply-chain concern is real but modest: the developer controls both the source and the release artifacts on the same host, and the sha512sums pin the content. This is a genuine medium-risk pattern (prebuilt binaries from a non-major host) but not an active attack.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 "https://forge.soutade.fr/api/packages/soutade/generic/${__pkgname}/${pkgver}/libgourou_utils_${pkgver}.tgz"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD installs prebuilt binaries (acsmdownloader, adept_activate, adept_remove, adept_loan_mgt) and shared libraries (lib*) downloaded from forge.soutade.fr, which is the upstream developer's own self-hosted Gitea/Forgejo instance rather than a major release platform like GitHub or GitLab. The project (libgourou) is a legitimate, well-known open-source tool for handling Adobe DRM ACSM files, and the host is the canonical upstream source — not a random personal host. However, the binaries are prebuilt and executed directly, and the host is a self-hosted forge with no independent verification mechanism beyond the sha512sums provided in the PKGBUILD. The checksums are present and appear correctly formatted (though one appears to be 127 hex chars rather than 128 — possible truncation in the displayed PKGBUILD, which could indicate a broken checksum). The supply-chain concern is real but modest: the developer controls both the source and the release artifacts on the same host, and the sha512sums pin the content. This is a genuine medium-risk pattern (prebuilt binaries from a non-major host) but not an active attack.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: VCalV
    
      2_pkgname=gourou
    
      3pkgname="${_pkgname}-bin"
    
      4__pkgname="lib${_pkgname}"
    
      5__commit="469d378f9a097dca5f4a44e2c54192cef39b3a96"
    
      6pkgver=0.8.7
    
      7pkgrel=2
    
      8pkgdesc="Download and decrypt adobe encrypted (acsm) pdf and epub files (binary version)"
    
      9arch=('x86_64')
    
      10license=('LGPL-3.0-only')
    
      11url="https://forge.soutade.fr/soutade/libgourou"
    
      12depends=(glibc gcc-libs zlib libzip openssl)
    
      13makedepends=()
    
      14conflicts=(gourou-git gourou gourou-appimage)
    
      15provides=("gourou=${pkgver}")
    
      16options=(!strip)
    
      17__commit_link="https://forge.soutade.fr/soutade/${__pkgname}/raw/commit/${__commit}/"
    
      18__man_link="${__commit_link}/utils/man/"
    
      19source=(
    
      20	"https://forge.soutade.fr/api/packages/soutade/generic/${__pkgname}/${pkgver}/libgourou_utils_${pkgver}.tgz"
    
      21	"$__man_link/acsmdownloader.1"
    
      22	"$__man_link/adept_activate.1"
    
      23	"$__man_link/adept_loan_mgt.1"
    
      24	"$__man_link/adept_remove.1"
    
      25    "$__commit_link/utils/LICENSE"
    
      26)
    
      27sha512sums=(
    
      28        2227934de3ecfa46d6d46711d144d96d4680f57ebaa096839c480a4ed1e3e2f1be460633b3eda2b58c86485274a5b329d29f68d952bed41d8c2c10516e95b30b
    
      29        9cfaafb8ba99bf42713c9a99fd26d5a5b5f027e2fee1eba4e86f5161e1a8256ef691fbb135bd19b7ff9118eab89fc1a365e5ffc8fe9ef6cf080eec757ddd32b9
    
      30        b3cceb1ac60bedf75628c9cac56e2d246abe9378e58f959352b7ce133fabead3900f6ac3ccfa78f1163a923334ab6f724f77a2007144cd775aa45816a3398a51
    
      31        724e4c11491ca428995e3dfebf439a2a941b28b8cf08f5fa4fad93e3860196c21fe26962201bcc00d8875a970e3d7e321ebdf1b332157bb0fc920124dd12b42c
    
      32        cc99595cffc1f6882bd52525086947aa9356175cf00329b0c98cd9fd102a75595119dde8d2179b9478ce7777a42255f52998c00ad29d8556e3a130b618aa5e9a
    
      33        dd35b1dfd86efd7ea783b0d0c84e457991416ea986610494b32301188f4fd857df6610ae7d94759a1328536f75ff8764a5eb6a08f4965699ff3a8fd166dda725
    
      34)
    
      35
    
      36package() {
    
      37	install -d "$pkgdir"/{usr/bin/,usr/lib/,/usr/share/man/man1/}
    
      38
    
      39	cd "$srcdir"
    
      40
    
      41	install -Dm444 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      42
    
      43	cp --no-preserve=ownership acsm*.1 adept*.1 "$pkgdir"/usr/share/man/man1/
    
      44	gzip -9 "$pkgdir"/usr/share/man/man1/*
    
      45
    
      46	cd "${__pkgname}_utils_${pkgver}"
    
      47
    
      48	cp -a --no-preserve=ownership {acsmdownloader,adept_activate,adept_remove,adept_loan_mgt} "$pkgdir"/usr/bin
    
      49	cp -a --no-preserve=ownership lib* "$pkgdir"/usr/lib
    
      50}
    
      51

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2