gvst-vst-bin

maintainer Schmetzler · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads compiled VST plugin binaries (.so files) from gvst.uk, which is the official upstream vendor site for the GVST plugin suite. The cookie-fetching mechanism (curl -sc cookies.txt) is a legitimate anti-hotlinking measure used by this vendor, not an obfuscation technique. The binaries are installed into /usr/lib/vst and loaded by DAW applications, so they are effectively executed code. The main concern is: (1) no integrity verification beyond MD5 checksums (weak but present), (2) the cookie fetch at parse time (`_tmp=\`curl...\``) runs during makepkg sourcing which is unusual and slightly risky, and (3) the DLAGENTS override affects all https downloads in the build context. However, gvst.uk is the legitimate official host for these plugins, making this more of a 'sloppy packaging' issue than a genuine supply-chain threat. The binaries are from the official vendor, checksums are provided, and the pattern is consistent with working around a simple download gate. This is borderline medium/low — the executed-binary-from-host concern is real but the host is the official upstream, so the risk is low in practice.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:15 _tmp=`curl -sc cookies.txt https://gvst.uk/Downloads`

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads compiled VST plugin binaries (.so files) from gvst.uk, which is the official upstream vendor site for the GVST plugin suite. The cookie-fetching mechanism (curl -sc cookies.txt) is a legitimate anti-hotlinking measure used by this vendor, not an obfuscation technique. The binaries are installed into /usr/lib/vst and loaded by DAW applications, so they are effectively executed code. The main concern is: (1) no integrity verification beyond MD5 checksums (weak but present), (2) the cookie fetch at parse time (`_tmp=\`curl...\``) runs during makepkg sourcing which is unusual and slightly risky, and (3) the DLAGENTS override affects all https downloads in the build context. However, gvst.uk is the legitimate official host for these plugins, making this more of a 'sloppy packaging' issue than a genuine supply-chain threat. The binaries are from the official vendor, checksums are provided, and the pattern is consistent with working around a simple download gate. This is borderline medium/low — the executed-binary-from-host concern is real but the host is the official upstream, so the risk is low in practice.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Dominik Wetzel <dimonok at web dot de>
    
      2# Contributor: usrmusicman
    
      3pkgname=gvst-vst-bin
    
      4pkgver=20240925
    
      5pkgrel=1
    
      6pkgdesc="GVST Plugin Suite."
    
      7arch=('x86_64' 'i686')
    
      8url="https://gvst.uk"
    
      9license=('custom')
    
      10groups=('pro-audio' 'vst-plugins')
    
      11depends=('glibc' 'libcurl-gnutls')
    
      12replaces=('gvst-vst')
    
      13
    
      14# Needed to get the cookie for the download
    
      15_tmp=`curl -sc cookies.txt https://gvst.uk/Downloads`
    
      16DLAGENTS=("https::/usr/bin/curl -b cookies.txt -L -o %o %u")
    
      17
    
      18_url="${url}/Downloads/Get"
    
      19
    
      20source_x86_64=("${_url}/AllGVSTLinux64.zip")
    
      21source_i686=("${_url}/AllGVSTLinux32.zip")
    
      22
    
      23md5sums_x86_64=("e5ef7eb3eb7bd1d5bda572c5d6afa293")
    
      24md5sums_i686=("4b866fc29297c60fdc9ede09efd3cf2f")
    
      25
    
      26package() {
    
      27	## Install GVST
    
      28	mkdir -p $pkgdir/usr/lib/vst	
    
      29	cp $srcdir/*.so $pkgdir/usr/lib/vst
    
      30	
    
      31	## Install License
    
      32	install -Dm644 "$srcdir/GVSTLicense.txt" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      33}
    
      34

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2