hub-young

maintainer max.bra · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a ZIP from bce.mondadorieducation.it (Mondadori Education's CDN/backend), extracts a Debian package from it, and installs a prebuilt binary (hub-young-prod) directly into the system. Mondadori Education is a well-known Italian educational publisher and this appears to be their official distribution channel for the HUB Young app (the URL matches the official download page at hubscuola.it). However, the host is not a standard, well-known release platform (like GitHub releases), and the package installs an opaque prebuilt binary with no source verification beyond a single sha256sum. The sha256sum provides integrity protection against accidental corruption but not against a compromised upstream host silently replacing the binary. This is a legitimate medium-risk supply-chain concern: a prebuilt binary from a vendor-controlled but non-standard host, with no reproducibility or source build. It is not clearly malicious, but the risk is real if the CDN is compromised.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 source=(https://bce.mondadorieducation.it/media_educar/contenuti/appdilettura/younglinux.zip)

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a ZIP from bce.mondadorieducation.it (Mondadori Education's CDN/backend), extracts a Debian package from it, and installs a prebuilt binary (hub-young-prod) directly into the system. Mondadori Education is a well-known Italian educational publisher and this appears to be their official distribution channel for the HUB Young app (the URL matches the official download page at hubscuola.it). However, the host is not a standard, well-known release platform (like GitHub releases), and the package installs an opaque prebuilt binary with no source verification beyond a single sha256sum. The sha256sum provides integrity protection against accidental corruption but not against a compromised upstream host silently replacing the binary. This is a legitimate medium-risk supply-chain concern: a prebuilt binary from a vendor-controlled but non-standard host, with no reproducibility or source build. It is not clearly malicious, but the risk is real if the CDN is compromised.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: max.bra <max dot bra at alice dot it>
    
      2
    
      3pkgname=hub-young
    
      4pkgver=7.2.385
    
      5pkgrel=1
    
      6pkgdesc="La piattaforma facile, gratuita e innovativa per la didattica digitale."
    
      7arch=('x86_64')
    
      8url="https://www.hubscuola.it/download-app"
    
      9license=('unknown')
    
      10depends=('sdl2' 'unzip')
    
      11optdepends=(
    
      12'chromium: a modern browser for the application to work'
    
      13'firefox: a modern browser for the application to work'
    
      14'google-chrome: a modern browser for the application to work'
    
      15'evince: a pdf viewer'
    
      16'epdfview: a pdf viewer'
    
      17'qpdfview: a pdf viewer'
    
      18'mupdf: a pdf viewer'
    
      19)
    
      20options=(!strip)
    
      21
    
      22_debname=HUB-Young.deb
    
      23
    
      24source=(https://bce.mondadorieducation.it/media_educar/contenuti/appdilettura/younglinux.zip)
    
      25sha256sums=('1b5163fa7b6e54b36368b78658d3821b040632cc0b469ed4bd379cf0b3ac0e54')
    
      26
    
      27prepare() {
    
      28  cd "$srcdir"
    
      29  msg2 "Decompressing Debian package..."
    
      30  ar xv "${_debname}" > /dev/null
    
      31  tar -xf data.tar.zst > /dev/null
    
      32
    
      33  #find ./{etc,usr} -type d -exec chmod 755 '{}' \;
    
      34  find ./usr -type d -exec chmod 755 '{}' \;
    
      35  chmod 755 ./usr/local/bin/hubyoung/hub-young-prod
    
      36}
    
      37
    
      38package() {
    
      39  cd "$srcdir"
    
      40  #cp -dpr --no-preserve=ownership {opt,usr} "$pkgdir"
    
      41  cp -dpr --no-preserve=ownership ./usr "$pkgdir"
    
      42}
    
      43

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2