ida-free

maintainer fatalis · 29 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary installer (.run) from web.archive.org (a Wayback Machine snapshot of the original hex-rays.com host). The original source (out7.hex-rays.com) is the official Hex-Rays distribution server, so the content is legitimate. However, routing through web.archive.org introduces a real supply-chain concern: the Wayback Machine is a third-party intermediary, and while the sha256sum pins the exact archived copy, the integrity guarantee depends on the archive not having been tampered with at capture time or since. The installer is then executed (chmod +x + fakechroot chroot + run) to install IDA Free, which is a closed-source proprietary binary. The use of web.archive.org instead of the direct vendor URL is non-standard and adds an unnecessary intermediary for an executed binary — this is a genuine medium-severity supply-chain concern, not a false positive. The sha256 checksum mitigates but does not eliminate the risk (it only verifies the archived copy matches what was originally captured). The package is not piracy (IDA Free is legitimately free) and appears functional.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("${_installer}::https://web.archive.org/web/20240921184600if_/https://out7.hex-rays.com/files/${_originalname}"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary installer (.run) from web.archive.org (a Wayback Machine snapshot of the original hex-rays.com host). The original source (out7.hex-rays.com) is the official Hex-Rays distribution server, so the content is legitimate. However, routing through web.archive.org introduces a real supply-chain concern: the Wayback Machine is a third-party intermediary, and while the sha256sum pins the exact archived copy, the integrity guarantee depends on the archive not having been tampered with at capture time or since. The installer is then executed (chmod +x + fakechroot chroot + run) to install IDA Free, which is a closed-source proprietary binary. The use of web.archive.org instead of the direct vendor URL is non-standard and adds an unnecessary intermediary for an executed binary — this is a genuine medium-severity supply-chain concern, not a false positive. The sha256 checksum mitigates but does not eliminate the risk (it only verifies the archived copy matches what was originally captured). The package is not piracy (IDA Free is legitimately free) and appears functional.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: fatalis <fatalis@fatalis.pw>
    
      2pkgname=ida-free
    
      3pkgver=8.4.240527
    
      4pkgrel=2
    
      5pkgdesc="Freeware version of the world's smartest and most feature-full disassembler"
    
      6arch=('x86_64')
    
      7url='https://www.hex-rays.com/products/ida/'
    
      8license=('custom')
    
      9makedepends=('fakechroot')
    
      10options=('!strip')
    
      11_originalname='idafree84_linux.run'
    
      12_installer="${_originalname}-${pkgver}-${pkgrel}"
    
      13source=("${_installer}::https://web.archive.org/web/20240921184600if_/https://out7.hex-rays.com/files/${_originalname}"
    
      14        'ida-free.desktop')
    
      15sha256sums=('941f228ce489bf0a14268980edad16140be297e0749245d7839a2a3b02070a62'
    
      16            '55f2ed3f165df6efb5f7975b17d8e53bee1d88cad33efb9d4422402213d17440')
    
      17
    
      18package() {
    
      19    install -d "${pkgdir}"/opt/${pkgname}
    
      20    install -d "${pkgdir}"/usr/bin
    
      21    install -d "${pkgdir}"/usr/share/{icons,applications,licenses/${pkgname}}
    
      22    install -d "${pkgdir}"/tmp
    
      23
    
      24    # chroot is needed to prevent the installer from creating a single file outside of prefix
    
      25    # have to copy the installer due to chroot
    
      26    cp "${srcdir}"/${_installer} "${pkgdir}"/
    
      27    chmod +x "${pkgdir}"/${_installer}
    
      28    fakechroot chroot "${pkgdir}" /${_installer} --mode unattended --prefix /opt/${pkgname} --installpassword ""
    
      29    rm "${pkgdir}"/${_installer}
    
      30    rm "${pkgdir}"/tmp/installbuilder_installer.log
    
      31    rmdir "${pkgdir}"/tmp
    
      32
    
      33    # the installer needlessly makes a lot of files executable
    
      34    find "${pkgdir}"/opt/${pkgname} -type f -exec chmod -x {} \;
    
      35    # make dir permissions consistent with the 7.0 installer
    
      36    find "${pkgdir}"/opt/${pkgname} -type d -exec chmod g-w {} \;
    
      37    chmod +x "${pkgdir}"/opt/${pkgname}/{ida64,assistant}
    
      38
    
      39    rm "${pkgdir}"/opt/${pkgname}/{uninstall*,Uninstall*}
    
      40
    
      41    install "${srcdir}"/ida-free.desktop "${pkgdir}"/usr/share/applications
    
      42    ln -s /opt/${pkgname}/appico64.png "${pkgdir}"/usr/share/icons/ida-free.png
    
      43    ln -s /opt/${pkgname}/license.txt "${pkgdir}"/usr/share/licenses/${pkgname}/LICENSE
    
      44    ln -s /opt/${pkgname}/ida64 "${pkgdir}"/usr/bin/ida64
    
      45}
    
      46

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2