idos-timetable-browser-license-installer-latest

maintainer dreieck · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt Windows executable (IWIN.ZIP containing Setup.exe) from ttakt.chaps.cz, which appears to be the official CHAPS (Czech timetable software vendor) distribution server. The domain chaps.cz is the same vendor referenced in the package URL and license PDF. However, the checksums for both the ZIP and the PDF are set to SKIP, meaning there is no integrity verification. The package then executes Setup.exe via Wine during the build phase. This is a legitimate use case (installing a purchased proprietary license), but the combination of an unverified binary executed via Wine from a vendor-specific subdomain constitutes a real supply-chain concern: if the host is compromised or the file is silently replaced, arbitrary Windows code runs on the user's system. The domain appears to be the official vendor host rather than a personal/unofficial mirror, which reduces but does not eliminate the risk. The SKIP checksums are the primary concern here — the binary is executed without any integrity check. This warrants a medium rating.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:50 "${_target}::https://ttakt.chaps.cz/TTAktual/Win/Zip/${_zipfile}"
PKGBUILD:51 "IDOS-Licence.pdf::https://chaps.cz/files/idos/IDOS-Licence.pdf"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt Windows executable (IWIN.ZIP containing Setup.exe) from ttakt.chaps.cz, which appears to be the official CHAPS (Czech timetable software vendor) distribution server. The domain chaps.cz is the same vendor referenced in the package URL and license PDF. However, the checksums for both the ZIP and the PDF are set to SKIP, meaning there is no integrity verification. The package then executes Setup.exe via Wine during the build phase. This is a legitimate use case (installing a purchased proprietary license), but the combination of an unverified binary executed via Wine from a vendor-specific subdomain constitutes a real supply-chain concern: if the host is compromised or the file is silently replaced, arbitrary Windows code runs on the user's system. The domain appears to be the official vendor host rather than a personal/unofficial mirror, which reduces but does not eliminate the risk. The SKIP checksums are the primary concern here — the binary is executed without any integrity check. This warrants a medium rating.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: dreieck
    
      2
    
      3# PKGBUILD last time manually edited: At least on 2024-12-17.
    
      4
    
      5_year='25'
    
      6_prevyear="$(( ${_year} - 1 ))"
    
      7
    
      8_pkgname=idos-timetable-browser-license-installer
    
      9pkgname="${_pkgname}-latest"
    
      10epoch=2
    
      11_pkgver="20${_prevyear}_20${_year}"
    
      12pkgver="${_pkgver}"
    
      13pkgrel=1
    
      14pkgdesc="If you purchased IDOS for Windows by CHAPS, then this installs the license. You need to enter your ZIP-extraction-code and your setup-code during installation. Runs an interactive GUI software via wine during installation."
    
      15arch=('i686' 'x86_64')
    
      16url="https://www.chaps.cz/eng/order"
    
      17license=('custom')
    
      18
    
      19groups=(
    
      20  "idos-timetable"
    
      21)
    
      22
    
      23depends=(
    
      24  "idos-timetable-browser"
    
      25)
    
      26
    
      27makedepends=(
    
      28  "unzip"
    
      29  "wine"
    
      30)
    
      31
    
      32optdepends=()
    
      33
    
      34provides=(
    
      35  "${_pkgname}=${pkgver}"
    
      36  "idos-timetable-browser-license=${pkgver}"
    
      37)
    
      38
    
      39conflicts=(
    
      40  "${_pkgname}"
    
      41  "idos-timetable-browser-license"
    
      42)
    
      43
    
      44replaces=("${_pkgname}<=${pkgver}")
    
      45
    
      46_zipfile="IWIN.ZIP"
    
      47_target="iwin-${_pkgver}.zip"
    
      48
    
      49source=(
    
      50  "${_target}::https://ttakt.chaps.cz/TTAktual/Win/Zip/${_zipfile}"
    
      51  "IDOS-Licence.pdf::https://chaps.cz/files/idos/IDOS-Licence.pdf"
    
      52  "copying.txt"
    
      53  "installer_settings.inf"
    
      54  "idos-timetable-browser-license.install"
    
      55)
    
      56
    
      57sha256sums=(
    
      58  "SKIP"
    
      59  "SKIP"
    
      60  "6382fff14035c4ec7387e7f0d20d7494e05da3d4c24155090fb39196fa944041"
    
      61  "1cdffacf6b199b9a16bb6fedd9a4e08f7e3f897bebb5d891b27601f400f5dffb"
    
      62  "f692f387815e7980b418e6e6b2c2965d79f7f9dfe0fc962f6ed3bbfe5f99570a"
    
      63)
    
      64
    
      65build() {
    
      66  cd "${srcdir}"
    
      67  
    
      68  WINEPREFIX="${srcdir}/.wine"
    
      69  export WINEPREFIX
    
      70  
    
      71  if locale -a | grep -qE '^cs_CZ'; then
    
      72    if locale -a | grep -qE '^cs_CZ' | grep -qi utf8; then
    
      73      LC_CTYPE="$(locale -a | grep -E '^cs_CZ' | grep -i utf8 | head -n 1)"
    
      74    else
    
      75      LC_CTYPE="$(locale -a | grep -E '^cs_CZ' | tail -n 1)"
    
      76    fi
    
      77    export LC_CTYPE
    
      78  fi
    
      79  
    
      80  _gui_inst="${srcdir}/IDOS"
    
      81  
    
      82  msg ""
    
      83  msg "== Important, please read. =="
    
      84  msg ""
    
      85  msg "Launching installer GUI."
    
      86  msg "Please DO NOT CHANGE INSTALLATION DIRECTORY!"
    
      87  msg ""
    
      88  msg "If you purchased only a local license, not a network license,"
    
      89  msg "please MAKE SURE that the wine-drive we are going to install to"
    
      90  msg "is NOT A NETWORK DRIVE but a LOCAL HARDDISK. If necessary,"
    
      91  msg "abort, run"
    
      92  msg "  WINEPREFIX=${WINEPREFIX} winecfg"
    
      93  msg "to reconfigure, and then resume installation (e.g. with makepkg)"
    
      94  msg "from where you aborted, without deleting and re-creating"
    
      95  msg "${srcdir} and ${WINEPREFIX}."
    
      96  msg ""
    
      97  msg "Also, do not change the other settings during installation. Only" 
    
      98  msg "at the very end, you can uncheck to view the ReadMe.txt."
    
      99  msg ""
    
      100  msg "Note: The GUI performs a full installation into a temporary"
    
      101  msg "directory, but after that only the license file will be"
    
      102  msg "extracted and copied to the proper location where the IDOS"
    
      103  msg "timetable browser should already be installed."
    
      104  msg ""
    
      105  
    
      106  wine "./Setup.exe" /LOADINF="installer_settings.inf" /DIR="${_gui_inst}"
    
      107}
    
      108
    
      109
    
      110package() {
    
      111  _gui_inst="${srcdir}/IDOS"
    
      112  
    
      113  _instdirbase='/opt/idos-timetable'
    
      114  _instdir="${pkgdir}/${_instdirbase}"
    
      115  
    
      116  install -D -m644 "${_gui_inst}/TT.ttk" "${_instdir}/TT.ttk"
    
      117  
    
      118  install -D -m644 "${srcdir}/IDOS-Licence.pdf"            "${pkgdir}/usr/share/licenses/${pkgname}/IDOS-Licence.pdf"
    
      119  install -D -m644 "${srcdir}/copying.txt"            "${pkgdir}/usr/share/licenses/${pkgname}/copying.txt"
    
      120}
    
      121

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2