idrive-bin

maintainer andybarilla · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt shell self-extracting binary installer from idrivedownloads.com (the official IDrive download host, consistent with their Linux backup product) with sha256sums=('SKIP') and no version pinning. The installer is then executed/unpacked and its embedded binaries (idrive, idevsutil engines, bundled Python) are installed and run as root on the target system. While idrivedownloads.com appears to be IDrive's legitimate download infrastructure, the combination of: (1) no checksum verification, (2) an unversioned 'latest' URL that could silently change, and (3) execution of prebuilt proprietary binaries with root privileges constitutes a genuine supply-chain risk. If the upstream host were compromised or the URL silently redirected, arbitrary code would execute as root with no integrity check. This is a real medium-severity concern, not a false positive, though there is no evidence of actual malice.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 source=("idriveforlinux.bin::https://www.idrivedownloads.com/downloads/linux/download-for-linux/linux-bin/idriveforlinux.bin")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt shell self-extracting binary installer from idrivedownloads.com (the official IDrive download host, consistent with their Linux backup product) with sha256sums=('SKIP') and no version pinning. The installer is then executed/unpacked and its embedded binaries (idrive, idevsutil engines, bundled Python) are installed and run as root on the target system. While idrivedownloads.com appears to be IDrive's legitimate download infrastructure, the combination of: (1) no checksum verification, (2) an unversioned 'latest' URL that could silently change, and (3) execution of prebuilt proprietary binaries with root privileges constitutes a genuine supply-chain risk. If the upstream host were compromised or the URL silently redirected, arbitrary code would execute as root with no integrity check. This is a real medium-severity concern, not a false positive, though there is no evidence of actual malice.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Andy <this.is.apb@gmail.com>
    
      2pkgname=idrive-bin
    
      3pkgver=3.12.0
    
      4pkgrel=2
    
      5pkgdesc="IDrive cloud backup for Linux - official interactive menu (idrive) and idevsutil engines"
    
      6arch=('x86_64')
    
      7url="https://www.idrive.com/online-backup-linux-scripts"
    
      8license=('LicenseRef-IDrive')
    
      9# popt: required by the idevsutil/idevsutil_dedup transfer engines (not part of
    
      10# base). curl/cronie/which: used by idrive at runtime for transfers and scheduling.
    
      11depends=('popt' 'curl' 'cronie' 'which')
    
      12provides=('idrive')
    
      13conflicts=('idrive')
    
      14# Vendored prebuilt binaries: don't strip/relink, and skip the static-lib check.
    
      15options=('!strip' '!emptydirs' 'staticlibs')
    
      16install="$pkgname.install"
    
      17# Upstream serves a single, unversioned "latest" installer, so the checksum
    
      18# cannot be pinned; pkgver() below reads the real version out of it after download.
    
      19source=("idriveforlinux.bin::https://www.idrivedownloads.com/downloads/linux/download-for-linux/linux-bin/idriveforlinux.bin")
    
      20sha256sums=('SKIP')
    
      21
    
      22pkgver() {
    
      23	grep -m1 -aoP '^APPVERSION="\K[^"]+' "$srcdir/idriveforlinux.bin"
    
      24}
    
      25
    
      26package() {
    
      27	cd "$srcdir"
    
      28
    
      29	# The .bin is a shell self-extractor with a gzipped tar appended after a
    
      30	# line matching __idrive__; unpack that payload into /opt (DESTPARENT).
    
      31	local marker
    
      32	marker=$(awk '/^__idrive__/ {print NR + 1; exit}' idriveforlinux.bin)
    
      33	# --no-same-owner: ignore the uids baked into the vendor tar so everything
    
      34	# ends up root-owned under fakeroot.
    
      35	install -d "$pkgdir/opt"
    
      36	tail -n +"$marker" idriveforlinux.bin | tar xz --no-same-owner -C "$pkgdir/opt"
    
      37
    
      38	local dest="$pkgdir/opt/IDriveForLinux"
    
      39	local deps="$dest/bin/Idrivelib/dependencies"
    
      40
    
      41	# Place the main menu binary for this architecture (k3 = modern kernels),
    
      42	# mirroring what the upstream installer does, then drop the other arches.
    
      43	tar xzf "$deps/linuxbin/k3/$CARCH/idrive.tar.gz" --no-same-owner -C "$dest/bin/"
    
      44	chmod 0755 "$dest/bin/idrive"
    
      45	rm -rf "$deps/linuxbin"
    
      46
    
      47	# Keep only the generic Linux transfer engines; the NAS-appliance variants
    
      48	# (QNAP/Synology/Netgear/Vault) are useless on a desktop/server install.
    
      49	find "$deps/evsbin" -type f -name '*.tar.gz' ! -name 'IDrive_linux_*' -delete
    
      50
    
      51	# Bundled python is per-arch; keep only this architecture's copy.
    
      52	find "$deps/pythonbin" -mindepth 1 -maxdepth 1 ! -name k3 -exec rm -rf {} +
    
      53	find "$deps/pythonbin/k3" -mindepth 1 -maxdepth 1 ! -name "$CARCH" -exec rm -rf {} +
    
      54
    
      55	# CLI entry point. idrive keeps its state under /opt and schedules root cron
    
      56	# jobs, so it must run as root; the wrapper escalates via sudo when needed.
    
      57	# It also enters the app's bin dir first, since idrive resolves some paths
    
      58	# relative to the working directory.
    
      59	install -d "$pkgdir/usr/bin"
    
      60	cat > "$pkgdir/usr/bin/idrive" <<-'EOF'
    
      61		#!/bin/sh
    
      62		if [ "$(id -u)" -ne 0 ]; then
    
      63			if command -v sudo >/dev/null 2>&1; then
    
      64				exec sudo -- "$0" "$@"
    
      65			fi
    
      66			echo "idrive must be run as root; re-run with: sudo idrive" >&2
    
      67			exit 1
    
      68		fi
    
      69		cd /opt/IDriveForLinux/bin && exec ./idrive "$@"
    
      70	EOF
    
      71	chmod 0755 "$pkgdir/usr/bin/idrive"
    
      72
    
      73	# Proprietary license: ship a pointer to the canonical Terms of Service plus
    
      74	# the bundled readme. The full terms are not redistributed as text.
    
      75	install -d "$pkgdir/usr/share/licenses/$pkgname"
    
      76	cat > "$pkgdir/usr/share/licenses/$pkgname/LICENSE" <<-'EOF'
    
      77		IDrive for Linux is proprietary software, Copyright IDrive Inc.
    
      78
    
      79		Use is governed by the IDrive Terms of Service:
    
      80		    https://www.idrive.com/terms-and-conditions
    
      81
    
      82		This package redistributes the unmodified official installer payload
    
      83		from https://www.idrive.com/online-backup-linux-scripts for convenience.
    
      84	EOF
    
      85	install -m644 "$dest/bin/readme.txt" \
    
      86		"$pkgdir/usr/share/licenses/$pkgname/readme.txt"
    
      87}
    
      88

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2