jps2rin

maintainer yinflying · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt x86_64 binary from download.javad.com (the official JAVAD GNSS vendor download server, which is a legitimate company making GNSS receivers and software). The binary is installed directly as an executable. While download.javad.com appears to be the official vendor distribution host for JAVAD software (javad.com is the company's main site), it is still a prebuilt binary from a vendor host with only an MD5 checksum for integrity verification. MD5 is cryptographically weak and insufficient to prevent targeted substitution. There is no GPG signature verification. The binary depends on glibc and is executed directly, so any compromise of the download host or MITM would result in arbitrary code execution. This is a genuine medium-severity supply-chain concern: a prebuilt binary from a vendor host with weak integrity checking, not clearly malicious but not safely verifiable.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 "https://download.javad.com/software/JPS2RIN/${pkgname}_linux64_${pkgver}.tar.gz"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 75%): The PKGBUILD downloads a prebuilt x86_64 binary from download.javad.com (the official JAVAD GNSS vendor download server, which is a legitimate company making GNSS receivers and software). The binary is installed directly as an executable. While download.javad.com appears to be the official vendor distribution host for JAVAD software (javad.com is the company's main site), it is still a prebuilt binary from a vendor host with only an MD5 checksum for integrity verification. MD5 is cryptographically weak and insufficient to prevent targeted substitution. There is no GPG signature verification. The binary depends on glibc and is executed directly, so any compromise of the download host or MITM would result in arbitrary code execution. This is a genuine medium-severity supply-chain concern: a prebuilt binary from a vendor host with weak integrity checking, not clearly malicious but not safely verifiable.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: yinflying <yinflying@foxmail.com>
    
      2pkgname=jps2rin
    
      3pkgver=2.1.237
    
      4pkgrel=1
    
      5pkgdesc="A converter from JPS format files(.jps) to RINEX(2/3) formats."
    
      6arch=('x86_64')
    
      7url="http://javad.com/jgnss/"
    
      8groups=('GNSS')
    
      9depends=('glibc')
    
      10provides=("${pkgname}" "jps4rin")
    
      11conflicts=("${pkgname}" "jps4rin")
    
      12replaces=()
    
      13backup=()
    
      14options=()
    
      15install=
    
      16source=(
    
      17    "https://download.javad.com/software/JPS2RIN/${pkgname}_linux64_${pkgver}.tar.gz"
    
      18)
    
      19noextract=()
    
      20md5sums=(
    
      21    'd894f36afdc694af798af8eb8111d397'
    
      22)
    
      23
    
      24package() {
    
      25    install -Dm755 ${pkgname}_linux64 "$pkgdir/usr/bin/${pkgname}"
    
      26}
    
      27

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2