katana

maintainer squdle · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary tarball via wget inside prepare() rather than declaring it in source=() with a checksum. This means the download is not integrity-verified by makepkg and could be silently substituted. The host is the official Foundry vendor domain (foundry.com), which reduces the risk of a compromised third-party mirror, but the lack of any checksum (sha256sums etc.) means there is no way to detect tampering in transit or a future change to the file served at that URL. The downloaded tarball contains a proprietary installer (install.sh) that is executed directly in package(), installing a prebuilt binary application to /opt. This is a genuine supply-chain concern: an executed binary from an unverified download. The vendor domain origin keeps this from being high severity, but the absence of integrity verification on an executed binary warrants medium.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:21 wget -O "katana${pkgver}.tar.gz" "https://www.foundry.com/products/download_product?file=Katana${pkgver}-linux-x86-release-64.tgz"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary tarball via wget inside prepare() rather than declaring it in source=() with a checksum. This means the download is not integrity-verified by makepkg and could be silently substituted. The host is the official Foundry vendor domain (foundry.com), which reduces the risk of a compromised third-party mirror, but the lack of any checksum (sha256sums etc.) means there is no way to detect tampering in transit or a future change to the file served at that URL. The downloaded tarball contains a proprietary installer (install.sh) that is executed directly in package(), installing a prebuilt binary application to /opt. This is a genuine supply-chain concern: an executed binary from an unverified download. The vendor domain origin keeps this from being high severity, but the absence of integrity verification on an executed binary warrants medium.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Joshua Deakin contact[at]joshuadeakin[dot]com
    
      2
    
      3# Note: You may want to add /opt/Katana<version>/ to $PATH
    
      4# Note: May need to stop Qt from using the MIT-SHM X11 Shared Memory Extension:
    
      5# $ env QT_X11_NO_MITSHM=1 /opt/Katana<version>/katana
    
      6# Note: Uncomment the ACCEPTEULA line to auto accept EULA agreement.
    
      7
    
      8pkgname='katana'
    
      9pkgbase='katana'
    
      10pkgver='3.0v1'
    
      11pkgrel=1
    
      12pkgdesc="VFX package for asset based look development and lighting"
    
      13arch=('x86_64')
    
      14url="https://www.foundry.com"
    
      15license=('custom')
    
      16depends=()
    
      17makedepends=()
    
      18options=('!strip')
    
      19
    
      20prepare() {
    
      21	wget -O "katana${pkgver}.tar.gz" "https://www.foundry.com/products/download_product?file=Katana${pkgver}-linux-x86-release-64.tgz"
    
      22	tar -xvzf "katana${pkgver}.tar.gz"
    
      23	sed -i 's/more EULA/cat EULA/' "${srcdir}/install.sh"
    
      24}
    
      25
    
      26package() {
    
      27	dest_katana="${pkgdir}/opt/${pkgname}${pkgver}"
    
      28	dest_3delight="${pkgdir}/opt/${pkgname}${pkgver}-3delight"
    
      29	echo "${dest_katana}"
    
      30	echo "${dest_3delight}"
    
      31	#export ACCEPTEULA='yes'
    
      32	export KATANAPATH="${dest_katana}"
    
      33	export DELIGHTPATH="${dest_3delight}"
    
      34	bash install.sh
    
      35}
    
      36
    
      37

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2