kindlegen

maintainer alerque · 78 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt proprietary binary (kindlegen) from archive.org rather than from Amazon's official servers. The binary is executed directly (installed to /usr/bin with 0755). While archive.org is a reputable archival service and the file is verified with both md5 and sha256 checksums, the original upstream (Amazon) has discontinued this tool and the official download URL no longer works, making archive.org the de-facto source. The checksums provide integrity verification, but archive.org is not the authoritative vendor host — items can be replaced or the archive modified by the uploader. The combination of a prebuilt binary from a non-official host constitutes a genuine medium supply-chain concern, even with checksums present, since the checksums themselves are defined in the same PKGBUILD and could be updated alongside a malicious binary replacement. This is a real but not clearly malicious concern — the pattern is common for abandoned proprietary tools in AUR.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("https://archive.org/download/$pkgname$pkgver/${pkgname}_linux_2.6_i386_v${pkgver/./_}.tar.gz")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt proprietary binary (kindlegen) from archive.org rather than from Amazon's official servers. The binary is executed directly (installed to /usr/bin with 0755). While archive.org is a reputable archival service and the file is verified with both md5 and sha256 checksums, the original upstream (Amazon) has discontinued this tool and the official download URL no longer works, making archive.org the de-facto source. The checksums provide integrity verification, but archive.org is not the authoritative vendor host — items can be replaced or the archive modified by the uploader. The combination of a prebuilt binary from a non-official host constitutes a genuine medium supply-chain concern, even with checksums present, since the checksums themselves are defined in the same PKGBUILD and could be updated alongside a malicious binary replacement. This is a real but not clearly malicious concern — the pattern is common for abandoned proprietary tools in AUR.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Caleb Maclennan <caleb@alerque.com>
    
      2# Contributor: AUR[flyingpig]
    
      3# Contributor: Valentin-Costel Haloiu <vially.ichb@gmail.com>
    
      4# Contributor: Eugene Yunak <e.yunak@gmail.com>
    
      5# Contributor: Pellegrino Prevete <pellegrinoprevete@gmail.com>
    
      6
    
      7pkgname=kindlegen
    
      8pkgver=2.9
    
      9pkgrel=7
    
      10pkgdesc='cli tool to build eBooks that can be used on Amazon’s Kindle platform (binary)'
    
      11arch=(x86_64 i686)
    
      12url='https://www.amazon.com/gp/feature.html?ie=UTF8&docId=1000765211'
    
      13license=(custom)
    
      14source=("https://archive.org/download/$pkgname$pkgver/${pkgname}_linux_2.6_i386_v${pkgver/./_}.tar.gz")
    
      15md5sums=('21aef3c8846946203e178c83a37beba1')
    
      16sha256sums=('9828db5a2c8970d487ada2caa91a3b6403210d5d183a7e3849b1b206ff042296')
    
      17
    
      18package() {
    
      19	install -Dm0755 -t "$pkgdir/usr/bin/" kindlegen
    
      20	install -Dm0644 -t "$pkgdir/usr/share/licenses/$pkgname/" EULA.txt "KindleGen Legal Notices 2013-02-19 Linux.txt"
    
      21	install -Dm0644 -t "$pkgdir/usr/share/doc/$pkgname/" manual.html docs/english/*
    
      22}
    
      23

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2