kingstvis

maintainer kro007 · 3 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary tarball (KingstVIS executable, libAnalyzer.so, bundled ICU shared libraries, and an Updater binary) directly from the vendor's own website (qdkingst.com), which is the official homepage listed in the `url` field. The source is the vendor's own download endpoint for their Linux logic analyzer software. The md5sum for the tarball is provided (d77d83d056c8b7f5f8f9fb08cf02d117), which provides at least basic integrity checking, though the SKIPs for the local icon/desktop files are harmless. The concern is that this installs prebuilt closed-source binaries and shared libraries (including a bundled libAnalyzer.so and an Updater binary) from a non-GitHub/non-distro host with no reproducibility. The host is the official vendor site for Kingst logic analyzers, not a random personal host, which reduces but does not eliminate supply-chain risk. The Updater binary is particularly notable as it could fetch and execute additional code. This is a legitimate medium-risk pattern: prebuilt proprietary binaries from a vendor's own download server, with a checksum for the tarball but no signature verification.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("${pkgname}.tar.gz::http://www.qdkingst.com/download/vis_linux"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 78%): This PKGBUILD downloads a prebuilt binary tarball (KingstVIS executable, libAnalyzer.so, bundled ICU shared libraries, and an Updater binary) directly from the vendor's own website (qdkingst.com), which is the official homepage listed in the `url` field. The source is the vendor's own download endpoint for their Linux logic analyzer software. The md5sum for the tarball is provided (d77d83d056c8b7f5f8f9fb08cf02d117), which provides at least basic integrity checking, though the SKIPs for the local icon/desktop files are harmless. The concern is that this installs prebuilt closed-source binaries and shared libraries (including a bundled libAnalyzer.so and an Updater binary) from a non-GitHub/non-distro host with no reproducibility. The host is the official vendor site for Kingst logic analyzers, not a random personal host, which reduces but does not eliminate supply-chain risk. The Updater binary is particularly notable as it could fetch and execute additional code. This is a legitimate medium-risk pattern: prebuilt proprietary binaries from a vendor's own download server, with a checksum for the tarball but no signature verification.

PKGBUILD

1 offending line(s) highlighted

      1#Maintainer: kro007 <mula.gabriel.fr@gmail.com>
    
      2#Contributer: NN777 <NN777@NN777.com>
    
      3
    
      4pkgname=('kingstvis')
    
      5pkgver=3.6.5
    
      6pkgrel=1
    
      7pkgdesc="Kingst Virtual Instruments - Logic Analyzer"
    
      8provides=("kingstvis")
    
      9url='http://www.qdkingst.com'
    
      10arch=('x86_64')
    
      11depends=('qt5-base' 'qt5-svg')
    
      12source=("${pkgname}.tar.gz::http://www.qdkingst.com/download/vis_linux"
    
      13kingstvis.desktop
    
      14logo-0.png
    
      15logo-1.png
    
      16logo-2.png
    
      17logo-3.png
    
      18logo-4.png
    
      19)
    
      20md5sums=('d77d83d056c8b7f5f8f9fb08cf02d117'
    
      21SKIP
    
      22SKIP
    
      23SKIP
    
      24SKIP
    
      25SKIP
    
      26SKIP
    
      27)
    
      28
    
      29package(){
    
      30	 install -Dm755 "${srcdir}"/KingstVIS/KingstVIS "${pkgdir}"/opt/kingstvis/KingstVIS
    
      31	 install -Dm755 "${srcdir}"/KingstVIS/Updater "${pkgdir}"/opt/kingstvis/Updater
    
      32	 
    
      33	 install -Dm755 "${srcdir}"/KingstVIS/libAnalyzer.so "${pkgdir}"/opt/kingstvis/libAnalyzer.so
    
      34	 
    
      35	 install -Dm755 "${srcdir}"/KingstVIS/libicudata.so.56 "${pkgdir}"/opt/kingstvis/libicudata.so.56
    
      36	 
    
      37	 install -Dm755 "${srcdir}"/KingstVIS/libicui18n.so.56 "${pkgdir}"/opt/kingstvis/libicui18n.so.56
    
      38	 
    
      39	 install -Dm755 "${srcdir}"/KingstVIS/libicuuc.so.56 "${pkgdir}"/opt/kingstvis/libicuuc.so.56
    
      40	 
    
      41	 mkdir -p "${pkgdir}"/opt/kingstvis/Resource
    
      42	 install -Dm644 "${srcdir}"/KingstVIS/Resource/* "${pkgdir}"/opt/kingstvis/Resource
    
      43	 
    
      44	 mkdir -p "${pkgdir}"/opt/kingstvis/Language
    
      45	 install -Dm644 "${srcdir}"/KingstVIS/Language/* "${pkgdir}"/opt/kingstvis/Language
    
      46	 
    
      47	 mkdir -p "${pkgdir}"/opt/kingstvis/Analyzer
    
      48	 install -Dm644 "${srcdir}"/KingstVIS/Analyzer/* "${pkgdir}"/opt/kingstvis/Analyzer
    
      49	 
    
      50	 mkdir -p "${pkgdir}"/opt/kingstvis/Driver
    
      51	 install -Dm644 "${srcdir}"/KingstVIS/Driver/* "${pkgdir}"/opt/kingstvis/Driver
    
      52	 
    
      53	 mkdir -p "${pkgdir}"/opt/kingstvis/imageformats
    
      54	 install -Dm644 "${srcdir}"/KingstVIS/imageformats/* "${pkgdir}"/opt/kingstvis/imageformats
    
      55	 	 
    
      56	 mkdir -p "${pkgdir}"/opt/kingstvis/platforms
    
      57	 install -Dm644 "${srcdir}"/KingstVIS/platforms/* "${pkgdir}"/opt/kingstvis/platforms
    
      58	 
    
      59	 install -Dm644 "${srcdir}"/KingstVIS/README "${pkgdir}"/opt/kingstvis/README	 
    
      60	 
    
      61	 install -Dm644 "${srcdir}"/KingstVIS/Driver/99-Kingst.rules "${pkgdir}"/etc/udev/rules.d/99-Kingst.rules
    
      62	 
    
      63	 install -Dm755 "${srcdir}"/kingstvis.desktop "${pkgdir}"/usr/share/applications/kingstvis.desktop
    
      64	 
    
      65	 # Icons
    
      66	 #/usr/share/icons/hicolor/16x16/apps/
    
      67	 install -Dm644 "${srcdir}"/logo-0.png "${pkgdir}"/usr/share/icons/hicolor/64x64/KingstVIS.png
    
      68	 install -Dm644 "${srcdir}"/logo-0.png "${pkgdir}"/usr/share/icons/KingstVIS.png
    
      69	 install -Dm644 "${srcdir}"/logo-1.png "${pkgdir}"/usr/share/icons/hicolor/48x48/KingstVIS.png
    
      70	 install -Dm644 "${srcdir}"/logo-2.png "${pkgdir}"/usr/share/icons/hicolor/32x32/KingstVIS.png
    
      71	 install -Dm644 "${srcdir}"/logo-3.png "${pkgdir}"/usr/share/icons/hicolor/20x20/KingstVIS.png
    
      72	 install -Dm644 "${srcdir}"/logo-4.png "${pkgdir}"/usr/share/icons/hicolor/16x16/KingstVIS.png
    
      73}
    
      74

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2