komodo-ide-nightly

maintainer Naatan · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary tarball of Komodo IDE from downloads.activestate.com (the official ActiveState download server) with SKIP checksums, then executes install.sh from within the extracted tarball. The host is the legitimate vendor's official download server, which reduces supply-chain risk compared to a personal/unofficial host. However, all checksums are SKIP (including for the patches stored locally), meaning there is no integrity verification for any artifact. The nightly build URL resolves dynamically via a curl+grep at parse time, and the binary is executed directly (install.sh runs during package()). The combination of: (1) executed prebuilt binary with no checksum verification, (2) nightly/rolling source that changes without version pinning, and (3) patches applied to bundled Python files that are also unverified, constitutes a real supply-chain concern even from an official host — a compromised CDN or MITM could substitute a malicious tarball with no detection. This is a genuine medium-severity concern, not a false positive, though it is not clearly malicious.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:13 _body=$(curl -s http://downloads.activestate.com/Komodo/nightly/komodoide/latest/ | grep -ioE "Komodo-IDE-.{6,7}-.{5}-linux-x86_64.tar.gz")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt binary tarball of Komodo IDE from downloads.activestate.com (the official ActiveState download server) with SKIP checksums, then executes install.sh from within the extracted tarball. The host is the legitimate vendor's official download server, which reduces supply-chain risk compared to a personal/unofficial host. However, all checksums are SKIP (including for the patches stored locally), meaning there is no integrity verification for any artifact. The nightly build URL resolves dynamically via a curl+grep at parse time, and the binary is executed directly (install.sh runs during package()). The combination of: (1) executed prebuilt binary with no checksum verification, (2) nightly/rolling source that changes without version pinning, and (3) patches applied to bundled Python files that are also unverified, constitutes a real supply-chain concern even from an official host — a compromised CDN or MITM could substitute a malicious tarball with no detection. This is a genuine medium-severity concern, not a false positive, though it is not clearly malicious.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Nathan Rijksen <nathanr+aur@activestate.com>
    
      2# Contributor: max-k <max-k@post.com>
    
      3# Based on https://aur.archlinux.org/packages/komodo-edit (by max-k)
    
      4
    
      5if [ $(uname -m) = "x86_64" ] ; then
    
      6_arch="x86_64"
    
      7else
    
      8_arch="x86"
    
      9fi
    
      10
    
      11pkgname="komodo-ide-nightly"
    
      12_bigname="Komodo-IDE"
    
      13_body=$(curl -s http://downloads.activestate.com/Komodo/nightly/komodoide/latest/ | grep -ioE "Komodo-IDE-.{6,7}-.{5}-linux-x86_64.tar.gz")
    
      14_major=$(echo $_body | sed -n 's/.*\([0-9.]\{6,7\}\).*/\1/p')
    
      15_minor=$(echo $_body | sed -n 's/.*\([0-9]\{5\}\).*/\1/p')
    
      16pkgver="${_major}_${_minor}"
    
      17pkgrel=1
    
      18pkgdesc="Code smarter and faster with the leading IDE for today's major web languages, including Python, PHP, Node.js, Perl, Go and Ruby.  - XUL based"
    
      19arch=(i686 x86_64)
    
      20url="http://www.activestate.com/komodo-ide"
    
      21license=('custom')
    
      22depends=('dbus-glib' 'glibc>=2.4' 'libjpeg-turbo' 'gcc-libs' 'gtk2')
    
      23optdepends=('xterm: can be used for running certain commands')
    
      24options=('!strip')
    
      25
    
      26source=('_install.py.patch' 'activestate.py.patch')
    
      27_srcbase="http://downloads.activestate.com/Komodo/nightly/komodoide/latest/link/"
    
      28source_i686=("${_srcbase}/Komodo-IDE-linux-x86.tar.gz")
    
      29source_x86_64=("${_srcbase}/Komodo-IDE-linux-x86_64.tar.gz")
    
      30
    
      31sha256sums=('SKIP'
    
      32            'SKIP')
    
      33sha256sums_i686=('SKIP')
    
      34sha256sums_x86_64=('SKIP')
    
      35
    
      36prepare() {
    
      37  cd ${srcdir}/${_bigname}-${_major}-${_minor}-linux-${_arch}
    
      38  if [ $_arch == "x86_64" ] ; then
    
      39    sed -i "s/__ARCH__/x86_64/" ${srcdir}/_install.py.patch
    
      40    sed -i "s/__ARCH__/x86_64/" ${srcdir}/activestate.py.patch
    
      41  else
    
      42    sed -i "s/__ARCH__/x86/" ${srcdir}/_install.py.patch
    
      43    sed -i "s/__ARCH__/x86/" ${srcdir}/activestate.py.patch
    
      44  fi
    
      45  patch -p0 -i ${srcdir}/_install.py.patch support/_install.py
    
      46  patch -p0 -i ${srcdir}/activestate.py.patch INSTALLDIR/lib/python/lib/python*.*/activestate.py
    
      47}
    
      48
    
      49build() {
    
      50  echo "" > /dev/null
    
      51}
    
      52
    
      53package() {
    
      54  cd ${srcdir}/${_bigname}-${_major}-${_minor}-linux-${_arch}
    
      55  ./install.sh -v -s -I ${pkgdir}/opt/${pkgname} --dest-dir /opt/${pkgname} 2>&1 > /dev/null
    
      56  _dfile=${pkgdir}/opt/${pkgname}/share/desktop/komodo-ide-${_major:0:2}-nightly.desktop
    
      57  sed -i "s#${pkgdir}##" ${_dfile}
    
      58  install -Dm644 ${_dfile} ${pkgdir}/usr/share/applications/${pkgname}.desktop
    
      59  install -d ${pkgdir}/usr/bin
    
      60  ln -sf /opt/${pkgname}/bin/komodo ${pkgdir}/usr/bin/komodo
    
      61}
    
      62

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2