kryoflux

maintainer starfry · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads and installs a prebuilt binary .deb (containing dtc and libcapsimage.so) and a prebuilt JAR (kryoflux-ui.jar) from kryoflux.com. These are executed/loaded at runtime. The sources are from the official KryoFlux vendor domain (kryoflux.com and webstore.kryoflux.com), which is the legitimate upstream for this proprietary hardware product. However, the checksums are MD5 (weak, though present), and the JAR is fetched from a bare URL without a versioned path, meaning it could be silently updated server-side without a pkgver bump. The .deb extraction and direct installation of a prebuilt binary is a real supply-chain concern since there is no way to verify the binary's provenance beyond the vendor's word. This is a legitimate medium-risk pattern: prebuilt proprietary binaries from the official vendor host, not clearly malicious but not auditable source builds.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source=("https://www.kryoflux.com/download/kryoflux_${pkgver}0_linux.tar.gz"
PKGBUILD:18 'https://kryoflux.com/kryoflux-ui.jar'
PKGBUILD:22 'https://webstore.kryoflux.com/catalog/images/kf_logo_big.png')

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads and installs a prebuilt binary .deb (containing dtc and libcapsimage.so) and a prebuilt JAR (kryoflux-ui.jar) from kryoflux.com. These are executed/loaded at runtime. The sources are from the official KryoFlux vendor domain (kryoflux.com and webstore.kryoflux.com), which is the legitimate upstream for this proprietary hardware product. However, the checksums are MD5 (weak, though present), and the JAR is fetched from a bare URL without a versioned path, meaning it could be silently updated server-side without a pkgver bump. The .deb extraction and direct installation of a prebuilt binary is a real supply-chain concern since there is no way to verify the binary's provenance beyond the vendor's word. This is a legitimate medium-risk pattern: prebuilt proprietary binaries from the official vendor host, not clearly malicious but not auditable source builds.

PKGBUILD

3 offending line(s) highlighted

      1# Co-Maintainer: Jose Riha <jose1711 gmail com>
    
      2# Maintainer: John Lane <archlinux at jelmail dot com>
    
      3
    
      4pkgname=kryoflux
    
      5pkgdesc="USB Floppy Controller for Software Preservation"
    
      6pkgver=3.5
    
      7pkgrel=1
    
      8arch=('x86_64' 'aarch64')
    
      9url="http://www.kryoflux.com"
    
      10license=('custom')
    
      11provides=('capsimage')
    
      12conflicts=('capsimage')
    
      13depends=('libusb')
    
      14install=kryoflux.install
    
      15makedepends=('gendesk' 'imagemagick')
    
      16optdepends=('java-runtime: for the Kryoflux GUI')
    
      17source=("https://www.kryoflux.com/download/kryoflux_${pkgver}0_linux.tar.gz"
    
      18        'https://kryoflux.com/kryoflux-ui.jar'
    
      19        '80-kryoflux.rules'
    
      20        'kryoflux.conf'
    
      21        'kryoflux.sh'
    
      22        'https://webstore.kryoflux.com/catalog/images/kf_logo_big.png')
    
      23md5sums=('aa1a74bc681e2092278506ef4a2126f9'
    
      24         '44a067aa8d40dd0c8c53d6ff3ad8109c'
    
      25         '43ec7eb49fbdab703cafe146145fe0de'
    
      26         'ede10c48b2b1edc5c346e8814f07bcdb'
    
      27         '6811dc57633d7046a540b65e763aa338'
    
      28         'ede9a2b77643af8bf9d166c30827c170')
    
      29
    
      30prepare() {
    
      31  cd "${srcdir}"
    
      32  gendesk -f -n --pkgname "${pkgname}" --pkgdesc "Control program for KryoFlux" --exec "kryoflux" --categories "Utility;Archiving"
    
      33  convert kf_logo_big.png -background None -gravity center -extent 400x400 kryoflux.png
    
      34}
    
      35
    
      36package() {
    
      37  pkgroot=${pkgdir}/usr
    
      38  #pkgroot=${pkgdir}/usr/local
    
      39
    
      40  cd "$srcdir"
    
      41  install -D 80-kryoflux.rules ${pkgdir}/etc/udev/rules.d/80-kryoflux.rules
    
      42  install -D kryoflux.conf ${pkgdir}/etc/modprobe.d/kryoflux.conf
    
      43
    
      44  cd "$srcdir/Linux_Release${pkgver}0"
    
      45  install -d ${pkgroot}/{bin,lib}
    
      46  if [ "$CARCH" = "x86_64" ]
    
      47  then
    
      48    ar -xv dtc/${CARCH}/kryoflux-dtc_${pkgver}.0_amd64.deb data.tar.gz
    
      49  else
    
      50    ar -xv dtc/${CARCH}/kryoflux-dtc_${pkgver}.0_arm64.deb data.tar.gz
    
      51  fi
    
      52  tar -C ${pkgdir} -xvf data.tar.gz
    
      53  # rename dtc binary to kdtc to avoid clash with dtc package (suggested by @frankspace)
    
      54  mv ${pkgdir}/usr/bin/dtc ${pkgdir}/usr/bin/kdtc
    
      55  # we'll also copy dtc under original name to /usr/share/java/kryoflux
    
      56  install -Dm755 ${pkgdir}/usr/bin/kdtc ${pkgroot}/share/java/kryoflux/dtc
    
      57  install -Dm644 ${srcdir}/kryoflux-ui.jar ${pkgroot}/share/java/kryoflux/kryoflux-ui.jar
    
      58
    
      59  # Documents
    
      60  install -d ${pkgdir}/usr/share/{licenses,doc}/kryoflux
    
      61  install -Dm644 LICENCE.txt ${pkgdir}/usr/share/licenses/kryoflux/LICENCE
    
      62  install docs/* ${pkgdir}/usr/share/doc/kryoflux
    
      63  install dtc/*README* ${pkgdir}/usr/share/doc/kryoflux
    
      64  cp -a schematics ${pkgdir}/usr/share/doc/kryoflux
    
      65
    
      66  # Shell wrapper
    
      67  install -Dm755 ${srcdir}/kryoflux.sh ${pkgroot}/bin/kryoflux
    
      68
    
      69  # Desktop file
    
      70  install -Dm644 "${srcdir}/${pkgname}.desktop" "${pkgroot}/share/applications/${pkgname}.desktop"
    
      71  install -Dm644 "${srcdir}/${pkgname}.png" "${pkgroot}/share/pixmaps/${pkgname}.png"
    
      72
    
      73  # resolve conflict with filesystem package
    
      74  mv ${pkgdir}/usr/lib64/libcapsimage.so ${pkgdir}/usr/lib/libcapsimage.so
    
      75  rmdir ${pkgdir}/usr/lib64
    
      76}
    
      77
    
      78# vim: ft=sh syn=sh et
    
      79

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2