lfp

maintainer Connor · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary tarball from software.concise.cc, a personal/project-controlled host that is not the upstream GitLab release infrastructure. The package then installs prebuilt binaries and a precompiled Python wheel (lfpreviewer-1.0.1-cp311-cp311-linux_x86_64.whl) directly into the system. There is no way to verify the wheel or binaries against upstream source. The sha512sum and md5sum provide integrity checks against the downloaded artifact, but if the host is compromised or the artifact is swapped, those checksums would also be updated. The validpgpkeys entry is present but there is no actual signature file in the source array, so PGP verification is not actually enforced. This is a genuine supply-chain concern: prebuilt binaries and a compiled Python extension wheel from a non-official host, with no source build, constitutes a real medium-severity risk.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 "https://software.concise.cc/x86_64/${pkgname}-${pkgver}-${pkgrel}-$arch.pkg.tar.xz"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt binary tarball from software.concise.cc, a personal/project-controlled host that is not the upstream GitLab release infrastructure. The package then installs prebuilt binaries and a precompiled Python wheel (lfpreviewer-1.0.1-cp311-cp311-linux_x86_64.whl) directly into the system. There is no way to verify the wheel or binaries against upstream source. The sha512sum and md5sum provide integrity checks against the downloaded artifact, but if the host is compromised or the artifact is swapped, those checksums would also be updated. The validpgpkeys entry is present but there is no actual signature file in the source array, so PGP verification is not actually enforced. This is a genuine supply-chain concern: prebuilt binaries and a compiled Python extension wheel from a non-official host, with no source build, constitutes a real medium-severity risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Connor Etherington <connor@concise.cc>
    
      2# ---
    
      3pkgname=lfp
    
      4pkgver=4.2.4
    
      5pkgrel=1
    
      6pkgdesc='A wrapper for the lf file manager with in-terminal media previews, on-exit directory changing and much more'
    
      7license=('MIT')
    
      8arch=('x86_64')
    
      9install="lfp.install"
    
      10url="https://gitlab.com/a4to/lfp"
    
      11depends=(lf zsh ffmpeg graphicsmagick openslide ghostscript bat fzf dunst dialog xsel lolcat python3 python-docopt python-pillow python-attrs libxres python-setuptools python-pip tesseract tesseract-data-eng)
    
      12conflicts=(lfp-git)
    
      13optdepends=(
    
      14  'nodejs: to make use of lfps built in node actions manager'
    
      15  'python3: to make use of lfps built in python actions manager'
    
      16  )
    
      17source=(
    
      18  "https://software.concise.cc/x86_64/${pkgname}-${pkgver}-${pkgrel}-$arch.pkg.tar.xz"
    
      19)
    
      20sha512sums=(
    
      21  '83a891da7c16eb733229f96a59b9296b2bbf935318b8fe6e167312b59242c29ee81fffb2d7f5905730cdec5621ea0d0f4947f0e32630b6678a1d91f0532c1945'
    
      22)
    
      23md5sums=(
    
      24  'cee544f8d2a315e43ac840e405d42e04'
    
      25)
    
      26validpgpkeys=(
    
      27  '81BACEEBC3EA26E127166E4A819BB92A9A48160E'
    
      28)
    
      29
    
      30package() {
    
      31
    
      32  cd "$srcdir/${pkgname}-${pkgver}-${pkgrel}-${arch}/lfpreviewer" ||
    
      33  cd "$srcdir/${pkgname}/lfpreviewer"
    
      34
    
      35  pip install . --root="$pkgdir" --prefix=/usr --no-deps
    
      36  pip install ./lfpreviewer-1.0.1-cp311-cp311-linux_x86_64.whl 2>/dev/null ||
    
      37    pip install ./lfpreviewer-1.0.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl 2>/dev/null || true
    
      38
    
      39
    
      40  cd "$srcdir/${pkgname}-${pkgver}-${pkgrel}-${arch}" >/dev/null 2>&1 ||
    
      41  cd "$srcdir/${pkgname}"
    
      42
    
      43  install -Dm755 usr/bin/* -t "${pkgdir}/usr/bin"
    
      44  install -Dm755 usr/share/${pkgname}/{lfp,lfpcd,cleaner,scope} -t "${pkgdir}/usr/share/${pkgname}"
    
      45  install -Dm644 usr/share/${pkgname}/{lfp-icons,lfprc} -t "${pkgdir}/usr/share/${pkgname}"
    
      46  install -Dm644 usr/share/licenses/${pkgname}/LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      47  install -Dm644 usr/share/doc/${pkgname}/README.md "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      48  install -Dm644 usr/share/man/man1/${pkgname}.1.gz "${pkgdir}/usr/share/man/man1/${pkgname}.1.gz"
    
      49  install -Dm755 usr/share/${pkgname}/ocr/ocr.js -t "${pkgdir}/usr/share/${pkgname}/ocr"
    
      50  install -Dm644 usr/share/${pkgname}/ocr/package.json -t "${pkgdir}/usr/share/${pkgname}/ocr"
    
      51  install -Dm644 usr/share/${pkgname}/ocr/tesseract.js -t "${pkgdir}/usr/share/${pkgname}/ocr"
    
      52
    
      53}
    
      54

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2