lib32-libfmod

maintainer brunoharasimiuk · 7 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD installs prebuilt proprietary shared libraries (.so files) that will be executed/loaded by applications at runtime. Two concerns: (1) The source is zdoom.org, which is a third-party mirror/host rather than the official FMOD developer portal (fmod.org/fmodex). While zdoom.org is a well-known and reputable game engine project that historically mirrored FMOD for GZDoom/ZDoom compatibility, it is not the canonical upstream vendor for FMOD SDK distributions. (2) sha512sums=('SKIP') means there is no integrity verification whatsoever — if the file on zdoom.org were replaced or tampered with, the malicious .so files would be installed silently. The combination of prebuilt binary blobs + no checksum + non-official host constitutes a genuine medium-severity supply-chain risk. The FMOD 4.44.x SDK is very old (EOL), making it less likely to be actively maintained or verified. This is not clearly malicious, but the lack of checksum on executed binary code from a third-party host is a real concern.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=(https://zdoom.org/files/fmod/fmodapi44464linux.tar.gz)

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD installs prebuilt proprietary shared libraries (.so files) that will be executed/loaded by applications at runtime. Two concerns: (1) The source is zdoom.org, which is a third-party mirror/host rather than the official FMOD developer portal (fmod.org/fmodex). While zdoom.org is a well-known and reputable game engine project that historically mirrored FMOD for GZDoom/ZDoom compatibility, it is not the canonical upstream vendor for FMOD SDK distributions. (2) sha512sums=('SKIP') means there is no integrity verification whatsoever — if the file on zdoom.org were replaced or tampered with, the malicious .so files would be installed silently. The combination of prebuilt binary blobs + no checksum + non-official host constitutes a genuine medium-severity supply-chain risk. The FMOD 4.44.x SDK is very old (EOL), making it less likely to be actively maintained or verified. This is not clearly malicious, but the lack of checksum on executed binary code from a third-party host is a real concern.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  Vincent Grande <shoober420@gmail.com>
    
      2# Contributor: Philip Abernethy <chais.z3r0@gmail.com>
    
      3
    
      4pkgname=lib32-libfmod
    
      5pkgver=4.44.64
    
      6pkgrel=1
    
      7pkgdesc="Libraries of the fmodex audio engine"
    
      8arch=('x86_64')
    
      9url="http://www.fmod.org/"
    
      10license=('custom')
    
      11conflicts=('fmodex')
    
      12source=(https://zdoom.org/files/fmod/fmodapi44464linux.tar.gz)
    
      13sha512sums=('SKIP')
    
      14
    
      15package() {
    
      16	install -Dm644 ${srcdir}/fmodapi${pkgver//./}linux/api/lib/libfmodex-${pkgver}.so ${pkgdir}/usr/lib32/libfmodex-${pkgver}.so
    
      17	install -m644 ${srcdir}/fmodapi${pkgver//./}linux/api/lib/libfmodexL-${pkgver}.so ${pkgdir}/usr/lib32/libfmodexL-${pkgver}.so
    
      18	install -m644 ${srcdir}/fmodapi${pkgver//./}linux/fmoddesignerapi/api/lib/libfmodevent-${pkgver}.so ${pkgdir}/usr/lib32/libfmodevent-${pkgver}.so
    
      19	install -m644 ${srcdir}/fmodapi${pkgver//./}linux/fmoddesignerapi/api/lib/libfmodeventL-${pkgver}.so ${pkgdir}/usr/lib32/libfmodeventL-${pkgver}.so
    
      20	install -m644 ${srcdir}/fmodapi${pkgver//./}linux/fmoddesignerapi/api/lib/libfmodeventnet-${pkgver}.so ${pkgdir}/usr/lib32/libfmodeventnet-${pkgver}.so
    
      21	ln -s libfmodex-${pkgver}.so ${pkgdir}/usr/lib32/libfmodex.so
    
      22	ln -s libfmodexL-${pkgver}.so ${pkgdir}/usr/lib32/libfmodexL.so
    
      23	ln -s libfmodevent-${pkgver}.so ${pkgdir}/usr/lib32/libfmodevent.so
    
      24	ln -s libfmodeventL-${pkgver}.so ${pkgdir}/usr/lib32/libfmodeventL.so
    
      25	ln -s libfmodeventnet-${pkgver}.so ${pkgdir}/usr/lib32/libfmodeventnet.so
    
      26	install -Dm644 ${srcdir}/fmodapi${pkgver//./}linux/documentation/LICENSE.TXT ${pkgdir}/usr/share/licenses/${pkgname}/LICENSE
    
      27}
    
      28

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2