libirimager-bin

maintainer passerby1 · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary .deb from ftp.evocortex.com, which is the official vendor host for Optris/Evocortex thermal imaging SDK (evocortex.com/evocortex.org are the same company). The URL pattern matches the vendor's official FTP distribution channel for their libirimager SDK. A sha512 checksum is present, providing integrity verification. However, this is still a prebuilt closed-source binary from a non-GitHub/non-standard host with no way to independently verify the checksum against a signed release manifest. The binary is extracted and installed into the system library path (usr/lib), meaning it will be executed/loaded by applications. This fits the classic medium risk profile: executed binary from a vendor-specific host with checksum but no GPG signature verification. The host appears to be the legitimate vendor (evocortex.com matches the package URL domain evocortex.org), which slightly reduces concern, but the supply-chain risk of an unverifiable prebuilt binary remains real.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source_x86_64=("http://ftp.evocortex.com/libirimager-${pkgver}-amd64.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt binary .deb from ftp.evocortex.com, which is the official vendor host for Optris/Evocortex thermal imaging SDK (evocortex.com/evocortex.org are the same company). The URL pattern matches the vendor's official FTP distribution channel for their libirimager SDK. A sha512 checksum is present, providing integrity verification. However, this is still a prebuilt closed-source binary from a non-GitHub/non-standard host with no way to independently verify the checksum against a signed release manifest. The binary is extracted and installed into the system library path (usr/lib), meaning it will be executed/loaded by applications. This fits the classic medium risk profile: executed binary from a vendor-specific host with checksum but no GPG signature verification. The host appears to be the legitimate vendor (evocortex.com matches the package URL domain evocortex.org), which slightly reduces concern, but the supply-chain risk of an unverifiable prebuilt binary remains real.

PKGBUILD

1 offending line(s) highlighted

      1# Generated by debtap
    
      2# Maintainer: bionade24
    
      3# Contributor: passerby1
    
      4pkgname=libirimager-bin
    
      5pkgver=8.8.3
    
      6pkgrel=1
    
      7pkgdesc="Development library for Optris PI imagers."
    
      8arch=('x86_64')
    
      9url="http://www.evocortex.org/irimagerdirect-sdk/"
    
      10license=('BSD')
    
      11depends=('cmake>=2.6' 'gcc>=5' 'systemd-libs>=1.0')
    
      12options=('!strip' '!emptydirs')
    
      13install=${pkgname}.install
    
      14source_x86_64=("http://ftp.evocortex.com/libirimager-${pkgver}-amd64.deb")
    
      15sha512sums_x86_64=('aec73f997d338dcdff2db068d90c107d0f38d3047a99f200812cb36fae8e11cf2d2d98e929771f06fa5859c0997ea61cd90c229a0c9245864427e95a83558626')
    
      16
    
      17package(){
    
      18
    
      19	# Extract package data
    
      20	tar xf data.tar.xz -C "${pkgdir}"
    
      21
    
      22	# Fix directories structure differencies
    
      23	cd "${pkgdir}"
    
      24
    
      25	mkdir -p usr/lib 2> /dev/null; mv lib/* usr/lib; rm -rf lib
    
      26
    
      27	cd ..
    
      28
    
      29}
    
      30

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2