libps3000

maintainer mti · 3 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary .deb from labs.picotech.com, which is Picotech's own official Linux package repository (they host Debian/Ubuntu packages there for their oscilloscope drivers). This is a legitimate vendor host, not a random personal server. However, the package installs a closed-source, prebuilt binary library directly from the vendor without source access, and uses only an MD5 checksum (cryptographically weak, no SHA256/b2). The host itself is plausibly official, but the combination of: (1) executed/loaded binary code, (2) weak integrity check only, and (3) no source availability means a compromised or MITM'd host could deliver malicious code. This is a genuine medium-severity supply-chain concern — not because the host is clearly unofficial, but because the integrity guarantee is weak for an installed shared library. The cheaper model's MEDIUM rating is correct here.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 source=("http://labs.picotech.com/debian/pool/main/libp/libps3000/${pkgname}_${pkgver//_/-}_amd64.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from labs.picotech.com, which is Picotech's own official Linux package repository (they host Debian/Ubuntu packages there for their oscilloscope drivers). This is a legitimate vendor host, not a random personal server. However, the package installs a closed-source, prebuilt binary library directly from the vendor without source access, and uses only an MD5 checksum (cryptographically weak, no SHA256/b2). The host itself is plausibly official, but the combination of: (1) executed/loaded binary code, (2) weak integrity check only, and (3) no source availability means a compromised or MITM'd host could deliver malicious code. This is a genuine medium-severity supply-chain concern — not because the host is clearly unofficial, but because the integrity guarantee is weak for an installed shared library. The cheaper model's MEDIUM rating is correct here.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Mikael Tillenius <mti at tillenius dot com>
    
      2pkgname=libps3000
    
      3pkgver=4.0.54_3r2438
    
      4pkgrel=1
    
      5pkgdesc="library for picotech oscilloscope 3000 series"
    
      6arch=('x86_64')
    
      7url="http://www.picotech.com/linux.html"
    
      8license=('custom')
    
      9groups=()
    
      10depends=(libusb)
    
      11optdepends=()
    
      12provides=()
    
      13conflicts=()
    
      14replaces=()
    
      15backup=()
    
      16options=(!strip)
    
      17install=
    
      18changelog=
    
      19source=("http://labs.picotech.com/debian/pool/main/libp/libps3000/${pkgname}_${pkgver//_/-}_amd64.deb")
    
      20md5sums=('1799d33209f33223df27374e3a1342ee')
    
      21
    
      22package() {
    
      23  tar -xf data.tar.xz -C "${pkgdir}"
    
      24  chmod -R go-w $pkgdir
    
      25  chown -R root:root $pkgdir
    
      26}
    
      27

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2