libps3000a

maintainer mti · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary .deb from labs.picotech.com, which is PicoTech's own official Linux software repository (the vendor hosts their Linux drivers/libraries there). This is a legitimate vendor subdomain, not a random personal host. However, the package installs a prebuilt binary blob (shared library) directly from that host with only an MD5 checksum (cryptographically weak, no GPG signature verification). The binary is executed/loaded at runtime by user applications. The concerns are: (1) MD5 is insufficient for integrity verification against a determined attacker; (2) no GPG signature check; (3) the binary is not built from source. Despite labs.picotech.com being the legitimate vendor host, the lack of strong integrity verification and the nature of an executed binary library keeps this at medium rather than clean. It is not high because there is no evidence of malicious intent or source substitution — this is a standard pattern for proprietary hardware vendor libraries in the AUR.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 source=("http://labs.picotech.com/debian/pool/main/libp/${pkgname}/${pkgname}_${pkgver//_/-}_amd64.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from labs.picotech.com, which is PicoTech's own official Linux software repository (the vendor hosts their Linux drivers/libraries there). This is a legitimate vendor subdomain, not a random personal host. However, the package installs a prebuilt binary blob (shared library) directly from that host with only an MD5 checksum (cryptographically weak, no GPG signature verification). The binary is executed/loaded at runtime by user applications. The concerns are: (1) MD5 is insufficient for integrity verification against a determined attacker; (2) no GPG signature check; (3) the binary is not built from source. Despite labs.picotech.com being the legitimate vendor host, the lack of strong integrity verification and the nature of an executed binary library keeps this at medium rather than clean. It is not high because there is no evidence of malicious intent or source substitution — this is a standard pattern for proprietary hardware vendor libraries in the AUR.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Mikael Tillenius <mti at tillenius dot com>
    
      2pkgname=libps3000a
    
      3pkgver=2.1.54_6r2438
    
      4pkgrel=1
    
      5pkgdesc="library for picotech oscilloscope 3000a series"
    
      6arch=('x86_64')
    
      7url="http://www.picotech.com/linux.html"
    
      8license=('custom')
    
      9groups=()
    
      10depends=(libusb)
    
      11optdepends=()
    
      12provides=()
    
      13conflicts=()
    
      14replaces=()
    
      15backup=()
    
      16options=(!strip)
    
      17install=
    
      18changelog=
    
      19source=("http://labs.picotech.com/debian/pool/main/libp/${pkgname}/${pkgname}_${pkgver//_/-}_amd64.deb")
    
      20md5sums=('16abf553eba9ecb014357c27160448a7')
    
      21
    
      22package() {
    
      23  tar -xf data.tar.xz -C "${pkgdir}"
    
      24  chmod -R go-w $pkgdir
    
      25  chown -R root:root $pkgdir
    
      26}
    
      27
    
      28

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2