libtvcontrol

maintainer 1Conan · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads prebuilt binary .deb packages from assets.checkra.in, which is the official distribution host for the checkra1n jailbreak project (checkra.in is the legitimate checkra1n domain). The libtvcontrol library is associated with the checkra1n/lilstevie ecosystem for Apple TV 4K DFU control. The host is not a random personal server — it is the project's own CDN/asset host. However, the binaries are prebuilt and executed/installed directly (shared libraries and tools), and the sha512sums are present and pinned, which mitigates substitution risk. The concern is that these are precompiled binaries from a non-forge host rather than source-built, which is a legitimate medium-level supply-chain concern: if assets.checkra.in is compromised or the maintainer swaps the files, the pinned hashes would catch it, but users must trust those hashes in the PKGBUILD itself. This is a real but modest supply-chain risk typical of binary-repackaging AUR packages — not clearly malicious, but not source-built either. Rating remains medium due to prebuilt binary installation from a non-standard (though project-affiliated) host.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 https://assets.checkra.in/debian/libtvcontrol-dev_${pkgver}-${_pkgrel}_amd64.deb

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads prebuilt binary .deb packages from assets.checkra.in, which is the official distribution host for the checkra1n jailbreak project (checkra.in is the legitimate checkra1n domain). The libtvcontrol library is associated with the checkra1n/lilstevie ecosystem for Apple TV 4K DFU control. The host is not a random personal server — it is the project's own CDN/asset host. However, the binaries are prebuilt and executed/installed directly (shared libraries and tools), and the sha512sums are present and pinned, which mitigates substitution risk. The concern is that these are precompiled binaries from a non-forge host rather than source-built, which is a legitimate medium-level supply-chain concern: if assets.checkra.in is compromised or the maintainer swaps the files, the pinned hashes would catch it, but users must trust those hashes in the PKGBUILD itself. This is a real but modest supply-chain risk typical of binary-repackaging AUR packages — not clearly malicious, but not source-built either. Rating remains medium due to prebuilt binary installation from a non-standard (though project-affiliated) host.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: 1Conan <me@1conan.com>
    
      2
    
      3_pkgrel=1
    
      4
    
      5pkgname=libtvcontrol
    
      6pkgver=0.0.1
    
      7pkgrel=3
    
      8pkgdesc="A library to handle Advanced Breakout for Apple TV 4K. A library to control whether an Apple TV 4K boots to DFU or Normal mode using an Advanced Breakout."
    
      9license=('MIT')
    
      10url="https://github.com/lilstevie/libtvcontrol"
    
      11arch=('x86_64')
    
      12depends=('libusb>=1.0.19')
    
      13options=('!strip')
    
      14source=(
    
      15  https://assets.checkra.in/debian/libtvcontrol-dev_${pkgver}-${_pkgrel}_amd64.deb
    
      16  https://assets.checkra.in/debian/libtvcontrol-tools_${pkgver}-${_pkgrel}_amd64.deb
    
      17  https://assets.checkra.in/debian/libtvcontrol0_${pkgver}-${_pkgrel}_amd64.deb
    
      18)
    
      19noextract=("${source[@]##*/}")
    
      20sha512sums=(
    
      21  '7f6fdd49d3e23fbfc11e0c7e43e15aad75b21072196f25c84a44816c558e4da2a4710ee5bfca2c69bc6fdff83a2e0eeca05834764d258172b8db0d9e4335f6b0'
    
      22  '647b86ba63d358ab2ce8fe062709f8742ac2387735ef5cf905e1e0c2221a787a2b080ea0a4d9c265758c52fc3816f2008d67e8f6b42e297b1e9117706f2dabc0'
    
      23  'e7d4ebd9a65faaeb082a948249272dc7cf7c965531d266b13203b2c687123f8ab5e44ba9cd519c7724982e7c2b7511cab563407ae59cd8a31ce5cac372cb1076'
    
      24)
    
      25
    
      26package() {
    
      27  for file in "${noextract[@]}"; do
    
      28    ar x $file
    
      29    tar -xf data.tar.xz -C $pkgdir
    
      30    rm data.tar.xz control.tar.xz
    
      31  done
    
      32  mv $pkgdir/lib/udev $pkgdir/usr/lib
    
      33  mv $pkgdir/usr/lib/x86_64-linux-gnu/* $pkgdir/usr/lib
    
      34  rmdir $pkgdir/lib $pkgdir/usr/lib/x86_64-linux-gnu
    
      35}
    
      36

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2