lightscribe

maintainer jose1711 · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary RPM from files.jkvinge.net, which is a personal/unofficial host rather than the official LightScribe vendor servers. The RPM is then extracted and its libraries/binaries are installed directly onto the system. While checksums (md5 and sha256) are present providing some integrity guarantee, the source is not the official vendor and the host could be compromised or the package substituted. The binary is executed/installed (shared libraries and system files from the RPM land in /usr and /etc), making this a genuine supply-chain concern. This is a real medium-risk pattern: unofficial host serving executed binaries with no way to verify the host's trustworthiness beyond the static checksums baked into the PKGBUILD. The package is also very old (i686-only, kernel 2.6 era) and LightScribe as a technology is long discontinued, but that does not change the risk classification.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=(http://files.jkvinge.net/packages/${pkgname}/${pkgname}-${pkgver}-linux-2.6-intel.rpm

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary RPM from files.jkvinge.net, which is a personal/unofficial host rather than the official LightScribe vendor servers. The RPM is then extracted and its libraries/binaries are installed directly onto the system. While checksums (md5 and sha256) are present providing some integrity guarantee, the source is not the official vendor and the host could be compromised or the package substituted. The binary is executed/installed (shared libraries and system files from the RPM land in /usr and /etc), making this a genuine supply-chain concern. This is a real medium-risk pattern: unofficial host serving executed binaries with no way to verify the host's trustworthiness beyond the static checksums baked into the PKGBUILD. The package is also very old (i686-only, kernel 2.6 era) and LightScribe as a technology is long discontinued, but that does not change the risk classification.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jose Riha <jose1711 gmail com>
    
      2# Contributor: Roman Kyrylych roman[at]archlinux.org
    
      3# Contributor: [Vitaliy Berdinskikh](mailto:ur6lad@archlinux.org.ua) aka UR6LAD
    
      4
    
      5pkgname=lightscribe
    
      6pkgver=1.18.24.1
    
      7pkgrel=4
    
      8pkgdesc="LightScribe Host Software for Linux"
    
      9arch=('i686')
    
      10url="http://www.lightscribe.com/downloadsection/linux/index.aspx?id=1372"
    
      11license=('custom')
    
      12depends=('libstdc++5')
    
      13source=(http://files.jkvinge.net/packages/${pkgname}/${pkgname}-${pkgver}-linux-2.6-intel.rpm
    
      14	rc.patch)
    
      15options=('!strip')
    
      16
    
      17build() {
    
      18	cd $srcdir
    
      19
    
      20	rpmextract.sh $pkgname-$pkgver-linux-2.6-intel.rpm 2> /dev/null
    
      21	patch -p1 < rc.patch
    
      22	rm usr/lib/lightscribe/libstdc++.so.5.0.7
    
      23}
    
      24
    
      25package() {
    
      26	cd $srcdir
    
      27
    
      28	mv etc usr $pkgdir
    
      29	install -D -m644 $pkgdir/usr/share/doc/lightscribeLicense.rtf \
    
      30		$pkgdir/usr/share/licenses/lightscribe/license.rtf
    
      31}
    
      32
    
      33md5sums=('a0a216278adb64ce06a0c19d603e8a15'
    
      34         'cec026845ef45c70b65833167b01ce8f')
    
      35sha256sums=('8928a55c5aa0438cde4109c93a30ff2fb8fa62f71855b2df497dd5ef603febf5'
    
      36            'e99613a8378a1dc2f66ab99a669bb6d01933a4b1e9f0f9e3ed55b533b34a84a9')
    
      37

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2