lightscribe-labeler

maintainer jose1711 · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD installs a prebuilt binary RPM (containing a Qt GUI application, SimpleLabeler) sourced from a personal/unofficial host (files.jkvinge.net) rather than the official LightScribe/HP distribution servers. The official LightScribe Linux downloads are long gone (HP discontinued the product), so this is a common preservation pattern in AUR, but the binary is still an executed application from a non-official third-party host with only an MD5+SHA256 checksum for integrity. There is no way to verify the binary matches what HP originally shipped. The checksums provide some protection against accidental corruption or casual tampering, but not against a compromised host serving a malicious binary that matches updated checksums in a future PKGBUILD revision. This is a genuine supply-chain concern: a prebuilt i686 binary application installed to /opt and symlinked into /usr/bin, sourced from a personal server. Medium severity is appropriate.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=(http://files.jkvinge.net/packages/lightscribe/lightscribeApplications-1.18.15.1-linux-2.6-intel.rpm)

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD installs a prebuilt binary RPM (containing a Qt GUI application, SimpleLabeler) sourced from a personal/unofficial host (files.jkvinge.net) rather than the official LightScribe/HP distribution servers. The official LightScribe Linux downloads are long gone (HP discontinued the product), so this is a common preservation pattern in AUR, but the binary is still an executed application from a non-official third-party host with only an MD5+SHA256 checksum for integrity. There is no way to verify the binary matches what HP originally shipped. The checksums provide some protection against accidental corruption or casual tampering, but not against a compromised host serving a malicious binary that matches updated checksums in a future PKGBUILD revision. This is a genuine supply-chain concern: a prebuilt i686 binary application installed to /opt and symlinked into /usr/bin, sourced from a personal server. Medium severity is appropriate.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jose Riha <jose1711 gmail com>
    
      2# Contributor: Roman Kyrylych roman[at]archlinux.org
    
      3# Contributor: Vitaliy Berdinskikh ur6lad[at]i.ua
    
      4
    
      5pkgname=lightscribe-labeler
    
      6pkgver=1.18.15.1
    
      7pkgrel=5
    
      8pkgdesc="LightScribe Simple Labeler"
    
      9arch=('i686')
    
      10url="http://www.lightscribe.com/downloadSection/linux/index.aspx?id=815"
    
      11license=('custom')
    
      12depends=('lightscribe' 'libstdc++5' 'libxi' 'libxcursor' 'libpng' 'fontconfig' 'libsm' 'libxrandr')
    
      13source=(http://files.jkvinge.net/packages/lightscribe/lightscribeApplications-1.18.15.1-linux-2.6-intel.rpm)
    
      14options=('!strip')
    
      15
    
      16package() {
    
      17	cd $srcdir
    
      18	cp -R opt $pkgdir
    
      19	find $pkgdir -type d -exec chmod 755 {} \;
    
      20	chmod -x $pkgdir/opt/lightscribeApplications/SimpleLabeler/qt.conf
    
      21
    
      22	mkdir -p $pkgdir/usr/bin
    
      23	cd $pkgdir/usr/bin
    
      24	ln -s ../../opt/lightscribeApplications/SimpleLabeler/SimpleLabeler lightscribe-labeler
    
      25
    
      26	mkdir -p $pkgdir/usr/share/licenses/lightscribe-labeler
    
      27	mv $pkgdir/opt/lightscribeApplications/lightscribeLicense.rtf $pkgdir/usr/share/licenses/lightscribe-labeler/license.rtf
    
      28}
    
      29md5sums=('bf5eb9aa41e3b5f4d0c879591464c1db')
    
      30sha256sums=('2e8cf6887974ac1bd4ee8d415a4160a75b39d31d33394eb7284d7179862fa504')
    
      31

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2