lkeyholetv

maintainer tomoaki · 14 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads prebuilt binary archives (LKeyHoleTV-32bits-Ubuntu.zip and LKeyHoleTV-64bits.zip) from oiseyer.com, which is the upstream vendor's own site for KeyHoleTV (a Japanese P2P TV client). The binaries are then installed directly into /opt/LKeyHoleTV and executed. While oiseyer.com appears to be the legitimate upstream distribution host for this software (it is referenced as the official URL), it is a small personal/vendor site rather than a recognized software forge, and the package installs prebuilt closed-source binaries. The integrity check uses only MD5 (weak, collision-prone). The build() step compiles local shared libraries (ALSA plugin, DSP plugin, language module) from source within the zip, but the main lkeyholetv binary itself is a prebuilt executable from the zip. This is a genuine supply-chain concern: if oiseyer.com were compromised or the files swapped, users would execute arbitrary binaries. The risk is real but not evidence of active malice — this is a legitimate medium-severity supply-chain concern for a prebuilt binary from a small unofficial host.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source_i686=("http://www.oiseyer.com/Download/Ubuntu/LKeyHoleTV-32bits-Ubuntu.zip"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads prebuilt binary archives (LKeyHoleTV-32bits-Ubuntu.zip and LKeyHoleTV-64bits.zip) from oiseyer.com, which is the upstream vendor's own site for KeyHoleTV (a Japanese P2P TV client). The binaries are then installed directly into /opt/LKeyHoleTV and executed. While oiseyer.com appears to be the legitimate upstream distribution host for this software (it is referenced as the official URL), it is a small personal/vendor site rather than a recognized software forge, and the package installs prebuilt closed-source binaries. The integrity check uses only MD5 (weak, collision-prone). The build() step compiles local shared libraries (ALSA plugin, DSP plugin, language module) from source within the zip, but the main lkeyholetv binary itself is a prebuilt executable from the zip. This is a genuine supply-chain concern: if oiseyer.com were compromised or the files swapped, users would execute arbitrary binaries. The risk is real but not evidence of active malice — this is a legitimate medium-severity supply-chain concern for a prebuilt binary from a small unofficial host.

PKGBUILD

1 offending line(s) highlighted

      1# Contributor/Maintainer: ilikenwf/Matt Parnell <parwok@gmail.com>
    
      2# Contributor: liliff/Musee U <icelandisbeingcolouredbywrens@gmail.com>
    
      3# Contributor: tomoaki/Tomoaki Hashizaki <thashisaki@yahoo.com>
    
      4pkgname=lkeyholetv
    
      5pkgver=2.3
    
      6pkgrel=4
    
      7pkgdesc="A client for KeyHoleTV, an online television portal that links to Japanese television channels, radio stations, and user-made channels."
    
      8arch=('i686' 'x86_64')
    
      9url="http://www.oiseyer.com/index-e.html"
    
      10license=('custom')
    
      11depends=('alsa-lib' 'gtk2' 'cairo' 'pango' 'libx11' 'libpng')
    
      12optdepends=('sdl: SDL video support')
    
      13provides=('lkeyholetv')
    
      14install=lkeyholetv.install
    
      15source_i686=("http://www.oiseyer.com/Download/Ubuntu/LKeyHoleTV-32bits-Ubuntu.zip"
    
      16	'lkeyholetv.desktop'
    
      17	'lkeyholetv')
    
      18md5sums_i686=('d0ac2fa20a6c7c46ddfc2d95dfcf2a79'
    
      19					'7a6d0d5ca7092918919431796787e574'
    
      20					'ae00db79eb19f3f1515f873852c903d2')
    
      21source_x86_64=("http://www.oiseyer.com/Download/Linux64/LKeyHoleTV-64bits.zip"
    
      22	'lkeyholetv.desktop'
    
      23	'lkeyholetv')
    
      24md5sums_x86_64=('bf5b14afa33d24ed9a002fe86c109c1e'
    
      25         '7a6d0d5ca7092918919431796787e574'
    
      26         'ae00db79eb19f3f1515f873852c903d2')
    
      27_lang='en_US'
    
      28[ "`echo $LANG | cut -d. -f1`" = "ja_JP" ] && _lang='ja_JP'
    
      29
    
      30build()
    
      31{
    
      32	cd ${srcdir}/KeyHoleTV
    
      33}
    
      34
    
      35package()
    
      36{
    
      37	mkdir -p ${pkgdir}/{usr/{bin,share/{applications,pixmaps,licenses/${pkgname}}},opt/LKeyHoleTV} || return 1
    
      38
    
      39	# Audio Interface: ALSA should work
    
      40	cd ${srcdir}/KeyHoleTV/ALSA
    
      41	make || return 1
    
      42	make install || return 1  # The install here copies a .so to .KeyHoleTV.
    
      43
    
      44	# Adding in DSP since it's native
    
      45        cd ${srcdir}/KeyHoleTV/DSP
    
      46        make || return 1
    
      47        make install || return 1  # Similar to the last install
    
      48
    
      49	# Language: en_US by default, ja_JP if locale is ja_JP.*
    
      50	cd ${srcdir}/KeyHoleTV/${_lang}
    
      51	make || return 1
    
      52	make install || return 1 # Similar to the last install.
    
      53
    
      54	# Some cleanup
    
      55	#rm -v ${srcdir}/KeyHoleTV/.KeyHoleTV/KeyHoleTVAddr.dat~ || return 1 #backup file in the 64bit tarball
    
      56	#rm -v ${srcdir}/KeyHoleTV/.KeyHoleTV/ESDObj.so || #esound unsupported/is in AUR
    
      57
    
      58	# Time to install the program itself
    
      59
    
      60	install -d ${srcdir}/KeyHoleTV/.KeyHoleTV ${pkgdir}/opt/LKeyHoleTV/
    
      61	install ${srcdir}/KeyHoleTV/lkeyholetv ${pkgdir}/opt/LKeyHoleTV/
    
      62	cp -r ${srcdir}/KeyHoleTV/.KeyHoleTV ${pkgdir}/opt/LKeyHoleTV/
    
      63	install ${srcdir}/lkeyholetv ${pkgdir}/usr/bin/
    
      64
    
      65	install -m644 ${srcdir}/lkeyholetv.desktop ${pkgdir}/usr/share/applications/ || return 1
    
      66	install -m644 ${srcdir}/KeyHoleTV/Lkeyholetv.png ${pkgdir}/usr/share/pixmaps/Lkeyholetv.png || return 1
    
      67	install -m644 ${srcdir}/KeyHoleTV/License.txt ${pkgdir}/usr/share/licenses/${pkgname}/LICENSE
    
      68}
    
      69

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2