magicq-beta

maintainer ask · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary .deb from files.magicq.co.uk, which is the official ChamSys/MagicQ distribution host for their lighting control software. ChamSys is a legitimate UK-based professional lighting console manufacturer, and files.magicq.co.uk is their official software distribution server. The package installs a closed-source proprietary binary directly into /opt/magicq. While the host appears to be the legitimate vendor's own distribution infrastructure (not a personal or unofficial mirror), it is still a prebuilt binary blob from a closed-source vendor with no source code available for inspection. The sha256sum is pinned, which mitigates substitution attacks at the specific version. The concern is real but typical for proprietary software AUR packages: if the vendor's server were compromised or the binary itself contains malicious code, there is no way to verify. This is a standard medium-risk pattern for prebuilt proprietary binaries from a vendor host — not clearly malicious, but not fully auditable either.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("http://files.magicq.co.uk/v${_pkgver}/magicq_ubuntu_v${_pkgver}.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt binary .deb from files.magicq.co.uk, which is the official ChamSys/MagicQ distribution host for their lighting control software. ChamSys is a legitimate UK-based professional lighting console manufacturer, and files.magicq.co.uk is their official software distribution server. The package installs a closed-source proprietary binary directly into /opt/magicq. While the host appears to be the legitimate vendor's own distribution infrastructure (not a personal or unofficial mirror), it is still a prebuilt binary blob from a closed-source vendor with no source code available for inspection. The sha256sum is pinned, which mitigates substitution attacks at the specific version. The concern is real but typical for proprietary software AUR packages: if the vendor's server were compromised or the binary itself contains malicious code, there is no way to verify. This is a standard medium-risk pattern for prebuilt proprietary binaries from a vendor host — not clearly malicious, but not fully auditable either.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Andreas Kling <arch@akling.org>
    
      2# Contributor: Ben Cooper <contactme@bengcooper.co.uk>
    
      3# Contributor: Johan Förberg <johan@forberg.se>
    
      4pkgname=magicq-beta
    
      5pkgver=1.9.8.3
    
      6pkgrel=1
    
      7pkgdesc='Lighting control software from ChamSys'
    
      8arch=(x86_64)
    
      9url='https://chamsyslighting.com/products/magicq'
    
      10license=(custom)
    
      11groups=()
    
      12conflicts=(magicq)
    
      13options=('!strip') # Binaries are already stripped.
    
      14
    
      15_pkgver="${pkgver//[^[:alnum:]]/_}"
    
      16source=("http://files.magicq.co.uk/v${_pkgver}/magicq_ubuntu_v${_pkgver}.deb")
    
      17sha256sums=('eb9daaf1e7053a8104f8a240713bf19b65488b5bb05a8f481573360b642f80c4')
    
      18
    
      19package() {
    
      20    depends=(
    
      21        alsa-lib
    
      22        jack
    
      23        gst-plugins-base
    
      24        gst-plugins-good
    
      25        libcups
    
      26        libgl
    
      27        libx11
    
      28        libxcb
    
      29        udev
    
      30        zlib
    
      31    )
    
      32
    
      33    cd "$pkgdir"
    
      34
    
      35    bsdtar xf "$srcdir/data.tar.xz"
    
      36
    
      37    mkdir -p "$pkgdir/usr/share/licenses/$pkgname"
    
      38    ln -s /opt/magicq/License_Conditions.txt "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      39
    
      40    # We use the system libraries instead of the bundled binaries:
    
      41    # https://secure.chamsys.co.uk/help/documentation/magicq/troubleshooting.html#_linux_magicq_fails_to_start_libgl_error
    
      42    rm -rf opt/magicq/lib/libstdc++.so.6
    
      43    # There are different JACK implementations, their client libraries and daemons are not compatibible with each other 
    
      44    rm -rf opt/magicq/lib/libjack.so.0
    
      45
    
      46    # Magicq expects to be able to write these directories.
    
      47    # The directory list comes from the debian package postinst.
    
      48    chmod 777 opt/magicq
    
      49
    
      50    for dir in log show web thumbs backuparchive convert audio; do
    
      51        mkdir -p "opt/magicq/$dir"
    
      52        chmod -R 777 "opt/magicq/$dir"
    
      53    done
    
      54
    
      55    # Fix permissions from .deb file.
    
      56    find usr etc -type f -exec chmod 644 {} + , -type d -exec chmod 755 {} +
    
      57
    
      58    mkdir -p usr/bin
    
      59    ln -s /opt/magicq/runmagicq.sh usr/bin/magicq
    
      60    ln -s /opt/magicq/runmagichd.sh usr/bin/magichd
    
      61    ln -s /opt/magicq/runmagicvis.sh usr/bin/magicvis
    
      62}
    
      63

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2