mediaget

maintainer ahmedmoselhi · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary tarball directly from mediaget.com (the vendor's own domain) and installs it wholesale into /opt. While the host is the official vendor site (not a random personal host), the package installs an opaque prebuilt binary blob with only an MD5 checksum (cryptographically weak, collision-prone). There is no source build, no reproducibility, and the binary is executed directly by end users. The wrapper script in 'mediaget' (from AUR sources, not the tarball) is also installed to /usr/bin without inspection. This is a classic prebuilt-binary supply-chain concern: if mediaget.com is compromised or silently replaces the tarball, users get arbitrary code execution. MD5 provides minimal integrity assurance. The vendor being the host slightly reduces but does not eliminate the risk compared to a truly third-party host. Medium severity is appropriate.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("${pkgname}.tar.xz::https://mediaget.com/installer/mediaget_linux_${fixver}.tar.xz" "mediaget.desktop" "mediaget")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt binary tarball directly from mediaget.com (the vendor's own domain) and installs it wholesale into /opt. While the host is the official vendor site (not a random personal host), the package installs an opaque prebuilt binary blob with only an MD5 checksum (cryptographically weak, collision-prone). There is no source build, no reproducibility, and the binary is executed directly by end users. The wrapper script in 'mediaget' (from AUR sources, not the tarball) is also installed to /usr/bin without inspection. This is a classic prebuilt-binary supply-chain concern: if mediaget.com is compromised or silently replaces the tarball, users get arbitrary code execution. MD5 provides minimal integrity assurance. The vendor being the host slightly reduces but does not eliminate the risk compared to a truly third-party host. Medium severity is appropriate.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: mediaget
    
      2
    
      3pkgname=mediaget
    
      4fixver=4317
    
      5pkgver=3.200.${fixver}
    
      6pkgrel=1
    
      7pkgdesc="torrent player torrent-client"
    
      8arch=('i386' 'x86_64')
    
      9url="https://mediaget.com/"
    
      10license=('custom')
    
      11depends=('libidn11' 'gcc-libs' 'vlc')
    
      12makedepends=('imagemagick') 
    
      13source=("${pkgname}.tar.xz::https://mediaget.com/installer/mediaget_linux_${fixver}.tar.xz" "mediaget.desktop" "mediaget")
    
      14md5sums=('165e48b9e87e3c25462c60376cfa1937'
    
      15         'a0d5c36d4c355317fba5eed5ad55880c'
    
      16         '70f419b3a15bee508f8bd1beb3b85342')
    
      17
    
      18  package() {
    
      19	cd "$srcdir"
    
      20          mkdir -p "$pkgdir"/opt
    
      21        cp -r mediaget_linux_${fixver} $pkgdir/opt/mediaget
    
      22       
    
      23	for res in 256 128 64 48 32 24 22 16; do
    
      24		convert "${pkgdir}/opt/${pkgname}/resources/${pkgname}.png" \
    
      25			-resize ${res}x${res} \
    
      26			"${pkgdir}/opt/${pkgname}/resources/${pkgname}_${res}.png"
    
      27	done
    
      28	for res in 16 22 24 32 48 64 128 256; do
    
      29		install -Dm644 "${pkgdir}/opt/${pkgname}/resources/${pkgname}_${res}.png" \
    
      30			"${pkgdir}/usr/share/icons/hicolor/${res}x${res}/apps/${pkgname}.png"
    
      31	done
    
      32       install -Dm755 mediaget.desktop "$pkgdir/usr/share/applications/mediaget.desktop"
    
      33       mkdir "$pkgdir"/usr/bin
    
      34       install -Dm755 mediaget "$pkgdir/usr/bin/mediaget"
    
      35}
    
      36
    
      37

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2