mediapurge

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary .deb from a personal domain (peter-ebe.de) with no versioning in the URL (the filename is static 'mediapurge.deb'), meaning the sha256sum could become stale if the file is silently replaced. The package extracts and installs a precompiled binary directly from this unofficial personal host with no source code available for inspection. This is a genuine supply-chain concern: the domain owner (or anyone who compromises it) can swap the binary at any time, and the static URL means the checksum in the PKGBUILD may not reflect what is actually downloaded in the future. The binary is executed on the user's system (it's installed as an application). This fits the medium severity definition: an executed binary from an unofficial/personal host.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("http://www.peter-ebe.de/ubuntu/repo/binary/mediapurge.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt binary .deb from a personal domain (peter-ebe.de) with no versioning in the URL (the filename is static 'mediapurge.deb'), meaning the sha256sum could become stale if the file is silently replaced. The package extracts and installs a precompiled binary directly from this unofficial personal host with no source code available for inspection. This is a genuine supply-chain concern: the domain owner (or anyone who compromises it) can swap the binary at any time, and the static URL means the checksum in the PKGBUILD may not reflect what is actually downloaded in the future. The binary is executed on the user's system (it's installed as an application). This fits the medium severity definition: an executed binary from an unofficial/personal host.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Tobias Müller <mintuser17 at gmail dot com>
    
      2
    
      3pkgname=mediapurge
    
      4pkgver=7.14
    
      5pkgrel=1
    
      6pkgdesc="Mediapurge is a media management system. "
    
      7arch=('x86_64')
    
      8url='http://www.peter-ebe.de/#'
    
      9license=("custom:${pkgname}")
    
      10depends=('ffmpeg'
    
      11         'gtk2')
    
      12source=("http://www.peter-ebe.de/ubuntu/repo/binary/mediapurge.deb")
    
      13sha256sums=('4bc0cdff35f5d7e1aca60364d22b609add7a08e532e0a0bad4db6ace282dd528')
    
      14
    
      15package() {
    
      16  tar xvf data.tar.xz -C "${pkgdir}/"
    
      17  chmod -R 755 ${pkgdir}/
    
      18}
    
      19

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2