mixbus32c9

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt x86_64 binary installer (.run file) from an S3 bucket (eu1.download.solidstatelogic.com) and executes it with 'sh'. The S3 bucket belongs to Solid State Logic (SSL), which acquired Harrison Consoles, so this is plausibly the official vendor distribution host. A sha256sum is provided, which mitigates substitution risk at the point of download. However, the source is a prebuilt binary blob executed directly during the build process — there is no source build, no reproducibility, and the S3 bucket is not the canonical Harrison Audio storefront URL listed in the 'url' field. This is a standard pattern for proprietary DAW AUR packages (similar to other Harrison Mixbus AUR packages), but the combination of an executed binary from a non-primary vendor host (SSL S3 vs harrisonaudio.com) with no way to verify the binary's internal integrity beyond the outer checksum keeps this at medium. The risk is real but not clearly malicious — it is consistent with legitimate vendor packaging practice for a commercial DAW.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("https://s3.eu-west-1.amazonaws.com/eu1.download.solidstatelogic.com/Harrison/Mixbus32C-${pkgver}-x86_64.run")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt x86_64 binary installer (.run file) from an S3 bucket (eu1.download.solidstatelogic.com) and executes it with 'sh'. The S3 bucket belongs to Solid State Logic (SSL), which acquired Harrison Consoles, so this is plausibly the official vendor distribution host. A sha256sum is provided, which mitigates substitution risk at the point of download. However, the source is a prebuilt binary blob executed directly during the build process — there is no source build, no reproducibility, and the S3 bucket is not the canonical Harrison Audio storefront URL listed in the 'url' field. This is a standard pattern for proprietary DAW AUR packages (similar to other Harrison Mixbus AUR packages), but the combination of an executed binary from a non-primary vendor host (SSL S3 vs harrisonaudio.com) with no way to verify the binary's internal integrity beyond the outer checksum keeps this at medium. The risk is real but not clearly malicious — it is consistent with legitimate vendor packaging practice for a commercial DAW.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=mixbus32c9
    
      2pkgver=9.2.172
    
      3pkgrel=2
    
      4pkgdesc="Harrison Consoles Mixbus 32C DAW (Version 9)"
    
      5arch=('x86_64')
    
      6url="https://store.harrisonaudio.com/all-products/mixbus32c"
    
      7license=('EULA')
    
      8groups=('pro-audio')
    
      9depends=('cairo' 'gcc-libs' 'glibc' 'hicolor-icon-theme' 'libsigc++' 'libx11' 'libxext' 'sh' 'taglib' 'libcurl-gnutls' 'dbus' 'fftw' 'fluidsynth' 'fontconfig' 'glib2' 'glibmm' 'jack' 'libarchive' 'liblo' 'libpulse' 'liblrdf' 'libltc' 'libpng' 'libsamplerate' 'libsndfile' 'libusb' 'libwebsockets' 'libxml2' 'lilv' 'pango' 'pangomm' 'readline' 'rubberband' 'vamp-plugin-sdk')
    
      10makedepends=('xdg-user-dirs')
    
      11optdepends=('avldrums.lv2: AVLinux drumkits'
    
      12			'gmsynth.lv2: General MIDI LV2 Synth'
    
      13			'setbfree-lv2: Tonewheel organ'
    
      14			'x42-plugins-lv2: Set of plugins and utilities from the X42 Project')
    
      15source=("https://s3.eu-west-1.amazonaws.com/eu1.download.solidstatelogic.com/Harrison/Mixbus32C-${pkgver}-x86_64.run")
    
      16sha256sums=('cf652a78a15cb7e33c465ca98ff60dc2b064a46c7e4bf8a1de5c6ea6c9a3b235')
    
      17
    
      18## Variables
    
      19_installer="Mixbus32C-${pkgver}-x86_64"
    
      20_app="Mixbus32C_x86_64-$pkgver"
    
      21
    
      22package() {
    
      23	## Create Install Directories
    
      24	mkdir -p "$pkgdir/opt/$pkgname" "$pkgdir/usr/share/applications"
    
      25	## Extract Installer
    
      26	sh "$srcdir/`basename ${_installer}`.run" --tar xf
    
      27	## Extract Bundle
    
      28	tar -xvf "$srcdir/`basename ${_app}`.tar"
    
      29	## Remove LV2 Plugins Provided in Archlinux Repos
    
      30	rm -r "$srcdir/`basename ${_app}`/lib/LV2/avldrums.lv2"
    
      31	rm -r "$srcdir/`basename ${_app}`/lib/LV2/b_synth.lv2"
    
      32	rm -r "$srcdir/`basename ${_app}`/lib/LV2/b_whirl.lv2"
    
      33	rm -r "$srcdir/`basename ${_app}`/lib/LV2/dpl.lv2"
    
      34	rm -r "$srcdir/`basename ${_app}`/lib/LV2/fat1.lv2"
    
      35	rm -r "$srcdir/`basename ${_app}`/lib/LV2/fil4.lv2"
    
      36	rm -r "$srcdir/`basename ${_app}`/lib/LV2/gmsynth.lv2"
    
      37	rm -r "$srcdir/`basename ${_app}`/lib/LV2/meters.lv2"
    
      38	rm -r "$srcdir/`basename ${_app}`/lib/LV2/midifilter.lv2"
    
      39	rm -r "$srcdir/`basename ${_app}`/lib/LV2/stereoroute.lv2"
    
      40	rm -r "$srcdir/`basename ${_app}`/lib/LV2/tuna.lv2"
    
      41	## Remove Uninstall Script
    
      42	rm -r "$srcdir/`basename ${_app}`/bin/Mixbus32C-${pkgver}.uninstall.sh"
    
      43	## Install Mixbus 32C
    
      44	cp -r "$srcdir/`basename ${_app}`/"* "$pkgdir/opt/$pkgname"
    
      45	## Install Desktop File
    
      46	echo "[Desktop Entry]" > "$pkgdir/usr/share/applications/Harrison Mixbus 32C Version 9.desktop"
    
      47	echo "Encoding=UTF-8" >> "$pkgdir/usr/share/applications/Harrison Mixbus 32C Version 9.desktop"
    
      48	echo "Version=1.0" >> "$pkgdir/usr/share/applications/Harrison Mixbus 32C Version 9.desktop"
    
      49	echo "Type=Application" >> "$pkgdir/usr/share/applications/Harrison Mixbus 32C Version 9.desktop"
    
      50	echo "Terminal=false" >> "$pkgdir/usr/share/applications/Harrison Mixbus 32C Version 9.desktop"
    
      51	echo "Exec=/opt/$pkgname/bin/$pkgname" >> "$pkgdir/usr/share/applications/Harrison Mixbus 32C Version 9.desktop"
    
      52	echo "Name=Harrison Mixbus 32C Version 9" >> "$pkgdir/usr/share/applications/Harrison Mixbus 32C Version 9.desktop"
    
      53	echo "Icon=/opt/$pkgname/share/resources/Mixbus32C-icon_256px.png" >> "$pkgdir/usr/share/applications/Harrison Mixbus 32C Version 9.desktop"
    
      54	echo "Comment=Digital Audio Workstation" >> "$pkgdir/usr/share/applications/Harrison Mixbus 32C Version 9.desktop"
    
      55	echo "Categories=AudioVideo;AudioEditing;Audio;Recorder;" >> "$pkgdir/usr/share/applications/Harrison Mixbus 32C Version 9.desktop"
    
      56	## Change permissions of desktop file
    
      57	chmod 644 "$pkgdir/usr/share/applications/Harrison Mixbus 32C Version 9.desktop"
    
      58}
    
      59

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2