mp3directcut

maintainer TrialnError · 5 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt Windows PE executable (mp3dc239.exe) from ftp.elf.stuba.sk, which is a Slovak university FTP mirror rather than the official upstream host (mpesch3.de). While university mirrors are generally trustworthy and the file is integrity-checked with a sha256sum, the source is not the official vendor distribution point. The .exe is then installed and executed via Wine. If the mirror were compromised or the file substituted, the sha256 check would catch it — but the hash itself was presumably set from this same third-party mirror, not verified against an official vendor-signed release. This is a real, if modest, supply-chain concern: a prebuilt binary from a non-official host that gets executed (via Wine). The sha256 mitigates runtime substitution but does not address whether the originally-fetched binary was authentic. This fits the medium category: executed binary from an unofficial/personal/mirror host without vendor signature verification.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=(http://ftp.elf.stuba.sk/pub/pc/sound/mp3dc${pkgver/.}.exe

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt Windows PE executable (mp3dc239.exe) from ftp.elf.stuba.sk, which is a Slovak university FTP mirror rather than the official upstream host (mpesch3.de). While university mirrors are generally trustworthy and the file is integrity-checked with a sha256sum, the source is not the official vendor distribution point. The .exe is then installed and executed via Wine. If the mirror were compromised or the file substituted, the sha256 check would catch it — but the hash itself was presumably set from this same third-party mirror, not verified against an official vendor-signed release. This is a real, if modest, supply-chain concern: a prebuilt binary from a non-official host that gets executed (via Wine). The sha256 mitigates runtime substitution but does not address whether the originally-fetched binary was authentic. This fits the medium category: executed binary from an unofficial/personal/mirror host without vendor signature verification.

PKGBUILD

1 offending line(s) highlighted

      1# Contributor: Lex Black <autumn-wind@web.de>
    
      2# Contributor: Filip <fila pruda com>
    
      3
    
      4pkgname=mp3directcut
    
      5pkgver=2.39
    
      6pkgrel=1
    
      7pkgdesc="fast audio editor and recorder for mp3 with no need to decompress"
    
      8arch=('i686' 'x86_64')
    
      9url="https://mpesch3.de/index.html"
    
      10license=('FREEWARE')
    
      11depends=(wine)
    
      12depends_i686=(mpg123)
    
      13depends_x86_64=(lib32-mpg123)
    
      14optdepends_i686=('libpulse: PulseAudio plugin')
    
      15optdepends_x86_64=('lib32-libpulse: PulseAudio plugin')
    
      16source=(http://ftp.elf.stuba.sk/pub/pc/sound/mp3dc${pkgver/.}.exe
    
      17        mp3directcut
    
      18        mp3directcut.desktop
    
      19        mp3dcicon.png)
    
      20sha256sums=('6bc9cda080266f0dc5d6304712ff35f8227d37acac19bf49e3320836098c80b0'
    
      21            'd0aa5b02aa6e99a926238747e4a16aae9a7aab6e25612fed0ee46b4cd949c34d'
    
      22            '99249e0b1e64c670aac164be5cf0fda5ba16878ce58ae7180d284abfa6d9df33'
    
      23            '178d703eb9958990d6b53b0da34e91b21bfed20316ad61a25b94c93f2e09739c')
    
      24
    
      25
    
      26package() {
    
      27  #bin
    
      28  install -Dm755 "mp3directcut" "$pkgdir/usr/bin/mp3directcut"
    
      29
    
      30  #app
    
      31  install -d -m755 "$pkgdir/usr/share/mp3directcut"
    
      32  install -m644 "mp3DirectCut.exe" "$pkgdir/usr/share/mp3directcut"
    
      33
    
      34  install -d -m755 "$pkgdir/usr/share/mp3directcut/Languages"
    
      35  cp -r "Languages/." "$pkgdir/usr/share/mp3directcut/Languages"
    
      36
    
      37  #.desktop icon
    
      38  install -Dm644 "mp3directcut.desktop" "$pkgdir/usr/share/applications/mp3directcut.desktop"
    
      39  install -Dm644 "mp3dcicon.png" "$pkgdir/usr/share/pixmaps/mp3directcut.png"
    
      40
    
      41  #docs
    
      42  install -d -m755 "$pkgdir/usr/share/doc/mp3directcut"
    
      43  install -m644 *.txt *.htm "$pkgdir/usr/share/doc/mp3directcut"
    
      44}
    
      45

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2