mqttfx-bin

MEDIUM

maintainer raymondbarbey 8 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The primary source is a prebuilt .deb fetched via web.archive.org (Wayback Machine) rather than the official vendor host (jensd.de, which appears to be defunct). While a sha256sum is provided, the Wayback Machine is not official release infrastructure and archived snapshots can theoretically be manipulated or the original could have been compromised before archival. The package installs a prebuilt binary blob (a Java application bundled as a .deb) that is executed directly from /opt, which is the core supply-chain concern regardless of the archival host. The log4jscanner/rewrite step is a positive mitigation but does not address the broader issue of an unverifiable binary from a non-official source. This is a genuine medium-severity supply-chain concern: an executed binary from an unofficial/archived host with no way to verify it matches what the original vendor shipped.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 "https://web.archive.org/web/20210514230412/http://www.jensd.de/apps/${_pkgbasename}/${pkgver}/${_pkgbasename}-${pkgver}-64bit.deb"

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The primary source is a prebuilt .deb fetched via web.archive.org (Wayback Machine) rather than the official vendor host (jensd.de, which appears to be defunct). While a sha256sum is provided, the Wayback Machine is not official release infrastructure and archived snapshots can theoretically be manipulated or the original could have been compromised before archival. The package installs a prebuilt binary blob (a Java application bundled as a .deb) that is executed directly from /opt, which is the core supply-chain concern regardless of the archival host. The log4jscanner/rewrite step is a positive mitigation but does not address the broader issue of an unverifiable binary from a non-official source. This is a genuine medium-severity supply-chain concern: an executed binary from an unofficial/archived host with no way to verify it matches what the original vendor shipped.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Arctic Ice Studio <development@arcticicestudio.com>
    
      2# Contributor: Arctic Ice Studio <development@arcticicestudio.com>
    
      3# Maintainer: taotieren <admin@taotieren.com>
    
      4
    
      5pkgname=mqttfx-bin
    
      6_pkgbasename=mqttfx
    
      7pkgver=1.7.1
    
      8pkgrel=4
    
      9pkgdesc="A MQTT Client written in Java based on Eclipse Paho"
    
      10arch=("x86_64")
    
      11url="http://mqttfx.org"
    
      12makedepends=(log4jscanner
    
      13#         unzip
    
      14        )
    
      15license=("Apache")
    
      16options=("!strip")
    
      17source=(
    
      18  "https://web.archive.org/web/20210514230412/http://www.jensd.de/apps/${_pkgbasename}/${pkgver}/${_pkgbasename}-${pkgver}-64bit.deb"
    
      19  "${_pkgbasename}.desktop"
    
      20  "${_pkgbasename}.png"
    
      21)
    
      22sha256sums=('6fb14c739cbf8b54a373a0c5c173ef3657c01c675374ded8f0a292c610e549c2'
    
      23            '741674f5b782aa4de0b071b7f49484b74ee2150e38b5d83eb4bd00b172978e2a'
    
      24            '6c1b23755d3b1832ddb643b585d623128cde38e2ef42e7839141cf2106b0a59e')
    
      25
    
      26package() {
    
      27  local bin_name=MQTTfx
    
      28  cd "${srcdir}"
    
      29
    
      30  # Extract the application data into the package directory root
    
      31  tar -xJf data.tar.xz -C "${pkgdir}"
    
      32
    
      33  # Install the binary directory and link into package
    
      34  install -dm755 "${pkgdir}/usr/bin"
    
      35  ln -s "/opt/${bin_name}/${bin_name}" "${pkgdir}/usr/bin/${_pkgbasename}"
    
      36
    
      37  # Install the application logo and desktop launcher
    
      38  install -Dm644 "${_pkgbasename}.png" "${pkgdir}/usr/share/icons/hicolor/128x128/apps/${_pkgbasename}.png"
    
      39  install -Dm644 "${_pkgbasename}.desktop" "${pkgdir}/usr/share/applications/${_pkgbasename}.desktop"
    
      40
    
      41  # Fix log4j
    
      42  cd "${pkgdir}/opt/${bin_name}/app/"
    
      43#   zipinfo lib/log4j-core*.jar | grep Jndi
    
      44  log4jscanner .
    
      45  log4jscanner --rewrite .
    
      46#   zipinfo lib/log4j-core*.jar | grep Jndi
    
      47}
    
      48

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2