mqttfx-bin

maintainer raymondbarbey · 8 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The primary source is a prebuilt .deb fetched via web.archive.org (Wayback Machine) rather than the official vendor host (jensd.de, which appears to be defunct). While a sha256sum is provided, the Wayback Machine is not official release infrastructure and archived snapshots can theoretically be manipulated or the original could have been compromised before archival. The package installs a prebuilt binary blob (a Java application bundled as a .deb) that is executed directly from /opt, which is the core supply-chain concern regardless of the archival host. The log4jscanner/rewrite step is a positive mitigation but does not address the broader issue of an unverifiable binary from a non-official source. This is a genuine medium-severity supply-chain concern: an executed binary from an unofficial/archived host with no way to verify it matches what the original vendor shipped.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 "https://web.archive.org/web/20210514230412/http://www.jensd.de/apps/${_pkgbasename}/${pkgver}/${_pkgbasename}-${pkgver}-64bit.deb"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The primary source is a prebuilt .deb fetched via web.archive.org (Wayback Machine) rather than the official vendor host (jensd.de, which appears to be defunct). While a sha256sum is provided, the Wayback Machine is not official release infrastructure and archived snapshots can theoretically be manipulated or the original could have been compromised before archival. The package installs a prebuilt binary blob (a Java application bundled as a .deb) that is executed directly from /opt, which is the core supply-chain concern regardless of the archival host. The log4jscanner/rewrite step is a positive mitigation but does not address the broader issue of an unverifiable binary from a non-official source. This is a genuine medium-severity supply-chain concern: an executed binary from an unofficial/archived host with no way to verify it matches what the original vendor shipped.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Arctic Ice Studio <development@arcticicestudio.com>
    
      2# Contributor: Arctic Ice Studio <development@arcticicestudio.com>
    
      3# Maintainer: taotieren <admin@taotieren.com>
    
      4
    
      5pkgname=mqttfx-bin
    
      6_pkgbasename=mqttfx
    
      7pkgver=1.7.1
    
      8pkgrel=4
    
      9pkgdesc="A MQTT Client written in Java based on Eclipse Paho"
    
      10arch=("x86_64")
    
      11url="http://mqttfx.org"
    
      12makedepends=(log4jscanner
    
      13#         unzip
    
      14        )
    
      15license=("Apache")
    
      16options=("!strip")
    
      17source=(
    
      18  "https://web.archive.org/web/20210514230412/http://www.jensd.de/apps/${_pkgbasename}/${pkgver}/${_pkgbasename}-${pkgver}-64bit.deb"
    
      19  "${_pkgbasename}.desktop"
    
      20  "${_pkgbasename}.png"
    
      21)
    
      22sha256sums=('6fb14c739cbf8b54a373a0c5c173ef3657c01c675374ded8f0a292c610e549c2'
    
      23            '741674f5b782aa4de0b071b7f49484b74ee2150e38b5d83eb4bd00b172978e2a'
    
      24            '6c1b23755d3b1832ddb643b585d623128cde38e2ef42e7839141cf2106b0a59e')
    
      25
    
      26package() {
    
      27  local bin_name=MQTTfx
    
      28  cd "${srcdir}"
    
      29
    
      30  # Extract the application data into the package directory root
    
      31  tar -xJf data.tar.xz -C "${pkgdir}"
    
      32
    
      33  # Install the binary directory and link into package
    
      34  install -dm755 "${pkgdir}/usr/bin"
    
      35  ln -s "/opt/${bin_name}/${bin_name}" "${pkgdir}/usr/bin/${_pkgbasename}"
    
      36
    
      37  # Install the application logo and desktop launcher
    
      38  install -Dm644 "${_pkgbasename}.png" "${pkgdir}/usr/share/icons/hicolor/128x128/apps/${_pkgbasename}.png"
    
      39  install -Dm644 "${_pkgbasename}.desktop" "${pkgdir}/usr/share/applications/${_pkgbasename}.desktop"
    
      40
    
      41  # Fix log4j
    
      42  cd "${pkgdir}/opt/${bin_name}/app/"
    
      43#   zipinfo lib/log4j-core*.jar | grep Jndi
    
      44  log4jscanner .
    
      45  log4jscanner --rewrite .
    
      46#   zipinfo lib/log4j-core*.jar | grep Jndi
    
      47}
    
      48

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2