msty-studio-bin

maintainer jeryd · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD installs a prebuilt proprietary Electron binary (MstyStudio) downloaded from next-assets.msty.studio, which is the vendor's own CDN/asset host for msty.ai. The domain is consistent with the official product (msty.ai → msty.studio), so this is not a random personal host. However, it is still a prebuilt closed-source binary from a non-GitHub/non-distro host with no reproducibility, and the sha256 checksum provides only integrity (not authenticity) guarantees. The URL uses a query parameter (?ver=) to pin the version but the path says 'latest', which could theoretically serve a different binary if the CDN is compromised or the version mapping changes. This is a standard -bin AUR pattern for proprietary apps (similar to zoom, slack-desktop, etc.) and the risk level is consistent with any other prebuilt proprietary binary AUR package — a real but accepted supply-chain concern, not an active attack.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source=("$filename::https://next-assets.msty.studio/app/latest/linux/MstyStudio_amd64.deb?ver=$pkgver")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD installs a prebuilt proprietary Electron binary (MstyStudio) downloaded from next-assets.msty.studio, which is the vendor's own CDN/asset host for msty.ai. The domain is consistent with the official product (msty.ai → msty.studio), so this is not a random personal host. However, it is still a prebuilt closed-source binary from a non-GitHub/non-distro host with no reproducibility, and the sha256 checksum provides only integrity (not authenticity) guarantees. The URL uses a query parameter (?ver=) to pin the version but the path says 'latest', which could theoretically serve a different binary if the CDN is compromised or the version mapping changes. This is a standard -bin AUR pattern for proprietary apps (similar to zoom, slack-desktop, etc.) and the risk level is consistent with any other prebuilt proprietary binary AUR package — a real but accepted supply-chain concern, not an active attack.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: jeryd leuck <jerydleuck@gmail.com>
    
      2pkgname=msty-studio-bin
    
      3pkgver=2.7.4
    
      4pkgrel=1
    
      5pkgdesc="Desktop AI workflow application (Local/Private)"
    
      6arch=('x86_64')
    
      7url="https://msty.ai/"
    
      8license=('custom:proprietary')
    
      9depends=('alsa-lib' 'at-spi2-core' 'atk' 'cairo' 'dbus' 'expat' 'gcc-libs' 'glib2' 'gtk3' 'hicolor-icon-theme' 'libcups' 'libdrm' 'libx11' 'libxcb' 'libxcomposite' 'libxdamage' 'libxext' 'libxfixes' 'libxi' 'libxkbcommon' 'libxrandr' 'libxrender' 'libxshmfence' 'mesa' 'nss' 'pango')
    
      10optdepends=('cuda: NVIDIA GPU acceleration'
    
      11            'rocm-core: AMD GPU acceleration'
    
      12            'docker: Intel GPU acceleration (via ipex-llm container workaround)'
    
      13            'libpulse: Support for Voice-to-Text and Text-to-Voice features'
    
      14            'ollama: Use system-wide Ollama instead of the bundled version')
    
      15provides=('msty' 'msty-deb' 'msty-rocm-bin' 'msty-studio')
    
      16conflicts=('msty' 'msty-deb' 'msty-bin' 'msty-rocm-bin' 'msty-studio')
    
      17filename="MstyStudio_amd64_${pkgver}.deb"
    
      18source=("$filename::https://next-assets.msty.studio/app/latest/linux/MstyStudio_amd64.deb?ver=$pkgver")
    
      19sha256sums=("ef26a2ee5d764e7a2939b8a580a2b3af94300fbc7773f1b53335c9d450f2a97f")
    
      20
    
      21prepare() {
    
      22  mkdir -p "$srcdir/pkg-contents"
    
      23  bsdtar -xOf "$srcdir/$filename" data.tar.xz | bsdtar -C "$srcdir/pkg-contents" -xv
    
      24}
    
      25
    
      26check() {
    
      27  find "$srcdir/pkg-contents" -path "*/resources" -prune -o -type f -exec sh -c 'file "$1" | grep -q ELF' _ {} \; -print | while read -r elf; do
    
      28    if ldd "$elf" | grep -q "not found"; then
    
      29      echo "Broken dependencies in $elf:"
    
      30      ldd "$elf" | grep "not found"
    
      31      exit 1
    
      32    fi
    
      33  done
    
      34}
    
      35
    
      36package() {
    
      37  # Copy extracted files to pkgdir (do not preserve ownership to support container builds)
    
      38  cp -a --no-preserve=ownership "$srcdir/pkg-contents/." "$pkgdir/"
    
      39
    
      40  # Fix permissions for chrome-sandbox (required for Electron sandboxing)
    
      41  chmod 4755 "$pkgdir/opt/MstyStudio/chrome-sandbox"
    
      42
    
      43  # Fix the .desktop file (Name with space, clean up extra lines)
    
      44  sed -i 's/^Name=.*/Name=Msty Studio/' "$pkgdir/usr/share/applications/MstyStudio.desktop"
    
      45  sed -i '/^exec=mstystudio/d' "$pkgdir/usr/share/applications/MstyStudio.desktop"
    
      46
    
      47  # Create symlinks in /usr/bin for terminal access
    
      48  install -d "$pkgdir/usr/bin"
    
      49  ln -s /opt/MstyStudio/MstyStudio "$pkgdir/usr/bin/msty"
    
      50  ln -s /opt/MstyStudio/MstyStudio "$pkgdir/usr/bin/msty-studio"
    
      51
    
      52  # Install Licenses
    
      53  install -Dm644 "$pkgdir/opt/MstyStudio/LICENSE.electron.txt" "$pkgdir/usr/share/licenses/$pkgname/LICENSE.electron"
    
      54  install -Dm644 "$pkgdir/opt/MstyStudio/LICENSES.chromium.html" "$pkgdir/usr/share/licenses/$pkgname/LICENSES.chromium.html"
    
      55}
    
      56

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2