multiposter

maintainer shinmera · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged Two genuine supply-chain concerns exist here, beyond the cheaper model's observation. (1) quicklisp.lisp is downloaded from beta.quicklisp.org and has a b2sum, so the file itself is pinned — that part is acceptable. However, (2) the prepare() step then runs that Lisp installer and immediately pulls a third-party dist from http://dist.shirakumo.org/shirakumo.txt over plain HTTP with no integrity check. This dist can supply arbitrary Lisp source/compiled code that is executed during the build() step via ql:quickload. The shirakumo.org dist is the maintainer's own personal distribution server, not an official Quicklisp dist, and it is fetched over unencrypted HTTP with no checksum verification whatsoever. Any MITM or compromise of dist.shirakumo.org could inject malicious Lisp code that runs during the build. This is a real, if not clearly malicious, supply-chain risk: executed code from an unofficial personal host fetched without integrity verification. The rating of MEDIUM is correct.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 "https://beta.quicklisp.org/quicklisp.lisp")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): Two genuine supply-chain concerns exist here, beyond the cheaper model's observation. (1) quicklisp.lisp is downloaded from beta.quicklisp.org and has a b2sum, so the file itself is pinned — that part is acceptable. However, (2) the prepare() step then runs that Lisp installer and immediately pulls a third-party dist from http://dist.shirakumo.org/shirakumo.txt over plain HTTP with no integrity check. This dist can supply arbitrary Lisp source/compiled code that is executed during the build() step via ql:quickload. The shirakumo.org dist is the maintainer's own personal distribution server, not an official Quicklisp dist, and it is fetched over unencrypted HTTP with no checksum verification whatsoever. Any MITM or compromise of dist.shirakumo.org could inject malicious Lisp code that runs during the build. This is a real, if not clearly malicious, supply-chain risk: executed code from an unofficial personal host fetched without integrity verification. The rating of MEDIUM is correct.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Yukari Hafner <shinmera@tymoon.eu>
    
      2pkgname=multiposter
    
      3pkgver=2.1.0
    
      4pkgrel=1
    
      5epoch=0
    
      6pkgdesc="An application to post to multiple services at once."
    
      7arch=('i686' 'x86_64' 'aarch64')
    
      8url="https://github.com/shinmera/multiposter"
    
      9license=('zlib' 'BSD')
    
      10groups=()
    
      11options=("!strip")
    
      12makedepends=('sbcl')
    
      13source=("https://github.com/shinmera/$pkgname/archive/v$pkgver.tar.gz"
    
      14       "https://beta.quicklisp.org/quicklisp.lisp")
    
      15b2sums=('befda3a0a3881bc1713c8dfb9ec9289dd08bea95cc98192b557b72afeae77a62475dfc83d776d03a80bb735ac8e74d2fd4027ff3c0769774fe3cc3d5ce2a3051'
    
      16        '57d0d29e08d77176fea4f01e644fc11bdb96e9efbd132cbb9720192d3b47599f5ce3c6e0307b44c33add06bd70c28004b8efb8968f1d9deb881a2db4ac615772')
    
      17
    
      18prepare() {
    
      19    if [ ! -d "quicklisp" ]; then
    
      20        sbcl --disable-debugger --no-sysinit --no-userinit \
    
      21             --load "quicklisp.lisp" \
    
      22             --eval '(quicklisp-quickstart:install :path "quicklisp/")' \
    
      23             --eval '(ql-dist:install-dist "http://dist.shirakumo.org/shirakumo.txt" :prompt NIL)' \
    
      24             --eval '(quit)'
    
      25    fi
    
      26}
    
      27
    
      28build() {
    
      29    sbcl --disable-debugger --no-sysinit --no-userinit \
    
      30         --load "quicklisp/setup.lisp" \
    
      31         --eval "(asdf:load-asd \"$(pwd)/$pkgname-$pkgver/multiposter.asd\")" \
    
      32         --eval '(ql:quickload :multiposter)' \
    
      33         --eval '(asdf:make :multiposter)' \
    
      34         --eval '(quit)'
    
      35}
    
      36
    
      37package() {
    
      38    mkdir -p "$pkgdir/usr/bin/"
    
      39    cp "$pkgname-$pkgver/multiposter" "$pkgdir/usr/bin/"
    
      40}
    
      41

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2