noscribe-cpu-bin

maintainer kmille · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary tarball from drive.switch.ch (a Swiss university cloud storage service, SWITCHdrive), which is not the project's primary GitHub Releases host. The upstream README does link to this host for Linux downloads, so it is not entirely unofficial, but it is a personal/institutional file-sharing service rather than a verifiable release artifact tied to a GitHub release tag. The binary is executed directly (symlinked into /usr/bin) with no source build. The sha256sum provides integrity checking against tampering in transit, but does not guarantee the binary on that host was built from the claimed source. This is a genuine supply-chain concern: a prebuilt binary from a non-canonical host (not GitHub Releases, not a distro mirror) that runs with user privileges. The risk is real but not clearly malicious, consistent with MEDIUM.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("noScribe_0.6.2c_legacy_cpu_linux_amd64.tar.gz::https://drive.switch.ch/index.php/s/HtKDKYRZRNaYBeI/download?path=%2FLinux&files=noScribe_0.6.2c_legacy_cpu_linux_amd64.tar.gz"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary tarball from drive.switch.ch (a Swiss university cloud storage service, SWITCHdrive), which is not the project's primary GitHub Releases host. The upstream README does link to this host for Linux downloads, so it is not entirely unofficial, but it is a personal/institutional file-sharing service rather than a verifiable release artifact tied to a GitHub release tag. The binary is executed directly (symlinked into /usr/bin) with no source build. The sha256sum provides integrity checking against tampering in transit, but does not guarantee the binary on that host was built from the claimed source. This is a genuine supply-chain concern: a prebuilt binary from a non-canonical host (not GitHub Releases, not a distro mirror) that runs with user privileges. The risk is real but not clearly malicious, consistent with MEDIUM.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: kmille < aur at androidloves DOTTT me >
    
      2
    
      3_pkgname=noscribe
    
      4pkgname="${_pkgname}-cpu-bin"
    
      5pkgver=0.6.2
    
      6pkgrel=1
    
      7pkgdesc="cutting edge AI technology for automated audio transcription"
    
      8arch=("x86_64")
    
      9url="https://github.com/kaixxx/noScribe"
    
      10license=("GPL-3.0-only")
    
      11provides=("${_pkgname}")
    
      12conflicts=("${_pkgname}-cuda-bin")
    
      13
    
      14# https://github.com/kaixxx/noScribe/blob/main/README.md#linux
    
      15source=("noScribe_0.6.2c_legacy_cpu_linux_amd64.tar.gz::https://drive.switch.ch/index.php/s/HtKDKYRZRNaYBeI/download?path=%2FLinux&files=noScribe_0.6.2c_legacy_cpu_linux_amd64.tar.gz"
    
      16        "noScribe.desktop")
    
      17sha256sums=("d100f51984fef6b300a6f5e49fac6c4666d06490469535b601ef0ff0c6feb4f5"
    
      18            "b7a503311a68dce0b15266602b57e5f6f5dc5593919023198f48fe102b9bde57")
    
      19
    
      20package() {
    
      21    mkdir -p "$pkgdir/opt/noScribe"
    
      22    cp -r "${srcdir}/noScribe/" "$pkgdir/opt/"
    
      23
    
      24    install -d "$pkgdir/usr/bin"
    
      25    ln -s "/opt/noScribe/noScribe" "$pkgdir/usr/bin/$_pkgname"
    
      26
    
      27    install -Dm 0644 noScribe.desktop "$pkgdir/usr/share/applications/noScribe.desktop"
    
      28}
    
      29
    
      30

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2