ocztoolbox

maintainer Muflone · 12 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The primary executable binary (OCZToolbox) is downloaded from url.muflone.com, a personal domain operated by the maintainer, rather than from OCZ's official servers. This is a real supply-chain concern: the maintainer controls both the PKGBUILD and the binary host, meaning a compromised or malicious maintainer could swap the binary without changing the checksum (by updating both simultaneously). The sha256sums provide integrity verification against the specific files at time of submission, but do not guarantee the files match what OCZ originally distributed. The binary is directly installed to /usr/bin and executed as a privileged tool (with polkit support). This pattern — a closed-source binary hosted on a personal mirror rather than the vendor's official distribution point — is a genuine medium-severity supply-chain risk, not a false positive. The PDF user guide from the same host is lower risk (data only), but the binary itself justifies the medium rating.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("http://url.muflone.com/${pkgname}-${pkgver}_linux.tar.gz"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The primary executable binary (OCZToolbox) is downloaded from url.muflone.com, a personal domain operated by the maintainer, rather than from OCZ's official servers. This is a real supply-chain concern: the maintainer controls both the PKGBUILD and the binary host, meaning a compromised or malicious maintainer could swap the binary without changing the checksum (by updating both simultaneously). The sha256sums provide integrity verification against the specific files at time of submission, but do not guarantee the files match what OCZ originally distributed. The binary is directly installed to /usr/bin and executed as a privileged tool (with polkit support). This pattern — a closed-source binary hosted on a personal mirror rather than the vendor's official distribution point — is a genuine medium-severity supply-chain risk, not a false positive. The PDF user guide from the same host is lower risk (data only), but the binary itself justifies the medium rating.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Muflone http://www.muflone.com/contacts/english/
    
      2# Contributor: Lev Lybin <lev.lybin@gmail.com>
    
      3# Contributor: ajs124 < ajs ÄT online DÖT de >
    
      4
    
      5pkgname=ocztoolbox
    
      6pkgver=4.9.0.634
    
      7pkgrel=4
    
      8pkgdesc="The OCZ Toolbox is designed to update firmware and BIOS, secure erase, view SMART attributes, and view drive details of your OCZ SSD with the click of a button."
    
      9arch=('i686' 'x86_64')
    
      10url="http://ocz.com/consumer/download/firmware"
    
      11license=('custom:OCZ EULA')
    
      12depends=('libxrender' 'fontconfig' 'libxext')
    
      13depends_i686=('libsm')
    
      14optdepends=('polkit: to run OCZToolbox directly from menu')
    
      15source=("http://url.muflone.com/${pkgname}-${pkgver}_linux.tar.gz"
    
      16        "http://url.muflone.com/${pkgname}-user_guide-${pkgver%.*}.pdf"
    
      17        "${pkgname}.desktop"
    
      18        "${pkgname}.png"
    
      19        "LICENSE"
    
      20        "${pkgname}_polkit"
    
      21        "org.archlinux.pkexec.${pkgname}.policy")
    
      22sha256sums=('7ef447dd08706d3065c522787f287e702b29ff9f9de4e07baf5ac0f456b9a140'
    
      23            '2552c53b3b21ad2e44be532a5d19e03c0b6c3c43a9353c33e76d13e6398fbb9a'
    
      24            'ce08e0c547b7fea09276d204a64ff83a3dee61ce1efded1384167c15d6a53ff0'
    
      25            'a5bab72e67578ceabf29e081063b00b1e1c3c2b9419fcbf888f3c24e65cf1035'
    
      26            '499875ee918c6163fefcb1056e2c179945f923a59c8093530bd12f7088a6c8a8'
    
      27            '1b12abcd995037834b2777e6acc6b598ca571379e4d2f443b59f4d4f8a9ba45b'
    
      28            '28ee6a363cfdb1128673cc954a7e84d4a96223f869efb8608fd45e964d61f36f')
    
      29
    
      30package() {
    
      31    if [ "$CARCH" = "x86_64" ]; then
    
      32        _source_arch="64"
    
      33    else
    
      34        _source_arch="32"
    
      35    fi
    
      36
    
      37    install -m 755 -D "OCZToolbox_v${pkgver}_linux/linux${_source_arch}/OCZToolbox" "${pkgdir}/usr/bin/${pkgname}"
    
      38    install -m 644 -D ${pkgname}.desktop "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      39    install -m 644 -D ${pkgname}.png "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
    
      40    install -m 644 -D LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      41    # Install policy file
    
      42    install -m 755 -d "${pkgdir}/usr/share/polkit-1/actions"
    
      43    install -m 644 -t "${pkgdir}/usr/share/polkit-1/actions" "org.archlinux.pkexec.${pkgname}.policy"
    
      44    # Install launcher script
    
      45    install -m 755 -t "${pkgdir}/usr/bin" "${pkgname}_polkit"
    
      46    # Install user guide
    
      47    install -m 755 -d "${pkgdir}/usr/share/doc/${pkgname}"
    
      48    install -m 644 -t "${pkgdir}/usr/share/doc/${pkgname}" "${pkgname}-user_guide-${pkgver%.*}.pdf"
    
      49}
    
      50

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2