ohmymd-bin

maintainer zxp19821005 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary .deb from 'oss.ohmymd.milchstrabe.com', which is not a well-known official distribution channel (e.g., GitHub releases). The domain 'milchstrabe.com' appears to be the vendor's own CDN/OSS storage, but it is not verifiable as an official, audited host. A prebuilt Electron application binary is executed code, and pulling it from a non-GitHub, non-standard host represents a genuine supply-chain risk: the host could be compromised or the binary silently replaced between checksum updates. The sha256sum provides some protection against tampering at a specific point in time, but does not mitigate the risk of the host being under attacker control or the binary being malicious to begin with. The package is not clearly malicious, but the combination of an unofficial/personal-looking CDN host and an executed binary warrants a MEDIUM rating.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 "${pkgname%-bin}-${pkgver}.deb::https://oss.ohmymd.milchstrabe.com/patch/linux/deb/${pkgname%-bin}_${pkgver}_amd64.deb"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt binary .deb from 'oss.ohmymd.milchstrabe.com', which is not a well-known official distribution channel (e.g., GitHub releases). The domain 'milchstrabe.com' appears to be the vendor's own CDN/OSS storage, but it is not verifiable as an official, audited host. A prebuilt Electron application binary is executed code, and pulling it from a non-GitHub, non-standard host represents a genuine supply-chain risk: the host could be compromised or the binary silently replaced between checksum updates. The sha256sum provides some protection against tampering at a specific point in time, but does not mitigate the risk of the host being under attacker control or the binary being malicious to begin with. The package is not clearly malicious, but the combination of an unofficial/personal-looking CDN host and an executed binary warrants a MEDIUM rating.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2pkgname=ohmymd-bin
    
      3_pkgname='Oh Mymd'
    
      4pkgver=0.6.1
    
      5_electronversion=24
    
      6pkgrel=8
    
      7pkgdesc="A markdown editor,support cloud sync.(Prebuilt version)"
    
      8arch=('x86_64')
    
      9url="https://www.ohmymd.app/"
    
      10_ghurl="https://github.com/1oopstudio/support.ohmymd.app"
    
      11license=("LicenseRef-custom")
    
      12provides=("${pkgname%-bin}=${pkgver}")
    
      13conflicts=("${pkgname%-bin}")
    
      14depends=(
    
      15    "electron${_electronversion}"
    
      16)
    
      17source=(
    
      18    "${pkgname%-bin}-${pkgver}.deb::https://oss.ohmymd.milchstrabe.com/patch/linux/deb/${pkgname%-bin}_${pkgver}_amd64.deb"
    
      19)
    
      20sha256sums=('df6cd51ce12fdf9f262eb74d16b9441fb90141dc78a2e89757404fd544046abb')
    
      21prepare() {
    
      22    bsdtar -xf "${srcdir}/data."*
    
      23    sed -i "s/\"\/opt\/${_pkgname}\/${pkgname%-bin}\"/${pkgname%-bin}/g" "${srcdir}/usr/share/applications/${pkgname%-bin}.desktop"
    
      24    _file_list=(chrome_100_percent.pak chrome_200_percent.pak chrome-sandbox icudtl.dat libEGL.so libffmpeg.so \
    
      25		libGLESv2.so libvk_swiftshader.so libvulkan.so.1 resources.pak vk_swiftshader_icd.json)
    
      26	for _files in "${_file_list[@]}";do
    
      27		ln -sf "/usr/lib/electron${_electronversion}/${_files}" "${srcdir}/usr/share/${_appname}/${_files}"
    
      28	done
    
      29}
    
      30package() {
    
      31    install -Dm755 -d "${pkgdir}/usr/"{bin,lib/"${pkgname%-bin}"}
    
      32    cp -r "${srcdir}/opt/${_pkgname}/"* "${pkgdir}/usr/lib/${pkgname%-bin}"
    
      33    ln -sf "/usr/lib/${pkgname%-bin}/${pkgname%-bin}" "${pkgdir}/usr/bin/${pkgname%-bin}"
    
      34    install -Dm644 "${srcdir}/usr/share/applications/${pkgname%-bin}.desktop" -t "${pkgdir}/usr/share/applications"
    
      35    _icon_sizes=(16x16 32x32 48x48 64x64 128x128 256x256 512x512 1024x1024)
    
      36    for _icons in "${_icon_sizes[@]}";do
    
      37        install -Dm644 "${srcdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname%-bin}.png" \
    
      38            -t "${pkgdir}/usr/share/icons/hicolor/${_icons}/apps"
    
      39    done
    
      40    install -Dm644 "${srcdir}/opt/${_pkgname}/LICENSE"* -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      41}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2