papilio-designlab

maintainer ivanovp · 3 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads prebuilt binary tarballs (a full IDE with compiled tools, including binaries under hardware/tools/zpu/bin that are chmod'd executable) from dev.ivanov.eu, which is the maintainer's personal server rather than the official Gadgetfactory/Papilio project release infrastructure. The original upstream appears to be defunct (the url points to a web.archive.org snapshot), so the maintainer is self-hosting the binaries. This is a genuine supply-chain concern: if dev.ivanov.eu is compromised or the maintainer's hosting changes, arbitrary binaries could be substituted. The checksums are only MD5 (weak, but present). The package installs and executes these binaries. This fits the classic AUR medium risk pattern: not clearly malicious, but executed binaries from a personal/unofficial host with no strong integrity guarantee.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source_i686=("DesignLab-${pkgver}-linux32.tgz::http://dev.ivanov.eu/uploads/files/papilio-designlab/DesignLab-${pkgver}-linux32.tgz")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads prebuilt binary tarballs (a full IDE with compiled tools, including binaries under hardware/tools/zpu/bin that are chmod'd executable) from dev.ivanov.eu, which is the maintainer's personal server rather than the official Gadgetfactory/Papilio project release infrastructure. The original upstream appears to be defunct (the url points to a web.archive.org snapshot), so the maintainer is self-hosting the binaries. This is a genuine supply-chain concern: if dev.ivanov.eu is compromised or the maintainer's hosting changes, arbitrary binaries could be substituted. The checksums are only MD5 (weak, but present). The package installs and executes these binaries. This fits the classic AUR medium risk pattern: not clearly malicious, but executed binaries from a personal/unofficial host with no strong integrity guarantee.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Peter Ivanov <ivanovp@gmail.com>
    
      2
    
      3pkgname=papilio-designlab
    
      4pkgver=1.0.8
    
      5pkgrel=4
    
      6pkgdesc="It is an IDE specially designed to get you up and running quickly with Soft Processors on the Papilio FPGA boards"
    
      7arch=('x86_64' 'i686')
    
      8url="https://web.archive.org/web/20170825132938/http://forum.gadgetfactory.net/index.php?/files/file/236-papilio-designlab-ide/"
    
      9license=('custom')
    
      10groups=()
    
      11options=(!strip staticlibs)
    
      12PKGEXT='.pkg.tar'
    
      13depends=('java-runtime=8')
    
      14source_i686=("DesignLab-${pkgver}-linux32.tgz::http://dev.ivanov.eu/uploads/files/papilio-designlab/DesignLab-${pkgver}-linux32.tgz")
    
      15source_x86_64=("DesignLab-${pkgver}-linux64.tgz::http://dev.ivanov.eu/uploads/files/papilio-designlab/DesignLab-${pkgver}-linux64.tgz")
    
      16source=('designlab' 
    
      17        'designlab.desktop' 
    
      18        'designlab.png' 
    
      19        'LICENSE')
    
      20install=papilio-designlab.install
    
      21md5sums_i686=('abf1d56ca2957e459455fb861ab3d9d6')
    
      22md5sums_x86_64=('08bf01f7366c5cb85b8f03ef93696cab')
    
      23md5sums+=('95b470f30b17b790c95f983f20fc71f1'
    
      24         'a4d2f7a5a0508106664d158e51f7e034'
    
      25         '7e27108f30b6a253abf907f0b96c56b3'
    
      26         '65c2c2b9df1c372efddfadaa49b76a89')
    
      27
    
      28
    
      29build() {
    
      30  echo "Nothing to build..."
    
      31}
    
      32
    
      33package() {
    
      34  cd "$srcdir/DesignLab-${pkgver}"
    
      35  mkdir -p $pkgdir/usr/share/papilio-designlab
    
      36  msg "Copying files"
    
      37  cp -ax * $pkgdir/usr/share/papilio-designlab
    
      38  msg "Correcting file permissions"
    
      39  find $pkgdir/usr/share/papilio-designlab/hardware/tools -type d -print0|xargs -0 chmod 755
    
      40  find $pkgdir/usr/share/papilio-designlab/hardware/tools/zpu/bin -type f -print0|xargs -0 chmod 755
    
      41#  if test "$CARCH" == x86_64; then
    
      42#      echo "64-bit serial library is used..."
    
      43#      cp -ax ./lib/librxtxSerial64.so $pkgdir/usr/share/papilio-designlab-ide/lib/librxtxSerial.so
    
      44#  fi
    
      45  cd "$srcdir"
    
      46  install -D -m755 designlab "${pkgdir}/usr/bin/designlab"
    
      47  install -D -m644 designlab.desktop "${pkgdir}/usr/share/applications/designlab.desktop"
    
      48  install -D -m644 designlab.png "${pkgdir}/usr/share/pixmaps/designlab.png"
    
      49  install -D -m644 LICENSE "${pkgdir}/usr/share/licenses/$pkgname/LICENSE"
    
      50}
    
      51

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2