patchy-image-editor-bin

maintainer nvidiahater · 0 votes · scanned 2026-08-18 00:03:42.021799

MEDIUM

Why flagged Downloads a prebuilt binary (Flatpak bundle containing a native executable) from rtsoft.com, which is a personal/vendor site not on a standard trust whitelist; the checksum is present but the binary is extracted and installed directly, so a silently swapped file at that URL would result in arbitrary code execution with no further verification.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:23 "PatchyLinux-${pkgver}.flatpak::https://rtsoft.com/files/PatchyLinux.flatpak"

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 72%): Downloads a prebuilt binary (Flatpak bundle containing a native executable) from rtsoft.com, which is a personal/vendor site not on a standard trust whitelist; the checksum is present but the binary is extracted and installed directly, so a silently swapped file at that URL would result in arbitrary code execution with no further verification.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=patchy-image-editor-bin
    
      2pkgver=0.89
    
      3pkgrel=1
    
      4pkgdesc="PSD-oriented image editor repackaged from the upstream Flatpak bundle"
    
      5arch=('x86_64')
    
      6url="https://github.com/SethRobinson/Patchy"
    
      7license=('MIT')
    
      8depends=(
    
      9  'qt6-base'
    
      10  'qt6-declarative'
    
      11  'qt6-imageformats'
    
      12  'qt6-svg'
    
      13)
    
      14makedepends=('ostree')
    
      15optdepends=(
    
      16  'kimageformats: additional image formats, including HEIC/HEIF'
    
      17  'libheif: HEIC/HEIF codec support'
    
      18)
    
      19provides=("patchy-image-editor=${pkgver}")
    
      20conflicts=('patchy-image-editor-git')
    
      21options=('!debug' '!strip')
    
      22source=(
    
      23  "PatchyLinux-${pkgver}.flatpak::https://rtsoft.com/files/PatchyLinux.flatpak"
    
      24  'LICENSE'
    
      25)
    
      26sha256sums=(
    
      27  '3a3714cea39c9700f20e920f0041b4942338bea82be41031bc44ef5f29e28786'
    
      28  'bbc50c8c376e0e5980939be7df6769feed1a30289c7efc6391b204dfb15de88d'
    
      29)
    
      30
    
      31prepare() {
    
      32  local bundle="${srcdir}/PatchyLinux-${pkgver}.flatpak"
    
      33  local commit
    
      34  local repo="${srcdir}/ostree-repo"
    
      35
    
      36  ostree --repo="${repo}" init --mode=bare-user-only
    
      37  ostree --repo="${repo}" static-delta apply-offline "${bundle}"
    
      38  commit="$(ostree --repo="${repo}" static-delta show "${bundle}" | sed -n 's/^To: //p')"
    
      39  [[ -n "${commit}" ]] || {
    
      40    error 'Unable to determine the Flatpak OSTree commit'
    
      41    return 1
    
      42  }
    
      43  ostree --repo="${repo}" checkout --user-mode --union "${commit}" patchy-flatpak
    
      44}
    
      45
    
      46check() {
    
      47  local appdir="${srcdir}/patchy-flatpak/files"
    
      48
    
      49  ldd -r "${appdir}/bin/patchy" > patchy-ldd.log
    
      50  if grep -Eq 'not found|undefined symbol' patchy-ldd.log; then
    
      51    cat patchy-ldd.log
    
      52    return 1
    
      53  fi
    
      54  "${appdir}/bin/patchy" --version | grep -Fx "Patchy ${pkgver}"
    
      55}
    
      56
    
      57package() {
    
      58  local appdir="${srcdir}/patchy-flatpak/files"
    
      59
    
      60  install -Dm755 "${appdir}/bin/patchy" "${pkgdir}/usr/bin/patchy"
    
      61  install -d "${pkgdir}/usr/share"
    
      62  cp -a "${appdir}/share/applications" "${pkgdir}/usr/share/"
    
      63  cp -a "${appdir}/share/icons" "${pkgdir}/usr/share/"
    
      64  cp -a "${appdir}/share/metainfo" "${pkgdir}/usr/share/"
    
      65  cp -a "${appdir}/share/patchy" "${pkgdir}/usr/share/"
    
      66  install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      67}
    
      68

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	MEDIUM	3
2026-08-17 00:18:29	MEDIUM	3
2026-08-16 11:34:30	MEDIUM	3
2026-08-16 11:32:23	MEDIUM	3