pepper-flash-debug

maintainer zrhoffman · 0 votes · base flashplugin-debug · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD installs prebuilt Adobe Flash Player debug binaries (libflashplayer.so, libpepflashplayer.so) sourced from archive.org rather than Adobe's official servers (which are now defunct since Flash EOL). The binaries are executed/loaded code, not data, so the supply-chain concern is real: archive.org is a community-uploaded mirror with no cryptographic provenance guarantee beyond the SHA256 checksums provided. Since Adobe's original download servers are offline, archive.org is a pragmatic but unofficial host. The checksums do provide integrity verification against the specific files, but cannot prove those files match what Adobe originally distributed. The 'time bomb' patch using bbe to modify the .so binary in-place is unusual but the intent (removing the EOL enforcement trigger) is documented and the pattern is well-known in the Flash preservation community. Overall this is a genuine medium-severity supply-chain concern: prebuilt native shared libraries from a non-official host that will be loaded into browsers, with only SHA256 as verification and no way to confirm the archive.org copies are authentic Adobe releases.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=(flash_player_npapi_linux_debug_$pkgver.x86_64.tar.gz::https://archive.org/download/adobe-flash-player-32.0.0.465-retail-debug/flash_player_npapi_linux_debug.x86_64.tar.gz

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD installs prebuilt Adobe Flash Player debug binaries (libflashplayer.so, libpepflashplayer.so) sourced from archive.org rather than Adobe's official servers (which are now defunct since Flash EOL). The binaries are executed/loaded code, not data, so the supply-chain concern is real: archive.org is a community-uploaded mirror with no cryptographic provenance guarantee beyond the SHA256 checksums provided. Since Adobe's original download servers are offline, archive.org is a pragmatic but unofficial host. The checksums do provide integrity verification against the specific files, but cannot prove those files match what Adobe originally distributed. The 'time bomb' patch using bbe to modify the .so binary in-place is unusual but the intent (removing the EOL enforcement trigger) is documented and the pattern is well-known in the Flash preservation community. Overall this is a genuine medium-severity supply-chain concern: prebuilt native shared libraries from a non-official host that will be loaded into browsers, with only SHA256 as verification and no way to confirm the archive.org copies are authentic Adobe releases.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Zach Hoffman <zrhoffman@apache.org>
    
      2
    
      3pkgname=(flashplugin-debug pepper-flash-debug)
    
      4pkgver=32.0.0.465
    
      5pkgrel=3
    
      6pkgdesc="Adobe Flash Player debugger"
    
      7arch=('x86_64')
    
      8url="https://www.adobe.com/support/flashplayer/debug_downloads.html"
    
      9makedepends=('bbe')
    
      10license=('custom' 'LGPL')
    
      11options=('!strip')
    
      12source=(flash_player_npapi_linux_debug_$pkgver.x86_64.tar.gz::https://archive.org/download/adobe-flash-player-32.0.0.465-retail-debug/flash_player_npapi_linux_debug.x86_64.tar.gz
    
      13        flash_player_ppapi_linux_debug_$pkgver.x86_64.tar.gz::https://archive.org/download/adobe-flash-player-32.0.0.465-retail-debug/flash_player_ppapi_linux_debug.x86_64.tar.gz)
    
      14noextract=(${source[@]%::*})
    
      15sha256sums=('7e4c598349e271634b3b190540ac70d7e0f20e7d161cd5359d611e4fd807e712'
    
      16            '63348acd3f3b8f18b89c5abce41a057211b2d08c476a924835b719f2830435d5')
    
      17
    
      18prepare() {
    
      19  local _dir
    
      20  for f in ${noextract[@]}; do
    
      21    _dir=$(grep -Eo '([np]papi)' <<< $f)
    
      22    mkdir -p $_dir
    
      23    tar xfC $f $_dir
    
      24  done
    
      25}
    
      26
    
      27remove_eol_time_bomb() {
    
      28  local plugin_file="$1";
    
      29  shift;
    
      30  # From https://cache.tehsausage.com/flash/defuse.txt
    
      31  time_bomb_trigger='\x40\x46\x3E\x6F\x77\x42'
    
      32  if grep "$(printf "$time_bomb_trigger")" "$plugin_file"; then
    
      33    echo "Found flash player EOL time bomb in ${plugin_file}. Removing it..."
    
      34    bbe -o "${plugin_file}.patched" -e "s/\x00\x00${time_bomb_trigger}/\x00\x00\x00\x00\x00\x00\xF8\x7F/" "$plugin_file"
    
      35    mv "${plugin_file}.patched" "$plugin_file"
    
      36    sync
    
      37    echo "Removed flash player EOL time bomb from ${plugin_file}"
    
      38  else
    
      39    echo "Did not find flash player EOL time bomb in ${plugin_file}."
    
      40  fi
    
      41}
    
      42
    
      43package_flashplugin-debug() {
    
      44  pkgdesc+=" NPAPI"
    
      45  depends=('libxt' 'gtk2' 'nss' 'curl' 'hicolor-icon-theme')
    
      46  optdepends=('libvdpau: GPU acceleration on Nvidia cards')
    
      47  provides=("flashplugin=${pkgver}")
    
      48  conflicts=('flashplugin')
    
      49
    
      50  cd npapi
    
      51  remove_eol_time_bomb libflashplayer.so
    
      52  install -Dm644 libflashplayer.so "$pkgdir/usr/lib/mozilla/plugins/libflashplayer.so"
    
      53  install -Dm644 -t "$pkgdir/usr/share/licenses/$pkgname" license.pdf LGPL/notice.txt
    
      54
    
      55  install -D -t "$pkgdir/usr/bin" usr/bin/flash-player-properties
    
      56  cp -a usr/share/{applications,icons} "$pkgdir/usr/share/"
    
      57
    
      58}
    
      59
    
      60package_pepper-flash-debug() {
    
      61  pkgdesc+=" PPAPI"
    
      62  depends=('gcc-libs')
    
      63  optdepends=('flashplugin-debug: settings utility')
    
      64  provides=("pepper-flash=${pkgver}")
    
      65  conflicts=('pepper-flash')
    
      66
    
      67  cd ppapi
    
      68  remove_eol_time_bomb libpepflashplayer.so
    
      69  install -Dm644 -t "$pkgdir/usr/lib/PepperFlash" manifest.json libpepflashplayer.so
    
      70  install -Dm644 -t "$pkgdir/usr/share/licenses/$pkgname" license.pdf LGPL/notice.txt
    
      71}
    
      72
    
      73# vim:set ts=2 sw=2 et:
    
      74

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2