photon-studio-bin

MEDIUM
maintainer sfs 0 votes scanned 2026-09-17 15:27:54.055002
View on AUR
Why flagged

Downloads a prebuilt proprietary Flatpak binary from 'files06.tchspt.com' (a CDN/mirror for techspot.com, not the official vendor domain tenzen.studio), uses a spoofed referer/user-agent to bypass download restrictions, and installs it directly; while a checksum is provided, the binary comes from unofficial third-party infrastructure rather than the project's own release servers, making it silently swappable by that host.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:37 "Photon-Studio-${pkgver}-linux-x64.flatpak::https://files06.tchspt.com/down/Photon-Studio-${pkgver}-linux-x64.flatpak"
Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 72%): Downloads a prebuilt proprietary Flatpak binary from 'files06.tchspt.com' (a CDN/mirror for techspot.com, not the official vendor domain tenzen.studio), uses a spoofed referer/user-agent to bypass download restrictions, and installs it directly; while a checksum is provided, the binary comes from unofficial third-party infrastructure rather than the project's own release servers, making it silently swappable by that host.

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: sfs sfslinux@gmail.com
2
3pkgname=photon-studio-bin
4pkgver=0.1.9
5pkgrel=4
6pkgdesc="A desktop local-first image editor with layers and native PSD support (Extracted from Flatpak)"
7arch=('x86_64')
8url="https://tenzen.studio/photon/"
9license=('LicenseRef-Photon-Studio')
10
11makedepends=('flatpak')
12depends=(
13 'alsa-lib'
14 'at-spi2-core'
15 'atk'
16 'gdk-pixbuf2'
17 'gtk3'
18 'libcups'
19 'libsecret'
20 'libx11'
21 'libxcomposite'
22 'libxdamage'
23 'libxext'
24 'libxfixes'
25 'libxkbcommon'
26 'libxrandr'
27 'mesa'
28 'nspr'
29 'nss'
30)
31options=('!strip')
32
33DLAGENTS=(
34 'https::/usr/bin/wget --referer=https://www.techspot.com/ --user-agent=Mozilla/5.0\ \(X11\;\ Linux\ x86_64\)\ AppleWebKit/537.36\ Chrome/150.0.0.0\ Safari/537.36 -O %o %u'
35)
36source=(
37 "Photon-Studio-${pkgver}-linux-x64.flatpak::https://files06.tchspt.com/down/Photon-Studio-${pkgver}-linux-x64.flatpak"
38 "photon-studio.png"
39)
40sha256sums=(
41 'c0e5394c500ac95dfa1b5722f3fe9d3170cfd98934d48fed85ebe32114d0f249'
42 'd09bc04240d4fccecc0667fcd263324a104cf3515388a71789e0cfa72bfc50f7'
43)
44
45prepare() {
46 cd "$srcdir"
47
48 mkdir -p "$srcdir/fake-flatpak-home"
49
50 echo "==> Extracting Photon Studio Flatpak..."
51
52 FLATPAK_USER_DIR="$srcdir/fake-flatpak-home" \
53 flatpak install \
54 --user \
55 --bundle \
56 --noninteractive \
57 --assumeyes \
58 --no-deps \
59 "$srcdir/Photon-Studio-${pkgver}-linux-x64.flatpak"
60}
61
62package() {
63 local app_dir
64
65 install -dm755 "$pkgdir/opt/photon-studio"
66 install -dm755 "$pkgdir/usr/bin"
67 install -dm755 "$pkgdir/usr/share/applications"
68
69 install -Dm644 \
70 "$srcdir/photon-studio.png" \
71 "$pkgdir/usr/share/pixmaps/photon-studio.png"
72
73 echo "==> Locating extracted application..."
74
75 app_dir="$(
76 find "$srcdir/fake-flatpak-home" \
77 -type d \
78 -path '*/app/*/*/*/*' \
79 -print -quit
80 )"
81
82 if [[ -z "$app_dir" ]]; then
83 echo "ERROR: Photon Studio application directory not found"
84 exit 1
85 fi
86
87 echo "==> Application directory: $app_dir"
88
89 if [[ ! -d "$app_dir/files/lib/com.tenzen.photon" ]]; then
90 echo "ERROR: Photon Studio files directory not found"
91 exit 1
92 fi
93
94 cp -a --no-preserve=links \
95 "$app_dir/files/lib/com.tenzen.photon/." \
96 "$pkgdir/opt/photon-studio/"
97 #
98 # Desktop file
99 #
100 local desktop_file
101
102 desktop_file="$(
103 find "$srcdir/fake-flatpak-home" \
104 -type f \
105 -name '*.desktop' \
106 -path '*/export/share/applications/*' \
107 -print -quit
108 )"
109
110 if [[ -n "$desktop_file" ]]; then
111 install -Dm644 \
112 "$desktop_file" \
113 "$pkgdir/usr/share/applications/photon-studio.desktop"
114
115 sed -i \
116 's|^Exec=.*|Exec=photon-studio %U|' \
117 "$pkgdir/usr/share/applications/photon-studio.desktop"
118
119 sed -i \
120 's|^Icon=.*|Icon=photon-studio|' \
121 "$pkgdir/usr/share/applications/photon-studio.desktop"
122 else
123 cat > "$pkgdir/usr/share/applications/photon-studio.desktop" <<'EOF'
124[Desktop Entry]
125Name=Photon Studio
126Comment=Desktop image editor with layers and native PSD support
127Exec=photon-studio %U
128Terminal=false
129Type=Application
130Icon=photon-studio
131Categories=Graphics;Photography;
132MimeType=image/jpeg;image/png;image/webp;image/tiff;image/vnd.adobe.photoshop;
133StartupWMClass=Photon Studio
134EOF
135 fi
136
137 #
138 # Exported icons
139 #
140 local icon_dir="$srcdir/fake-flatpak-home"
141
142 if find "$icon_dir" \
143 -type d \
144 -path '*/export/share/icons/*' \
145 -print -quit | grep -q .; then
146
147 install -dm755 "$pkgdir/usr/share/icons"
148
149 find "$icon_dir" \
150 -type d \
151 -path '*/export/share/icons/*' \
152 -exec cp -a {} "$pkgdir/usr/share/icons/" \;
153 fi
154
155 #
156 # Launcher
157 #
158 cat > "$pkgdir/usr/bin/photon-studio" <<'EOF'
159#!/bin/sh
160exec /opt/photon-studio/photon-studio "$@"
161EOF
162
163 chmod 755 "$pkgdir/usr/bin/photon-studio"
164
165install -dm755 "$pkgdir/usr/share/licenses/$pkgname"
166
167cat > "$pkgdir/usr/share/licenses/$pkgname/LICENSE" <<'EOF'
168Photon Studio is proprietary software.
169
170The applicable license terms are provided by the copyright holder,
171Tenzen Studio.
172
173Upstream:
174https://tenzen.studio/photon/
175EOF
176}
177

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 15:27:54 Medium 3
2026-09-17 15:25:49 Medium 3

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion