pingo

maintainer dbermond · 5 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt Windows PE binary (pingo.exe) from css-ig.net, which is the official upstream vendor site for the pingo image optimizer. The URL matches the official project URL listed in the 'url' field, so this is not an unofficial or personal host — it is the canonical distribution point. However, the binary is downloaded without a versioned/stable URL (pingo-win64.zip is a floating/latest URL, not pinned to a specific release), meaning the sha256sum provides integrity only at packaging time and could drift if the upstream file is silently replaced. The sha256sum is present and non-SKIP, which mitigates but does not eliminate the risk. The binary is executed via Wine at runtime. The DLAGENTS override with a custom User-Agent and Referer is unusual but functionally just works around hotlink protection on the vendor's server. The shellutils wrapper script comes from a personal GitHub repo (dbermond/shellutils) with SKIP checksum, which is a minor additional concern. Overall this is a legitimate but slightly risky pattern: a floating binary URL from the official vendor with a pinned hash, plus a SKIP-checksummed helper script from a personal repo. This warrants medium rather than clean due to the floating URL and the SKIP on the shell script.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("pingo-win64-${pkgver}.zip"::'https://css-ig.net/bin/pingo-win64.zip'

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt Windows PE binary (pingo.exe) from css-ig.net, which is the official upstream vendor site for the pingo image optimizer. The URL matches the official project URL listed in the 'url' field, so this is not an unofficial or personal host — it is the canonical distribution point. However, the binary is downloaded without a versioned/stable URL (pingo-win64.zip is a floating/latest URL, not pinned to a specific release), meaning the sha256sum provides integrity only at packaging time and could drift if the upstream file is silently replaced. The sha256sum is present and non-SKIP, which mitigates but does not eliminate the risk. The binary is executed via Wine at runtime. The DLAGENTS override with a custom User-Agent and Referer is unusual but functionally just works around hotlink protection on the vendor's server. The shellutils wrapper script comes from a personal GitHub repo (dbermond/shellutils) with SKIP checksum, which is a minor additional concern. Overall this is a legitimate but slightly risky pattern: a floating binary URL from the official vendor with a pinned hash, plus a SKIP-checksummed helper script from a personal repo. This warrants medium rather than clean due to the floating URL and the SKIP on the shell script.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Daniel Bermond <dbermond@archlinux.org>
    
      2
    
      3pkgname=pingo
    
      4pkgver=1.25.41
    
      5pkgrel=1
    
      6pkgdesc='Lossless and lossy image optimizer for PNG/JPEG/WebP/APNG (uses wine)'
    
      7arch=('any')
    
      8url='https://css-ig.net/pingo'
    
      9license=('LicenseRef-Unknown')
    
      10depends=(
    
      11    'sh'
    
      12    'wine')
    
      13makedepends=(
    
      14    'git')
    
      15options=('!debug' '!strip')
    
      16source=("pingo-win64-${pkgver}.zip"::'https://css-ig.net/bin/pingo-win64.zip'
    
      17        'git+https://github.com/dbermond/shellutils.git')
    
      18noextract=("pingo-win64-${pkgver}.zip")
    
      19sha256sums=('5122b4e80fac86f9057695eb544d293993f222ff14aa4f7c8653e84a4b8339a8'
    
      20            'SKIP')
    
      21
    
      22_useragent="User-Agent: Mozilla/5.0 (X11; Linux ${CARCH}) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.7680.153 Safari/537.36"
    
      23
    
      24DLAGENTS=("https::/usr/bin/curl \
    
      25              -gqb '' -LC - --retry 3 --retry-delay 3 \
    
      26              -H Upgrade-Insecure-Requests:\ 1 \
    
      27              -H ${_useragent// /\\ } \
    
      28              -H Referer:\ https://www.css-ig.net/pingo \
    
      29              --compressed \
    
      30              --output %o \
    
      31              %u")
    
      32
    
      33prepare() {
    
      34    mkdir -p "${pkgname}-${pkgver}"
    
      35    bsdtar -xf "pingo-win64-${pkgver}.zip" -C "${pkgname}-${pkgver}"
    
      36}
    
      37
    
      38package() {
    
      39    install -D -m755 shellutils/image/pingo -t "${pkgdir}/usr/bin"
    
      40    install -D -m644 "${pkgname}-${pkgver}/pingo.exe" -t "${pkgdir}/usr/share/${pkgname}"
    
      41}
    
      42

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2