pioneer-station

maintainer nikishefu · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt ZIP archive containing a Java application (with a bundled JRE at PioneerStation/jre64/) from Yandex Cloud Storage (storage.yandexcloud.net). While Yandex Cloud is a legitimate cloud provider, this bucket (pioneer-doc.geoscan.ru-static) is not the official Geoscan download infrastructure (docs.geoscan.ru), and there is no way to verify the bucket is controlled by Geoscan rather than a third party. The package installs a bundled JRE binary blob and launches it directly, meaning any compromise of that storage bucket would result in arbitrary code execution on the user's machine. The sha256sum provides integrity but not authenticity — if the bucket were substituted or the object replaced, the hash would change and the build would fail, but the hash itself was presumably taken from the same untrusted source. This is a genuine supply-chain concern: a prebuilt binary with a bundled runtime from a cloud storage URL that cannot be verified as official vendor infrastructure. Rated medium (not high) because there is no evidence of active malice, obfuscation, or substitution — it appears to be a legitimate but poorly-packaged vendor application hosted on cloud storage.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:8 source=("https://storage.yandexcloud.net/pioneer-doc.geoscan.ru-static/dwnlds/software/PioneerStation/PioneerStationLinux.zip")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt ZIP archive containing a Java application (with a bundled JRE at PioneerStation/jre64/) from Yandex Cloud Storage (storage.yandexcloud.net). While Yandex Cloud is a legitimate cloud provider, this bucket (pioneer-doc.geoscan.ru-static) is not the official Geoscan download infrastructure (docs.geoscan.ru), and there is no way to verify the bucket is controlled by Geoscan rather than a third party. The package installs a bundled JRE binary blob and launches it directly, meaning any compromise of that storage bucket would result in arbitrary code execution on the user's machine. The sha256sum provides integrity but not authenticity — if the bucket were substituted or the object replaced, the hash would change and the build would fail, but the hash itself was presumably taken from the same untrusted source. This is a genuine supply-chain concern: a prebuilt binary with a bundled runtime from a cloud storage URL that cannot be verified as official vendor infrastructure. Rated medium (not high) because there is no evidence of active malice, obfuscation, or substitution — it appears to be a legitimate but poorly-packaged vendor application hosted on cloud storage.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Nikita Ardashev <nikitaardasheff at gmail dot com>
    
      2
    
      3pkgname=pioneer-station
    
      4pkgver=0.1
    
      5pkgrel=1
    
      6pkgdesc='Software for working with Geoscan Pioneer products'
    
      7arch=('x86_64')
    
      8source=("https://storage.yandexcloud.net/pioneer-doc.geoscan.ru-static/dwnlds/software/PioneerStation/PioneerStationLinux.zip")
    
      9sha256sums=("b678c12868d51537f1ab4e71c143fd88807bb53764906070c8bdb1eb3b4b551f")
    
      10url="https://docs.geoscan.ru/pioneer/instructions/applications/pioneer_station/pioneer_station_main.html"
    
      11makedepends=('gendesk')
    
      12depends=('libcanberra')
    
      13
    
      14PKG_PATH="/opt/$pkgname"
    
      15WORK_DIR="${XDG_DATA_HOME:-$HOME/.local/share}/$pkgname"
    
      16
    
      17prepare() {
    
      18    gendesk -f -n --pkgname "$pkgname" --pkgdesc "$pkgdesc" --name "Pioneer Station" \
    
      19        --path "$WORK_DIR" \
    
      20        --exec "$PKG_PATH/jre64/bin/java -Dorg.osgi.framework.bundle.parent=ext -jar $PKG_PATH/plugins/org.eclipse.equinox.launcher_1.3.201.v20161025-1711.jar -consoleLog"
    
      21}
    
      22
    
      23package() {
    
      24    install -dm0755 "$pkgdir/opt"
    
      25    cp -a PioneerStation "$pkgdir$PKG_PATH"
    
      26    install -Dm644 "$pkgname.desktop" "$pkgdir/usr/share/applications/$pkgname.desktop"
    
      27}
    
      28
    
      29post_install() {
    
      30    echo "==> If you want to access Pioneer products over USB, add your user to the 'uucp' group:"
    
      31    echo "      \$ sudo usermod -aG uucp \$USER"
    
      32    echo "    and then relogin"
    
      33}
    
      34

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2