piskel-bin

maintainer orphaned · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary ZIP from Google Drive (a personal/opaque file host) outside of the source=() array, meaning there is no checksum verification for the actual executable being installed. The Google Drive file ID '1EFo7Ye_rl7bGNr4iehXIgFg4gn2IcWDX' can be swapped at any time by whoever controls that Drive account, and the downloaded binary is a native executable (an Electron/NW.js app 'piskel') that gets installed and run directly. This is a genuine supply-chain risk: an unverified, unchecksumed prebuilt binary from an unofficial host is executed on the user's system. The cookie-handling wget pattern is the standard workaround for Google Drive large-file downloads and is not itself obfuscation, but the lack of integrity verification for the actual payload is the real concern. Severity is medium rather than high because there is no evidence of active malice — it appears to be a legitimate but poorly packaged binary — however the unverifiable, swappable binary from a non-canonical host is a real supply-chain concern.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:21 wget --load-cookies /tmp/piskel_install_cookies.txt "https://docs.google.com/uc?export=download&confirm=$(wget --quiet --save-cookies /tmp/piskel_install_cookies.txt --keep-session-cookies --no-check-certificate 'https://docs.google.com/uc?export=download&id=1EFo7Ye_rl7bGNr4iehXIgFg4gn2IcWDX' -O- | sed -rn 's/.*confirm=([0-9A-Za-z_]+).*/\1\n/p')&id=1EFo7Ye_rl7bGNr4iehXIgFg4gn2IcWDX" -O "Piskel-0.14.0-64bits.zip" && rm -rf /tmp/piskel_install_cookies.txt

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 85%): The PKGBUILD downloads a prebuilt binary ZIP from Google Drive (a personal/opaque file host) outside of the source=() array, meaning there is no checksum verification for the actual executable being installed. The Google Drive file ID '1EFo7Ye_rl7bGNr4iehXIgFg4gn2IcWDX' can be swapped at any time by whoever controls that Drive account, and the downloaded binary is a native executable (an Electron/NW.js app 'piskel') that gets installed and run directly. This is a genuine supply-chain risk: an unverified, unchecksumed prebuilt binary from an unofficial host is executed on the user's system. The cookie-handling wget pattern is the standard workaround for Google Drive large-file downloads and is not itself obfuscation, but the lack of integrity verification for the actual payload is the real concern. Severity is medium rather than high because there is no evidence of active malice — it appears to be a legitimate but poorly packaged binary — however the unverifiable, swappable binary from a non-canonical host is a real supply-chain concern.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Famiu Haque <famiuhaque@gmail.com>
    
      2pkgname=piskel-bin
    
      3pkgver=0.14.0
    
      4pkgrel=1
    
      5pkgdesc="A free online editor for animated sprites & pixel art."
    
      6arch=('x86_64')
    
      7url="https://github.com/piskelapp/piskel"
    
      8license=('Apache')
    
      9makedepends=('unzip' 'imagemagick')
    
      10depends=('gconf' 'gtk2' 'alsa-lib' 'libxss' 'nss' 'libxtst')
    
      11conflicts=('piskel')
    
      12provides=('piskel')
    
      13options=(!strip)
    
      14source=("logo.ico::https://github.com/piskelapp/piskel/raw/master/misc/desktop/logo.ico"
    
      15    "Piskel.desktop")
    
      16sha256sums=('c2f050d7a8e779af36018947a91a4e6f613eeb1d832d96dc979565a71fe3c282'
    
      17            '193985d8343485ee4c4388432e0426d82a29437f9a3ad3fb3bbf19a3793a5f17')
    
      18
    
      19prepare()
    
      20{
    
      21    wget --load-cookies /tmp/piskel_install_cookies.txt "https://docs.google.com/uc?export=download&confirm=$(wget --quiet --save-cookies /tmp/piskel_install_cookies.txt --keep-session-cookies --no-check-certificate 'https://docs.google.com/uc?export=download&id=1EFo7Ye_rl7bGNr4iehXIgFg4gn2IcWDX' -O- | sed -rn 's/.*confirm=([0-9A-Za-z_]+).*/\1\n/p')&id=1EFo7Ye_rl7bGNr4iehXIgFg4gn2IcWDX" -O "Piskel-0.14.0-64bits.zip" && rm -rf /tmp/piskel_install_cookies.txt
    
      22    unzip -o Piskel-0.14.0-64bits.zip
    
      23}
    
      24
    
      25package()
    
      26{
    
      27	install -d "${pkgdir}/opt/"
    
      28    cp -a "${srcdir}/Piskel-0.14.0-64bits" "${pkgdir}/opt/Piskel"
    
      29	chmod +r -R "${pkgdir}/opt/Piskel/"
    
      30	chmod +rx "${pkgdir}/opt/Piskel/lib/"
    
      31	chmod +x "${pkgdir}/opt/Piskel/piskel"
    
      32
    
      33	install -d "${pkgdir}/usr/share/applications"
    
      34	install "${srcdir}/Piskel.desktop" "${pkgdir}/usr/share/applications"
    
      35    chmod +x "${pkgdir}/usr/share/applications/Piskel.desktop"
    
      36
    
      37	install -d "${pkgdir}/usr/bin"
    
      38	ln -s "/opt/Piskel/piskel" "${pkgdir}/usr/bin/piskel"
    
      39
    
      40	convert "${srcdir}/logo.ico" "${srcdir}/logo.png"
    
      41	install -d "${pkgdir}/usr/share/pixmaps"
    
      42	install "${srcdir}/logo-3.png" "${pkgdir}/usr/share/pixmaps/piskel.png"
    
      43}
    
      44

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2