pixeluvo

maintainer severach · 11 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads prebuilt RPM binaries (containing a compiled executable 'Pixeluvo') directly from the vendor's own domain (pixeluvo.com) and installs them. The checksums are hardcoded and present, which provides some integrity guarantee. However, this is a proprietary closed-source binary from a small commercial vendor's website over plain HTTP (not HTTPS), meaning the download is susceptible to MITM substitution and there is no way to verify the binary's contents beyond the SHA256 hash. The binary is directly executed by end users. This is a classic medium-severity supply-chain concern: not clearly malicious, but an unofficial/unverifiable prebuilt binary installed from a non-standard host over an unencrypted channel. The cheaper model's medium rating is correct here.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:26 curl -s 'http://www.pixeluvo.com/download/' | grep -Fe '.rpm' | sed -n -e 's:^.*downloads/pixeluvo-$[-0-9\.]\+$\.[xi].*$:\1:p' | sed -e 's:-:_:g'

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 source_x86_64=("http://www.pixeluvo.com/downloads/pixeluvo-${pkgver%%_*}-${_pkgrel[x86_64]}.x86_64.rpm")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads prebuilt RPM binaries (containing a compiled executable 'Pixeluvo') directly from the vendor's own domain (pixeluvo.com) and installs them. The checksums are hardcoded and present, which provides some integrity guarantee. However, this is a proprietary closed-source binary from a small commercial vendor's website over plain HTTP (not HTTPS), meaning the download is susceptible to MITM substitution and there is no way to verify the binary's contents beyond the SHA256 hash. The binary is directly executed by end users. This is a classic medium-severity supply-chain concern: not clearly malicious, but an unofficial/unverifiable prebuilt binary installed from a non-standard host over an unencrypted channel. The cheaper model's medium rating is correct here.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer:  Chris Severance aur.severach aATt spamgourmet dott com
    
      2# Contributor: Jay Little <jaylittle@jaylittle.com>
    
      3
    
      4set -u
    
      5pkgname='pixeluvo'
    
      6declare -A _pkgrel=([x86_64]='2' [i686]='1')
    
      7pkgver="1.6.0_${_pkgrel[x86_64]}"
    
      8if [ "${_pkgrel[i686]}" -gt "${_pkgrel[x86_64]}" ]; then
    
      9  pkgver="1.6.0_${_pkgrel[i686]}"
    
      10fi
    
      11pkgrel='1'
    
      12pkgdesc='photo editor with crop, vignette, text, captions, resize, color correction, raw file, filter, warp, layers, mask, and more.'
    
      13arch=('i686' 'x86_64')
    
      14url='http://www.pixeluvo.com'
    
      15license=('custom')
    
      16depends=('qt4' 'openssl' 'libpng' 'zlib')
    
      17install="${pkgname}.install"
    
      18source=('dummyfile')
    
      19source_x86_64=("http://www.pixeluvo.com/downloads/pixeluvo-${pkgver%%_*}-${_pkgrel[x86_64]}.x86_64.rpm")
    
      20source_i686=("http://www.pixeluvo.com/downloads/pixeluvo-${pkgver%%_*}-${_pkgrel[i686]}.i686.rpm")
    
      21sha256sums=('e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855')
    
      22sha256sums_i686=('c305332c1ec4004f85873edd7e1d0e4400419ec213728e216ab8bf00e0b5b52f')
    
      23sha256sums_x86_64=('7e38a5439f4d0b5b787f31078c77f544e04906c995dd41f2afb5e181096f2704')
    
      24
    
      25_vercheck() {
    
      26  curl -s 'http://www.pixeluvo.com/download/' | grep -Fe '.rpm' | sed -n -e 's:^.*downloads/pixeluvo-\([-0-9\.]\+\)\.[xi].*$:\1:p' | sed -e 's:-:_:g'
    
      27}
    
      28
    
      29prepare() {
    
      30  set -u
    
      31  # We installed all the required libraries so we can get rid of their lib and their runner
    
      32  cd "${srcdir}/opt/pixeluvo"/lib*/
    
      33  local _rmdir="$(basename "`pwd`")"
    
      34  cd ..
    
      35  rm -rf "${_rmdir}"
    
      36  cd "${srcdir}"
    
      37  # The binary has no hard coded references to /opt so get rid of it
    
      38  mv 'opt/pixeluvo/bin'/Pixeluvo* "${srcdir}/usr/bin/pixeluvo"
    
      39  rm -rf 'opt/pixeluvo/bin'
    
      40  mv 'opt/pixeluvo' 'usr/share'
    
      41  rmdir 'opt'
    
      42  sed -i -e 's:^\(Icon\)=.*$:\1=/usr/share/pixeluvo/pixeluvo.png:g' 'usr/share/applications/pixeluvo.desktop'
    
      43  set +u
    
      44}
    
      45
    
      46package() {
    
      47  set -u
    
      48  cd "${srcdir}"
    
      49  cp -pr 'usr' "${pkgdir}"
    
      50  set +u
    
      51}
    
      52set +u
    
      53

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 00:29:32	MEDIUM	3
2026-07-21 00:24:15	MEDIUM	3
2026-07-20 00:19:49	MEDIUM	3
2026-07-19 00:17:08	MEDIUM	3
2026-07-18 00:14:48	MEDIUM	3
2026-07-17 00:06:16	MEDIUM	3
2026-07-16 00:05:41	MEDIUM	3
2026-07-15 00:09:25	MEDIUM	3