pizarra-bin

maintainer categulario · 4 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads and installs a prebuilt binary from a personal domain (pizarra.categulario.xyz) rather than from an official forge release (e.g., GitLab releases for gitlab.com/categulario/pizarra-gtk). The maintainer appears to be the upstream author (same handle 'categulario'), so this is likely self-hosted releases rather than a third-party attack, but the host is still a personal domain with no institutional trust anchor. A sha256sum is present, which mitigates substitution risk somewhat, but if the personal domain is compromised the attacker controls both the binary and could update the PKGBUILD to change the checksum. The binary is installed directly to /usr/bin and executed by users, making the impact of any compromise high. This is a genuine medium-severity supply-chain concern: not clearly malicious, but an unofficial/personal host serving an executed binary.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("https://pizarra.categulario.xyz/releases/any-linux/pizarra-$pkgver-$arch.tar.gz")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 75%): The PKGBUILD downloads and installs a prebuilt binary from a personal domain (pizarra.categulario.xyz) rather than from an official forge release (e.g., GitLab releases for gitlab.com/categulario/pizarra-gtk). The maintainer appears to be the upstream author (same handle 'categulario'), so this is likely self-hosted releases rather than a third-party attack, but the host is still a personal domain with no institutional trust anchor. A sha256sum is present, which mitigates substitution risk somewhat, but if the personal domain is compromised the attacker controls both the binary and could update the PKGBUILD to change the checksum. The binary is installed directly to /usr/bin and executed by users, making the impact of any compromise high. This is a genuine medium-severity supply-chain concern: not clearly malicious, but an unofficial/personal host serving an executed binary.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Abraham Toriz <categulario at gmail dot com>
    
      2pkgname=pizarra-bin
    
      3pkgver=1.7.5
    
      4pkgrel=1
    
      5pkgdesc='A free-hand vector drawing application with infinite canvas (binary version)'
    
      6arch=('x86_64')
    
      7url='https://gitlab.com/categulario/pizarra-gtk'
    
      8license=('GPL3')
    
      9depends=('gtk3')
    
      10provides=('pizarra')
    
      11conflicts=('pizarra')
    
      12source=("https://pizarra.categulario.xyz/releases/any-linux/pizarra-$pkgver-$arch.tar.gz")
    
      13sha256sums=('353667df11d61b974e7abb446908bb728d8e52c4d366ec3b7a59e74caf38a947')
    
      14
    
      15package() {
    
      16    cd "$srcdir/build"
    
      17    install -Dm755 pizarra "$pkgdir"/usr/bin/pizarra
    
      18    install -Dm644 pizarra.desktop "$pkgdir"/usr/share/applications/pizarra.desktop
    
      19    install -Dm644 pizarra.svg "$pkgdir"/usr/share/icons/hicolor/scalable/apps/pizarra.svg
    
      20
    
      21    install -Dm644 README.md "$pkgdir"/usr/share/doc/pizarra/README.md
    
      22    install -Dm644 LICENSE "$pkgdir"/usr/share/doc/pizarra/LICENSE
    
      23    install -Dm644 CHANGELOG.md "$pkgdir"/usr/share/doc/pizarra/changelog
    
      24}
    
      25
    
      26

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2