poweriso-gui

maintainer RogueGirl · 6 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary tarball (poweriso-x86/x64-1.1.tar.gz) directly from poweriso.com with a SKIP'd checksum, then installs and executes it. While poweriso.com is the official vendor site for PowerISO, the SKIP'd MD5 checksum on the binary means there is no integrity verification at build time — if the domain or the file were ever substituted, the user would silently receive and execute a different binary. This is a genuine supply-chain concern (executed closed-source binary, no checksum), though not an active attack. The vendor host is legitimate (official PowerISO site), which keeps this from being high severity, but the missing checksum on an executed binary warrants medium.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("http://www.poweriso.com/poweriso-x86-${pkgver}.tar.gz"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary tarball (poweriso-x86/x64-1.1.tar.gz) directly from poweriso.com with a SKIP'd checksum, then installs and executes it. While poweriso.com is the official vendor site for PowerISO, the SKIP'd MD5 checksum on the binary means there is no integrity verification at build time — if the domain or the file were ever substituted, the user would silently receive and execute a different binary. This is a genuine supply-chain concern (executed closed-source binary, no checksum), though not an active attack. The vendor host is legitimate (official PowerISO site), which keeps this from being high severity, but the missing checksum on an executed binary warrants medium.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Barfin
    
      2pkgname=poweriso-gui
    
      3pkgver=1.1
    
      4pkgrel=3
    
      5pkgdesc="free GUI program which runs on Linux. It can create, extract, edit, convert all popular image files (including ISO, BIN, DAA, NRG, and etc). It can also burn image files to compact disc or copy compact discs to image files"
    
      6arch=('i686' 'x86_64')
    
      7url="ٰhttp://www.poweriso.com/download-poweriso-for-linux.htm"
    
      8license=('Freeware')
    
      9depends=("freetype2" "hicolor-icon-theme" "libbsd" "qt5-base")
    
      10md5sums=('SKIP'
    
      11         '7d6691d03b3f30f9776935c412d8c18c'
    
      12         '791bb24e8a2db258af3a538a5e2119b2'
    
      13         '62614ce35baa789ecb3ca6f0dd02b695')
    
      14if [ "${CARCH}" = "i686" ]; then
    
      15    source=("http://www.poweriso.com/poweriso-x86-${pkgver}.tar.gz"
    
      16    "poweriso-gui.desktop"
    
      17    "poweriso-gui.svg"
    
      18    "poweriso.sh")
    
      19else
    
      20    source=("http://www.poweriso.com/poweriso-x64-${pkgver}.tar.gz"
    
      21    "poweriso-gui.desktop"
    
      22    "poweriso-gui.svg"
    
      23    "poweriso.sh")
    
      24fi
    
      25package() {
    
      26  mkdir -p "${pkgdir}/usr/share/poweriso-gui"
    
      27  mkdir -p "${pkgdir}/usr/share/icons/hicolor/scalable"
    
      28  mkdir -p "${pkgdir}/usr/bin"
    
      29  cp ${srcdir}/poweriso-*/* "${pkgdir}/usr/share/poweriso-gui"
    
      30  rm -f "${pkgdir}/usr/share/poweriso-gui/poweriso.sh"
    
      31  install -Dm755 "${srcdir}/poweriso.sh" "${pkgdir}/usr/bin/poweriso-gui"
    
      32  install -Dm644 "${srcdir}/poweriso-gui.desktop" "${pkgdir}/usr/share/applications/poweriso-gui.desktop"
    
      33  install -Dm644 "${srcdir}/poweriso-gui.svg" "${pkgdir}/usr/share/icons/hicolor/scalable/apps/poweriso-gui.svg"
    
      34}
    
      35

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2