preloader-signed-bin

MEDIUM

maintainer ninetailedtori 1 votes scanned 2026-10-20 01:29:16.424148

View on AUR

Why flagged

Downloads prebuilt EFI binaries (executable code run at boot) from a personal blog host, and the checksums are dynamically fetched at build time from the same untrusted source, meaning a compromised host could serve both malicious binaries and matching checksums simultaneously, defeating integrity verification entirely.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 'https://blog.hansenpartnership.com/wp-uploads/2013/PreLoader.efi'

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Downloads prebuilt EFI binaries (executable code run at boot) from a personal blog host, and the checksums are dynamically fetched at build time from the same untrusted source, meaning a compromised host could serve both malicious binaries and matching checksums simultaneously, defeating integrity verification entirely.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Toria <ninetailedtori@uwu.gal>
    
      2# Maintainer: nl6720 <nl6720@archlinux.org>
    
      3# Contributor: Tobias Powalowski <tpowa@archlinux.org>
    
      4# shellcheck disable=SC2034,SC2086,SC2128,SC2148,SC2154,SC2164,SC2291
    
      5
    
      6pkgname='preloader-signed-bin'
    
      7pkgver='20130208'
    
      8pkgrel='1'
    
      9pkgdesc='Linux Foundation UEFI secure boot system (prebuilt X64 EFI binaries)'
    
      10url='https://blog.hansenpartnership.com/linux-foundation-secure-boot-system-released/'
    
      11arch=('any')
    
      12license=('GPL' 'LGPL2.1')
    
      13options=('!strip')
    
      14_preloader_checksum=$(curl -s "${url}" | grep "PreLoader.efi" | grep -oP 'md5sum \K[a-f0-9]{32}')
    
      15_hashtool_checksum=$( curl -s "${url}" | grep "HashTool.efi"  | grep -oP 'md5sum \K[a-f0-9]{32}')
    
      16source=(
    
      17    'https://blog.hansenpartnership.com/wp-uploads/2013/PreLoader.efi'
    
      18    'https://blog.hansenpartnership.com/wp-uploads/2013/HashTool.efi'
    
      19)
    
      20md5sums=(
    
      21    "${_preloader_checksum}"
    
      22    "${_hashtool_checksum}"
    
      23)
    
      24
    
      25package() {
    
      26    install -Dm644 -t "${pkgdir}/usr/share/${pkgname}/" "${srcdir}/PreLoader.efi"
    
      27    install -Dm644 -t "${pkgdir}/usr/share/${pkgname}/" "${srcdir}/HashTool.efi"
    
      28}
    
      29

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-20 01:29:16	Medium	3
2026-10-20 01:27:05	Medium	2