qt-akvis2

maintainer sfs · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD dynamically resolves the package version at build time by querying an S3-compatible bucket listing (akvis-deb.sfo2.cdn.digitaloceanspaces.com), then downloads and installs a prebuilt Debian binary package from that same host. Several real concerns exist: (1) The source URL is constructed dynamically inside prepare() rather than declared in the source=() array, bypassing makepkg's integrity verification entirely — sha256sums=('SKIP') applies to nothing meaningful. (2) The downloaded .deb is a prebuilt binary from a third-party CDN (DigitalOcean Spaces bucket controlled by the AKVIS vendor), not from an official distro mirror or the upstream project's own release infrastructure. (3) The version selection logic (grep -v 5.9.7-7, tail -1) means whatever the latest file in that bucket is gets installed — if the bucket is compromised or the maintainer pushes a malicious update, users get arbitrary code execution with no checksum protection. However, the host appears to be the actual AKVIS software vendor's CDN (alivecolors.com is AKVIS's product site), so this is a vendor-hosted binary rather than a random personal host. The risk is real but not clearly malicious: it's a supply-chain concern due to no integrity verification of an executed binary from a non-standard host with dynamic version resolution.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:19 _pkgver="`wget -q --output-document=- https://akvis-deb.sfo2.cdn.digitaloceanspaces.com/ |tr ">" "\n" |grep "</Key" |grep -v 5.9.7-7 |grep qt-akvis2_ |awk -F_ '{print $2}' |tail -1`"

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 source=("https://akvis-deb.sfo2.cdn.digitaloceanspaces.com/pool/non-free/q/qt-akvis2/qt-akvis2_${_pkgver}_amd64.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 85%): This PKGBUILD dynamically resolves the package version at build time by querying an S3-compatible bucket listing (akvis-deb.sfo2.cdn.digitaloceanspaces.com), then downloads and installs a prebuilt Debian binary package from that same host. Several real concerns exist: (1) The source URL is constructed dynamically inside prepare() rather than declared in the source=() array, bypassing makepkg's integrity verification entirely — sha256sums=('SKIP') applies to nothing meaningful. (2) The downloaded .deb is a prebuilt binary from a third-party CDN (DigitalOcean Spaces bucket controlled by the AKVIS vendor), not from an official distro mirror or the upstream project's own release infrastructure. (3) The version selection logic (grep -v 5.9.7-7, tail -1) means whatever the latest file in that bucket is gets installed — if the bucket is compromised or the maintainer pushes a malicious update, users get arbitrary code execution with no checksum protection. However, the host appears to be the actual AKVIS software vendor's CDN (alivecolors.com is AKVIS's product site), so this is a vendor-hosted binary rather than a random personal host. The risk is real but not clearly malicious: it's a supply-chain concern due to no integrity verification of an executed binary from a non-standard host with dynamic version resolution.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: sfs <sfslinux@gmail.com>
    
      2
    
      3pkgname=qt-akvis2
    
      4pkgver=5.9.7_30
    
      5pkgrel=1
    
      6pkgdesc="Akvis-patched Qt 5.9.7 runtime"
    
      7arch=('x86_64')
    
      8url="https://alivecolors.com"
    
      9license=('GPL3' 'LGPL3' 'FDL' 'custom')
    
      10depends=('double-conversion' 'libinput' 'libproxy' 'libwacom' 'libxkbcommon-x11' 'md4c' 'tslib' 'xcb-util-image' 'xcb-util-keysyms' 'xcb-util-renderutil' 'xcb-util-wm' )
    
      11makedepends=('wget' 'tar' 'libarchive')
    
      12sha256sums=('SKIP')
    
      13
    
      14pkgver() {
    
      15    echo ${_pkgver} |sed 's/-/_/'
    
      16}
    
      17
    
      18prepare() {
    
      19    _pkgver="`wget -q --output-document=- https://akvis-deb.sfo2.cdn.digitaloceanspaces.com/ |tr ">" "\n" |grep "</Key" |grep -v 5.9.7-7 |grep qt-akvis2_ |awk -F_ '{print $2}' |tail -1`"
    
      20    source=("https://akvis-deb.sfo2.cdn.digitaloceanspaces.com/pool/non-free/q/qt-akvis2/qt-akvis2_${_pkgver}_amd64.deb")
    
      21    wget "$source" -O ${pkgname}-${_pkgver}-1.deb &&
    
      22        bsdtar -xf ${pkgname}-${_pkgver}-1.deb &&
    
      23	tar -xf data.tar.xz
    
      24}
    
      25
    
      26package() {
    
      27    cp -dr --no-preserve=ownership usr "${pkgdir}"/
    
      28}
    
      29

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 00:29:32	MEDIUM	3
2026-07-21 00:24:15	MEDIUM	3
2026-07-20 00:19:49	MEDIUM	3
2026-07-19 00:17:08	MEDIUM	3
2026-07-18 00:14:48	MEDIUM	3
2026-07-17 00:06:16	MEDIUM	3
2026-07-16 00:05:41	MEDIUM	3
2026-07-15 00:09:25	MEDIUM	3