r-linux

maintainer mrxx · 23 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads prebuilt proprietary x86 binaries (.deb files) from r-studio.com, which is the official vendor site for R-TT's R-Studio/R-Linux products (r-tt.com is the product page, r-studio.com is the download host — both are operated by the same vendor). The sha512sums are pinned for both architecture variants, providing integrity verification. However, the binaries are closed-source, precompiled executables installed directly into /opt, with no source build. This is a legitimate medium-risk pattern: not an attack, but a supply-chain concern because users must trust the vendor's binary and the pinned hashes. The host is the official vendor download server, not a random personal host, which reduces (but does not eliminate) the concern. The PKGBUILD also modifies the extracted launcher script and injects elevate.sh, which is a local file included in the source array with a pinned hash — this is acceptable. Overall this is a standard 'binary repackage from official vendor' pattern common in AUR, rated medium due to executed closed-source binaries rather than any active malice.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source_i686=("$pkgname-$pkgver-i386.deb::"https://www.r-studio.com/downloads/RLinux6_i386.deb)

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads prebuilt proprietary x86 binaries (.deb files) from r-studio.com, which is the official vendor site for R-TT's R-Studio/R-Linux products (r-tt.com is the product page, r-studio.com is the download host — both are operated by the same vendor). The sha512sums are pinned for both architecture variants, providing integrity verification. However, the binaries are closed-source, precompiled executables installed directly into /opt, with no source build. This is a legitimate medium-risk pattern: not an attack, but a supply-chain concern because users must trust the vendor's binary and the pinned hashes. The host is the official vendor download server, not a random personal host, which reduces (but does not eliminate) the concern. The PKGBUILD also modifies the extracted launcher script and injects elevate.sh, which is a local file included in the source array with a pinned hash — this is acceptable. Overall this is a standard 'binary repackage from official vendor' pattern common in AUR, rated medium due to executed closed-source binaries rather than any active malice.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: mrxx <mrxx at cyberhome dot at>
    
      2# Contributor: Jean Lucas <jean@4ray.co>
    
      3
    
      4pkgname=r-linux
    
      5pkgver=6.5.191754
    
      6pkgrel=1
    
      7pkgdesc="File recovery utility for the ext2/ext3/ext4 file system"
    
      8arch=('i686' 'x86_64')
    
      9url="https://www.r-tt.com/data_recovery_linux/"
    
      10license=('custom')
    
      11depends=('xorg-xhost')
    
      12optdepends=('gksu' 'kdesu' 'polkit')
    
      13source_i686=("$pkgname-$pkgver-i386.deb::"https://www.r-studio.com/downloads/RLinux6_i386.deb)
    
      14source_x86_64=("$pkgname-$pkgver-x64.deb::https://www.r-studio.com/downloads/RLinux6_x64.deb")
    
      15source=('rlinux.sh' 'elevate.sh')
    
      16sha512sums=('01ea9c642f46a35a9b90896a7b93c3b03a5256100d6a1443286a5da58fcdca0c49447a48a2a6c335ab334cb53965ed4269381ecdda94af39d2f3c8542ce2cbae'
    
      17            'a98ab704660e17f062ffa75a4e326da600fb7f6af4518dadfbb7e42673b86a521e825ab81dd28995fcf375bd609fe1522a8a48d884fe7433c8b4c2022307cb32')
    
      18sha512sums_i686=('4fa85dcdaa37fcb36c1b5fa401c589aa89dd27121d15706bb06c1c0542bafc1acac085bbff6c14e1aae108307d8825baf2f483fa5a2b8da72d5afbf5272cb919')
    
      19sha512sums_x86_64=('f2ffff9d531c32154167742454b06392eecf8e93c6754879e1f8dd69fd81b8cccf1d8c00341644bf096e13230d7499f68536adde6ea8be6e28248760181ba177')
    
      20
    
      21prepare() {
    
      22    bsdtar xf data.tar.gz
    
      23}
    
      24
    
      25package() {
    
      26  install -d "$pkgdir"/opt
    
      27  install -d "$pkgdir"/usr/share/applications
    
      28
    
      29  install -Dm 755 rlinux.sh "$pkgdir"/usr/bin/rlinux
    
      30  cp -r usr/local/R-Linux "$pkgdir"/opt/
    
      31
    
      32  head -n -12 usr/local/R-Linux/bin/rlinux >"$pkgdir"/opt/R-Linux/bin/rlinux
    
      33  cat elevate.sh >>"$pkgdir"/opt/R-Linux/bin/rlinux
    
      34  sed -i 's|/usr/local|/opt|' "$pkgdir"/opt/R-Linux/bin/rlinux
    
      35
    
      36  cd usr/local/R-Linux/share
    
      37  install -Dm 644 logo_48.png "$pkgdir"/usr/share/pixmaps/rtt-rlinux.png
    
      38  sed 's|/usr/local|/opt|' rtt-rlinux.desktop >"$pkgdir"/usr/share/applications/rtt-rlinux.desktop
    
      39  install -Dm644 rln_viewer.txt "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      40}
    
      41

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2