rastertoezpl

maintainer orphaned · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads prebuilt binary tarballs (containing a CUPS filter binary 'rastertoezpl' that gets installed to /usr/lib/cups/filter/) from an AWS S3 bucket owned by Godex (godex.s3-accelerate.amazonaws.com). The URLs use opaque keys rather than version-named paths, making it impossible to verify these are official vendor releases by URL inspection alone. The binary is executed by CUPS as a filter for every print job. While the S3 bucket appears to belong to the official Godex vendor (godex prefix, godexintl.com URL), the source is not the vendor's primary website and the URL structure is non-standard/opaque. MD5 checksums are present but MD5 is cryptographically weak. The core concern is a prebuilt binary from a non-canonical host installed into a privileged CUPS filter path — this is a genuine medium supply-chain risk regardless of the checksum quality, as there is no way to verify the binary's provenance or integrity beyond a weak hash.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source_i686=("rastertoezpl-i686-${pkgver}.tar.gz::https://godex.s3-accelerate.amazonaws.com/Y,WSe2fgwzUgB,SSXAw_jw.file?v01")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads prebuilt binary tarballs (containing a CUPS filter binary 'rastertoezpl' that gets installed to /usr/lib/cups/filter/) from an AWS S3 bucket owned by Godex (godex.s3-accelerate.amazonaws.com). The URLs use opaque keys rather than version-named paths, making it impossible to verify these are official vendor releases by URL inspection alone. The binary is executed by CUPS as a filter for every print job. While the S3 bucket appears to belong to the official Godex vendor (godex prefix, godexintl.com URL), the source is not the vendor's primary website and the URL structure is non-standard/opaque. MD5 checksums are present but MD5 is cryptographically weak. The core concern is a prebuilt binary from a non-canonical host installed into a privileged CUPS filter path — this is a genuine medium supply-chain risk regardless of the checksum quality, as there is no way to verify the binary's provenance or integrity beyond a weak hash.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Miguel Revilla <yo at miguelrevilla dot com>
    
      2
    
      3pkgname='rastertoezpl'
    
      4pkgver=1.1.4
    
      5pkgrel=1
    
      6pkgdesc='CUPS driver for GODEX printers'
    
      7arch=('i686' 'x86_64')
    
      8depends=('cups')
    
      9url="http://www.godexintl.com"
    
      10license=('custom')
    
      11source_i686=("rastertoezpl-i686-${pkgver}.tar.gz::https://godex.s3-accelerate.amazonaws.com/Y,WSe2fgwzUgB,SSXAw_jw.file?v01")
    
      12source_x86_64=("rastertoezpl-x86_64-${pkgver}.tar.gz::https://godex.s3-accelerate.amazonaws.com/VQzwWnstvY7Mllo24tPuEw.file?v01")
    
      13md5sums_i686=('70d008319d571883925031c1a81bb60f')
    
      14md5sums_x86_64=('6cf78da6f4d9a3619778016beee73c7b')
    
      15
    
      16package() {
    
      17
    
      18	if [ "$CARCH" = "i686" ] ; then
    
      19		_srcdir="GoDEXdriver-${pkgver}(x86)"
    
      20	elif [ "$CARCH" = "x86_64" ] ; then
    
      21		_srcdir="GoDEXdriver-${pkgver}(x64)"
    
      22	else
    
      23		echo "Arch not supported: $CARCH"
    
      24		exit 1
    
      25	fi
    
      26
    
      27	cd "${srcdir}/${_srcdir}"
    
      28
    
      29	mkdir -p ${pkgdir}/usr/lib/cups/filter/
    
      30	cp rastertoezpl ${pkgdir}/usr/lib/cups/filter/
    
      31
    
      32	mkdir -p ${pkgdir}/usr/share/ppd/godex/
    
      33	cp ppd/*.ppd ${pkgdir}/usr/share/ppd/godex/
    
      34
    
      35	mkdir -p ${pkgdir}/usr/share/doc/rastertoezpl/
    
      36	cp ChangeLog ${pkgdir}/usr/share/doc/rastertoezpl/
    
      37
    
      38	mkdir -p ${pkgdir}/usr/share/cups/usb/
    
      39	echo "# GoDEX Printer:" > ${pkgdir}/usr/share/cups/usb/godex
    
      40	echo "0x195f 0x0001 unidir no-reattach" >> ${pkgdir}/usr/share/cups/usb/godex
    
      41}
    
      42

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2