revit

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The source tarball is fetched from a Google Drive hosting URL using an old-style subdomain-based direct-link pattern (c70f42b85bd16a3cde2c01fb0fba7562a16d22fd.googledrive.com/host/...). This is not the project's official release host (github.com/libyal/reviveit) and the file is a compiled/buildable source archive that gets configured and built. The MD5 checksum is weak and cannot be independently verified against any upstream release page. While this appears to be an old, abandoned forensics tool rather than an active attack, the combination of an unofficial third-party host, a weak checksum, and compiled source code that gets executed during build constitutes a genuine supply-chain concern. The PKGBUILD also uses outdated patterns (return 1, $startdir) suggesting it is very old and unmaintained. The medium rating from the cheaper model is appropriate here.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=(https://c70f42b85bd16a3cde2c01fb0fba7562a16d22fd.googledrive.com/host/0B3fBvzttpiiSXzFYdm55enhGLU0/${pkgname}07-alpha-$pkgver.tar.gz

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The source tarball is fetched from a Google Drive hosting URL using an old-style subdomain-based direct-link pattern (c70f42b85bd16a3cde2c01fb0fba7562a16d22fd.googledrive.com/host/...). This is not the project's official release host (github.com/libyal/reviveit) and the file is a compiled/buildable source archive that gets configured and built. The MD5 checksum is weak and cannot be independently verified against any upstream release page. While this appears to be an old, abandoned forensics tool rather than an active attack, the combination of an unofficial third-party host, a weak checksum, and compiled source code that gets executed during build constitutes a genuine supply-chain concern. The PKGBUILD also uses outdated patterns (return 1, $startdir) suggesting it is very old and unmaintained. The medium rating from the cheaper model is appropriate here.

PKGBUILD

1 offending line(s) highlighted

      1# Contributor: linuxSEAT <--put_my_name_here--@gmail.com>
    
      2# Contributor: Adam Wolk <netprobe@gmail.com>
    
      3
    
      4pkgname=revit
    
      5pkgver=20070804
    
      6pkgrel=3
    
      7pkgdesc='A file carving tool for recovery and forensics'
    
      8url='https://github.com/libyal/reviveit'
    
      9license=('custom')
    
      10arch=('i686' 'x86_64')
    
      11depends=('openssl' 'file')
    
      12optdepends=('libewf: Support for Expert Witness Compression Format (EWF)')
    
      13options=(!libtool)
    
      14source=(https://c70f42b85bd16a3cde2c01fb0fba7562a16d22fd.googledrive.com/host/0B3fBvzttpiiSXzFYdm55enhGLU0/${pkgname}07-alpha-$pkgver.tar.gz 
    
      15        $pkgname.patch)
    
      16
    
      17build() {
    
      18   cd $srcdir/${pkgname}07-$pkgver
    
      19   patch -p1 -i $startdir/$pkgname.patch || return 1
    
      20   ./configure --prefix=/usr --sysconfdir=/etc/$pkgname || return 1
    
      21   make || return 1
    
      22}
    
      23
    
      24package () {
    
      25   cd $srcdir/${pkgname}07-$pkgver
    
      26   make DESTDIR=$pkgdir install || return 1
    
      27
    
      28   install -Dm644 COPYING ${pkgdir}/usr/share/licenses/$pkgname/LICENSE
    
      29   cp etc/* $pkgdir/etc/$pkgname/
    
      30}
    
      31
    
      32md5sums=('3a6edb1f5a581c180ae70ee2f2982f27'
    
      33         '9cfbdd744c6ebaab732cc28d26240b7c')
    
      34

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2