room-arranger

maintainer ChrisLane · 10 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The primary source is a prebuilt binary tarball (Linux x86_64 executable) downloaded from Backblaze B2 cloud storage (f000.backblazeb2.com/file/rooarr/), which is a personal/vendor-controlled bucket rather than an official distribution channel like the vendor's own domain (roomarranger.com). The binary is installed directly to /opt and executed, so any compromise of that B2 bucket would result in arbitrary code execution on the user's system. The sha512sums provide some integrity protection, but cannot protect against a targeted swap of the upstream file at the same URL. This is a legitimate supply-chain concern: the vendor's actual download page may use this B2 bucket legitimately, but it cannot be independently verified as an official release artifact. The pattern matches the classic medium-risk scenario of an executed binary from a non-canonical host.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("https://f000.backblazeb2.com/file/rooarr/rooarr${pkgver//./}-linux64.tar.gz"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The primary source is a prebuilt binary tarball (Linux x86_64 executable) downloaded from Backblaze B2 cloud storage (f000.backblazeb2.com/file/rooarr/), which is a personal/vendor-controlled bucket rather than an official distribution channel like the vendor's own domain (roomarranger.com). The binary is installed directly to /opt and executed, so any compromise of that B2 bucket would result in arbitrary code execution on the user's system. The sha512sums provide some integrity protection, but cannot protect against a targeted swap of the upstream file at the same URL. This is a legitimate supply-chain concern: the vendor's actual download page may use this B2 bucket legitimately, but it cannot be independently verified as an official release artifact. The pattern matches the classic medium-risk scenario of an executed binary from a non-canonical host.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Chris Lane <aur at chrislane dot com>
    
      2# Contributor: Bernhard Landauer <oberon@manjaro.org>
    
      3# Contributor: Jason Scurtu (scujas) <jscurtu@gmail.com>
    
      4
    
      5pkgname=room-arranger
    
      6_pkgname=rooarr
    
      7pkgver=11.0.0
    
      8pkgrel=1
    
      9pkgdesc="3D room / apartment / floor planner with simple user interface."
    
      10arch=('x86_64')
    
      11license=('custom')
    
      12url='https://www.roomarranger.com'
    
      13depends=('hicolor-icon-theme' 'openssl')
    
      14source=("https://f000.backblazeb2.com/file/rooarr/rooarr${pkgver//./}-linux64.tar.gz"
    
      15        "${_pkgname}_run.sh"
    
      16        "${pkgname//-/}.desktop")
    
      17sha512sums=('5e0fbbd62c67d07d23245bbbd1d8be655323678d8525cf2c111bf248a12dffe314aa989cfb0c9032cef5dde918b07ad28e3fc179bc566510dc0362e657bfa299'
    
      18            '4fb685442c7527ae8494cc700c6e06dd37cdf1e21d3beb1b2479e98840329b612ec8ffb2f6b5e8e43a7cfda57800b2aee2b8bf0e1608f5fb510f68558be19663'
    
      19            '73799a47527485f0b2102ee1eba33ad8e86bf3b269697588390064467323e4ed44fc49d8b6a18b113d0a62ddf81178e8b0dbca2f321d4c52016ee2d8afeb165d')
    
      20
    
      21package() {
    
      22  cd rooarr-setup/rooarr-bin
    
      23
    
      24  # Copy icons and mimetypes
    
      25  ICONDIR=$pkgdir/usr/share/icons/hicolor
    
      26
    
      27  for i in 16 32 48 64 128 256 512; do
    
      28    install -Dm644 icons/icon_${i}x$i.png $ICONDIR/${i}x$i/apps/roomarranger.png
    
      29  done
    
      30
    
      31  install -Dm644 icons/icon_256x256.png $pkgdir/usr/share/pixmaps/roomarranger.png
    
      32  install -Dm644 icons/raFileIcon32.png $ICONDIR/32x32/mimetypes/application-com.roomarranger.project.png
    
      33  install -Dm644 icons/raFileObjectIcon32.png $ICONDIR/32x32/mimetypes/application-com.roomarranger.object.png
    
      34  install -Dm644 raproject.xml $pkgdir/usr/share/mime/packages/raproject.xml
    
      35
    
      36  # Copy programm files
    
      37  install -d $pkgdir/opt
    
      38  cp -r  $srcdir/rooarr-setup/rooarr-bin $pkgdir/opt
    
      39
    
      40  # Copy desktop file and launcher
    
      41  install -Dm644 $srcdir/roomarranger.desktop $pkgdir/usr/share/applications/roomarranger.desktop
    
      42  install -Dm755 $srcdir/rooarr_run.sh $pkgdir/usr/bin/${_pkgname}_run.sh
    
      43  ln -s /usr/bin/rooarr_run.sh $pkgdir/usr/bin/$pkgname
    
      44}
    
      45
    
      46# vim:set ts=2 sw=2 et:
    
      47

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2