samsung_magician-consumer-ssd

maintainer oberon2007 · 23 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads prebuilt proprietary binaries (a CLI tool named 'magician') directly from Dropbox personal share links and installs them as executable files. Dropbox share links are not an official Samsung distribution channel — they can be silently replaced by the link owner at any time without changing the URL, and the checksums only protect against accidental corruption, not intentional substitution by the Dropbox account holder. The binary is installed with 755 permissions into /usr/bin. This is a genuine supply-chain concern: an unofficial, mutable host serving executed code with no cryptographic signing. The cheaper model's MEDIUM rating is correct.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source_x86_64=('https://www.dropbox.com/s/jo5l1ihyxta47qy/Samsung_Magician_DC_Linux_64bit.zip')

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads prebuilt proprietary binaries (a CLI tool named 'magician') directly from Dropbox personal share links and installs them as executable files. Dropbox share links are not an official Samsung distribution channel — they can be silently replaced by the link owner at any time without changing the URL, and the checksums only protect against accidental corruption, not intentional substitution by the Dropbox account holder. The binary is installed with 755 permissions into /usr/bin. This is a genuine supply-chain concern: an unofficial, mutable host serving executed code with no cryptographic signing. The cheaper model's MEDIUM rating is correct.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Berhard Landauer <oberon@manjaro.org>
    
      2
    
      3_pkgname=samsung_magician
    
      4pkgname=$_pkgname-consumer-ssd
    
      5pkgver=1.0
    
      6pkgrel=1
    
      7pkgdesc="CLI tool for Samsung Consumer SSDs including 470, 750, 830, 840, 850, 950 and 960 series"
    
      8url="http://www.samsung.com/semiconductor/minisite/ssd/download/tools.html"
    
      9arch=('x86_64' 'i686')
    
      10license=('custom')
    
      11depends=('jsoncpp' 'hdparm')
    
      12conflicts=("$_pkgname")
    
      13source=('LICENSE')
    
      14md5sums=('138596cfbe00f6b9ead1829b300f5e83')
    
      15md5sums_x86_64=('f2ff15d1c5bb316f58d615203ab9b111')
    
      16md5sums_i686=('d1e51e912994000cc8ce8ec8fc86751b')
    
      17source_x86_64=('https://www.dropbox.com/s/jo5l1ihyxta47qy/Samsung_Magician_DC_Linux_64bit.zip')
    
      18source_i686=('https://www.dropbox.com/s/jhc76a921v049rj/Samsung_Magician_DC_Linux_32bit.zip')
    
      19
    
      20package() {
    
      21	install -Dm755 magician $pkgdir/usr/bin/magician
    
      22	install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$_pkgname/LICENSE"
    
      23}
    
      24

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2