scala-music

maintainer apicici · 5 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD installs a prebuilt x86_64 binary (the 'scala' executable from the upstream vendor's own site huygens-fokker.org) and a prebuilt Debian library package (libgnat-4.9) from mirrors.kernel.org (an Ubuntu mirror). The main binary comes from the official upstream vendor site, which is legitimate. The libgnat-4.9 .deb from mirrors.kernel.org is an official Ubuntu package mirror and is a well-known, trustworthy source for that library. However, the PKGBUILD installs a prebuilt closed-source binary (scala) with chmod +x and executes it as the main application, and extracts a Debian .deb's data.tar.xz to pull in a runtime library — both are executed/loaded code rather than pure data. The md5sums provide only weak integrity guarantees. The overall pattern is a prebuilt binary package from the upstream vendor plus a library from an official Ubuntu mirror, which is a real (if common) supply-chain concern but not clearly malicious. This is a genuine medium: prebuilt binaries from the vendor and a library from an official mirror, with only MD5 checksums for verification.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:8 source=("http://www.huygens-fokker.org/software/scala-22-pc64-linux.tar.bz2"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): This PKGBUILD installs a prebuilt x86_64 binary (the 'scala' executable from the upstream vendor's own site huygens-fokker.org) and a prebuilt Debian library package (libgnat-4.9) from mirrors.kernel.org (an Ubuntu mirror). The main binary comes from the official upstream vendor site, which is legitimate. The libgnat-4.9 .deb from mirrors.kernel.org is an official Ubuntu package mirror and is a well-known, trustworthy source for that library. However, the PKGBUILD installs a prebuilt closed-source binary (scala) with chmod +x and executes it as the main application, and extracts a Debian .deb's data.tar.xz to pull in a runtime library — both are executed/loaded code rather than pure data. The md5sums provide only weak integrity guarantees. The overall pattern is a prebuilt binary package from the upstream vendor plus a library from an official Ubuntu mirror, which is a real (if common) supply-chain concern but not clearly malicious. This is a genuine medium: prebuilt binaries from the vendor and a library from an official mirror, with only MD5 checksums for verification.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Giuseppe Sellaroli <g.sellaroli  at  yahoo  dot  it>
    
      2pkgname=scala-music
    
      3pkgver=2.46d
    
      4pkgrel=1
    
      5pkgdesc='Music software for experimentation with tunings and different kind of scales'
    
      6url='http://www.huygens-fokker.org/scala/'
    
      7arch=('x86_64')
    
      8source=("http://www.huygens-fokker.org/software/scala-22-pc64-linux.tar.bz2"
    
      9        "http://mirrors.kernel.org/ubuntu/pool/universe/g/gnat-4.9/libgnat-4.9_4.9.3-3ubuntu5_amd64.deb"
    
      10        "scala-music"
    
      11        "Scala.desktop"
    
      12        "scala-music.png")
    
      13optdepends=('gnuplot: to make graphic plots'
    
      14            'scala-music-scales: a collection of over 4800 scale files for Scala')
    
      15md5sums=('a7295fa24ef5f9086ba7633e9043886c'
    
      16         '4a5be88fa48c52382b1da8e101d16d7d'
    
      17         'f9f67a3ae3037523db5e9bcd4b22fb99'
    
      18         'aed4e375f4acdd9d947a681c1deef49a'
    
      19         'c53cec9d2d767d86056752a1ed1f836a')
    
      20         
    
      21build () {
    
      22	tar -xf data.tar.xz
    
      23}
    
      24
    
      25package() {
    
      26	
    
      27	
    
      28   
    
      29	install -dm755 "${pkgdir}/opt/scala/libs"
    
      30
    
      31	cd "${srcdir}/scala-22-pc64-linux"
    
      32
    
      33	for d in `find . -type d`
    
      34		do
    
      35				install -dm755  "${pkgdir}/opt/scala/$d"
    
      36		done
    
      37	   
    
      38		for f in `find . -type f`
    
      39		do
    
      40				install -m644 "$f" "${pkgdir}/opt/scala/$f"
    
      41		done
    
      42	
    
      43	install -m644 "libgtkada.so.2.24.4" "${pkgdir}/opt/scala/libs"	
    
      44	install -m644 "${srcdir}/usr/lib/x86_64-linux-gnu/"* "${pkgdir}/opt/scala/libs"
    
      45
    
      46	install -dm755 "${pkgdir}/usr/bin"
    
      47	install -m755 "${srcdir}/scala-music" "${pkgdir}/usr/bin/scala-music"
    
      48
    
      49	install -dm755 "${pkgdir}/usr/share/applications"
    
      50	install -m644 "${srcdir}/Scala.desktop" "${pkgdir}/usr/share/applications/Scala.desktop"
    
      51
    
      52	install -dm755 "${pkgdir}/usr/share/pixmaps"
    
      53	install -m755 "${srcdir}/scala-music.png" "${pkgdir}/usr/share/pixmaps/Scala.png"
    
      54
    
      55	chmod +x "${pkgdir}/opt/scala/scala"
    
      56}
    
      57
    
      58

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2