sdrconnect-nrsp

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt .run installer (a makeself self-extracting archive) from www.sdrplay.com, which is the official SDRplay vendor domain. The checksums are present and non-SKIP for both architectures, so integrity is verified. The binary is extracted (not executed as an installer) via '--tar xf', and the individual components (shared libraries, executables) are installed manually. The concern is that prebuilt closed-source binaries are being executed on the user's system with no source verification beyond a SHA256 hash of the vendor-supplied bundle — this is a legitimate supply-chain concern for a closed-source SDR application, but it is standard practice for proprietary Linux software in the AUR (similar to spotify, zoom, etc.). The vendor domain is the official SDRplay website. Overall this is a medium-risk pattern (prebuilt binary from a vendor, no source build) but not an active attack or clearly malicious; it follows normal AUR conventions for proprietary software packaging.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source_x86_64=("https://www.sdrplay.com/software/SDRconnect_linux-x64_${build}_nrsp.run")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt .run installer (a makeself self-extracting archive) from www.sdrplay.com, which is the official SDRplay vendor domain. The checksums are present and non-SKIP for both architectures, so integrity is verified. The binary is extracted (not executed as an installer) via '--tar xf', and the individual components (shared libraries, executables) are installed manually. The concern is that prebuilt closed-source binaries are being executed on the user's system with no source verification beyond a SHA256 hash of the vendor-supplied bundle — this is a legitimate supply-chain concern for a closed-source SDR application, but it is standard practice for proprietary Linux software in the AUR (similar to spotify, zoom, etc.). The vendor domain is the official SDRplay website. Overall this is a medium-risk pattern (prebuilt binary from a vendor, no source build) but not an active attack or clearly malicious; it follows normal AUR conventions for proprietary software packaging.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: KarmaTag <karmatag@proton.me>
    
      2
    
      3pkgname=sdrconnect-nrsp
    
      4pkgver=1.0.5
    
      5build=e077f2ebe
    
      6pkgrel=1
    
      7pkgdesc="SDR receiver for SDRplay nRSP-ST"
    
      8arch=('aarch64' 'x86_64')
    
      9url="https://www.sdrplay.com/nRSPstart/"
    
      10license=('custom:EULA')
    
      11depends=('libusb>=1.0' 'glibc' 'gcc-libs' 'fontconfig' 'freetype2' 'brotli' 'expat'
    
      12         'bzip2' 'libpng' 'harfbuzz' 'graphite' 'pcre2' 'alsa-lib' 'util-linux-libs')
    
      13source_x86_64=("https://www.sdrplay.com/software/SDRconnect_linux-x64_${build}_nrsp.run")
    
      14source_aarch64=("https://www.sdrplay.com/software/SDRconnect_linux-arm64_${build}_nrsp.run")
    
      15source=("sdrconnect-nrsp.desktop"
    
      16        "nrspadministrator.desktop"
    
      17        "nrspupdater.desktop"
    
      18        "66-sdrplay.rules")
    
      19sha256sums=('eba89d720a1153a9cf4d061b624dbafe26044ee7bb2e58955a1035778e49e21e'
    
      20            '0943ad905989b77283832fdd804f553671f1b42094d93c3103acef27468934a7'
    
      21            'd65f2ef4c25465924dfb73e27c13d701da50c287c35197d6d44bba726313d6f5'
    
      22            'b39086ca99ef4b2242ff9edef93258c99d478fd37a8ba64319843928e316c61b')
    
      23sha256sums_aarch64=('a95c8b4b3bd3a7d19878e639ec3b06bc81efc73db3ff36083b965f089b3c4e69')
    
      24sha256sums_x86_64=('2e289b2f9e365f25a6adc3c10ebf39578dc806ed3839829204a292cfa8852066')
    
      25
    
      26prepare() {
    
      27	cd ${srcdir}
    
      28
    
      29	msg2 "Extracting makeself archive..."
    
      30	sh SDRconnect_linux-*64_${build}_nrsp.run --tar xf
    
      31}
    
      32
    
      33package() {
    
      34	cd "${srcdir}"
    
      35
    
      36	# These commands are equivalent to the scripts used in the supplied
    
      37	# run file
    
      38	install -D -m644 "sdrplay_license.txt" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      39        (find *.so -type f -exec install -D -m755 "{}" "${pkgdir}/usr/lib/${pkgname}/{}" \;)
    
      40        (find *.ico -type f -exec install -D -m644 "{}" "${pkgdir}/usr/share/icons/{}" \;)
    
      41        (find *.desktop -exec install -D -m644 "{}" "${pkgdir}/usr/share/applications/{}" \;)
    
      42	install -D -m755 "SDRconnect" "${pkgdir}/usr/lib/${pkgname}/SDRconnect"
    
      43	install -D -m755 "NRSPAdministrator" "${pkgdir}/usr/lib/${pkgname}/NRSPAdministrator"
    
      44	install -D -m755 "NRSPUpdater" "${pkgdir}/usr/lib/${pkgname}/NRSPUpdater"
    
      45
    
      46	# avoid issue with libsdrplay rules
    
      47	install -D -m644 66-sdrplay.rules "${pkgdir}/usr/lib/udev/rules.d/66-sdrplay.rules"
    
      48
    
      49	install -m 755 -d "${pkgdir}/usr/bin"
    
      50	ln -s "/usr/lib/${pkgname}/SDRconnect" "${pkgdir}/usr/bin/${pkgname}"
    
      51	ln -s "/usr/lib/${pkgname}/NRSPAdministrator" "${pkgdir}/usr/bin/NRSPAdministrator"
    
      52	ln -s "/usr/lib/${pkgname}/NRSPUpdater" "${pkgdir}/usr/bin/NRSPUpdater"
    
      53}
    
      54

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2