slabeler-le

maintainer LotteV · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The PKGBUILD downloads a proprietary prebuilt binary from itch.io, which is a legitimate indie software distribution platform. The source is checksummed (both md5 and sha512), providing integrity verification. The prepare() function actually checks for the file and errors out if not present, suggesting this is intended as a manual-download package where the user places the zip themselves (the itch.io URL in source= is more of a reference than a functional download URL, since itch.io requires login/purchase). The binary is proprietary but from a named developer's itch.io page. The main security concern is the prebuilt binary from a non-official Linux distro channel, but itch.io is a well-known distribution platform for indie software. The chmod -R 777 on /opt/pkgname is sloppy and a minor security concern (world-writable directory) but not a supply-chain risk. Overall this is low risk: checksummed proprietary binary from a legitimate distribution platform with no signs of active malice or obfuscation.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 82%): The PKGBUILD downloads a proprietary prebuilt binary from itch.io, which is a legitimate indie software distribution platform. The source is checksummed (both md5 and sha512), providing integrity verification. The prepare() function actually checks for the file and errors out if not present, suggesting this is intended as a manual-download package where the user places the zip themselves (the itch.io URL in source= is more of a reference than a functional download URL, since itch.io requires login/purchase). The binary is proprietary but from a named developer's itch.io page. The main security concern is the prebuilt binary from a non-official Linux distro channel, but itch.io is a well-known distribution platform for indie software. The chmod -R 777 on /opt/pkgname is sloppy and a minor security concern (world-writable directory) but not a supply-chain risk. Overall this is low risk: checksummed proprietary binary from a legitimate distribution platform with no signs of active malice or obfuscation.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:8 url="https://m-lo7.itch.io/slabeler-le"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Lotte V
    
      2# Contributor: Lotte V
    
      3pkgname=slabeler-le
    
      4pkgver=1.0
    
      5pkgrel=1
    
      6pkgdesc="Proprietary software for labeling speech/singing audio"
    
      7arch=('x86_64')
    
      8url="https://m-lo7.itch.io/slabeler-le"
    
      9license=('custom')
    
      10groups=('slabeler')
    
      11depends=('libgcc' 'alsa-lib')
    
      12options=('!strip' '!emptydirs')
    
      13source=("SLabeler-linux.zip::https://m-lo7.itch.io/slabeler-le" "slabeler-le.desktop" "LICENSE")
    
      14md5sums=('694265ada186a44250428ec8ad3dbc64'
    
      15         '666391a8748ee269b6f23264bb1abcdc'
    
      16         '4247e0c0b44b09b93901cab7b0d22ab0')
    
      17sha512sums=('86ff3e451a6783a0066e4010128c720827995631ffd2943b63dca35cffa893a69808a1f6dbf1e34b79e9e7efd721e37a421807a66fe775ec5b7e230b113c89ec'
    
      18            'f1464580bd75087bc0e59e468073a21a0656897a04aad3c6c300a6b55adec2677f30da9b03447b2e3ed7bb1e3edd27923f6b8260a55a018cffd71056519d695a'
    
      19            '2cbb910a59da520bb31ca9da3171cbf1aaf2ab82a04c7e7ba763113dc94fe572883617685302fdadb489922be12716a4c7e2684e4f384200ff6ed19ff3a60416')
    
      20
    
      21prepare() {
    
      22    if [ ! -f "${srcdir}/SLabeler-linux.zip" ]; then
    
      23        echo ""
    
      24        echo "  ERROR: Source file 'SLabeler-linux.zip' not found in the build directory."
    
      25        echo "  Please download it manually from: ${url}"
    
      26        echo "  And place it in the same directory as this PKGBUILD."
    
      27        echo ""
    
      28        return 1
    
      29    fi
    
      30}
    
      31
    
      32package() {
    
      33    # 1. Create the folder in /opt
    
      34    install -d "${pkgdir}/opt/${pkgname}"
    
      35
    
      36    # 2. Dump EVERYTHING in there
    
      37    # This includes assets, the binary, and the desktop/icon if you want
    
      38    cp -r "${srcdir}/assets" "${pkgdir}/opt/${pkgname}/"
    
      39    install -m755 "${srcdir}/SLabeler" "${pkgdir}/opt/${pkgname}/"
    
      40
    
      41    # 3. Permissions
    
      42    # We make the folder world-writable so the log file can be created by anyone
    
      43    chmod -R 777 "${pkgdir}/opt/${pkgname}"
    
      44
    
      45    # 4. Standard Launcher & Desktop Integration
    
      46    install -d "${pkgdir}/usr/bin"
    
      47    ln -s "/opt/${pkgname}/SLabeler" "${pkgdir}/usr/bin/${pkgname}"
    
      48
    
      49    install -d "${pkgdir}/usr/share/applications"
    
      50    install -d "${pkgdir}/usr/share/pixmaps"
    
      51    install -m644 "${srcdir}/$pkgname.desktop" "${pkgdir}/usr/share/applications/"
    
      52    install -m644 "${srcdir}/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
    
      53}
    
      54

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2