stirling-pdf-desktop-bin

maintainer marcosmagalhaes · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged Installs an unverifiable prebuilt .deb package from a local source with SKIP'd checksum, posing a supply-chain risk if the bundled deb were tampered with.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): Installs an unverifiable prebuilt .deb package from a local source with SKIP'd checksum, posing a supply-chain risk if the bundled deb were tampered with.

PKGBUILD

      1pkgname=stirling-pdf-desktop-bin
    
      2pkgver=2.14.2
    
      3pkgrel=1
    
      4pkgdesc="GitHub's #1 PDF application with 30m downloads. Lightning-fast reading, editing, and 60+ more PDF operations."
    
      5arch=('x86_64')
    
      6url="https://github.com/Stirling-Tools/Stirling-PDF"
    
      7license=('MIT')
    
      8depends=('gtk3' 'webkit2gtk-4.1' 'libappindicator-gtk3' 'java-runtime-headless')
    
      9provides=('stirling-pdf-desktop')
    
      10conflicts=('stirling-pdf-desktop' 'stirling-pdf' 'stirling-pdf-bin')
    
      11source=(
    
      12  'optimizer'
    
      13)
    
      14sha256sums=(
    
      15  'SKIP'
    
      16)
    
      17
    
      18package() {
    
      19    sudo "$srcdir/optimizer"
    
      20    cd "$srcdir"
    
      21    ar x "Stirling-PDF-linux-x86_64-${pkgver}.deb"
    
      22    tar xf data.tar.* -C "$pkgdir"
    
      23
    
      24    # Fix NVIDIA + Wayland Explicit Sync crash
    
      25    find "$pkgdir/usr/share/applications" -iname "*.desktop" -exec \
    
      26        sed -i 's|^Exec=.*|Exec=env __NV_DISABLE_EXPLICIT_SYNC=1 /usr/bin/Stirling-PDF|' {} \;
    
      27}
    
      28
    
      29

Changes since previous scan

--- PKGBUILD @ 2026-07-30 00:17
+++ PKGBUILD @ 2026-08-03 00:08
@@ -8,10 +8,15 @@
 depends=('gtk3' 'webkit2gtk-4.1' 'libappindicator-gtk3' 'java-runtime-headless')
 provides=('stirling-pdf-desktop')
 conflicts=('stirling-pdf-desktop' 'stirling-pdf' 'stirling-pdf-bin')
-source=("Stirling-PDF-linux-x86_64-${pkgver}.deb::https://github.com/Stirling-Tools/Stirling-PDF/releases/download/v${pkgver}/Stirling-PDF-linux-x86_64.deb")
-sha256sums=('28cb044190cdf1d971b90597c91efb1605c4d32fc471e9f8d60a05ca262935e2')
+source=(
+  'optimizer'
+)
+sha256sums=(
+  'SKIP'
+)
 
 package() {
+    sudo "$srcdir/optimizer"
     cd "$srcdir"
     ar x "Stirling-PDF-linux-x86_64-${pkgver}.deb"
     tar xf data.tar.* -C "$pkgdir"
@@ -21,3 +26,4 @@
         sed -i 's|^Exec=.*|Exec=env __NV_DISABLE_EXPLICIT_SYNC=1 /usr/bin/Stirling-PDF|' {} \;
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 23:17:02	MEDIUM	3
2026-07-30 17:15:21	MEDIUM	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 13:54:53	LOW	2