torrentv-bin

maintainer asm0dey · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads prebuilt binaries (a TorrenTV executable and libffmpegsumo.so shared library) via goo.gl URL shorteners, which redirect to an unknown final host. While SHA1 checksums are present, SHA1 is cryptographically weak and the use of URL shorteners obscures the actual download origin, making it impossible to verify the source is official. The binaries are installed as executable code (/opt/torrentv/TorrenTV) and a shared library (libffmpegsumo.so), both of which execute in user context. This is a genuine supply-chain concern: the redirect destination could change silently, the checksums use a broken hash algorithm, and there is no way to audit the actual source host. This matches the medium severity definition of executed binaries from an unofficial/unverifiable host.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source_x86_64=("torrentv-$CARCH.tar.gz::http://goo.gl/zZUOXk")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads prebuilt binaries (a TorrenTV executable and libffmpegsumo.so shared library) via goo.gl URL shorteners, which redirect to an unknown final host. While SHA1 checksums are present, SHA1 is cryptographically weak and the use of URL shorteners obscures the actual download origin, making it impossible to verify the source is official. The binaries are installed as executable code (/opt/torrentv/TorrenTV) and a shared library (libffmpegsumo.so), both of which execute in user context. This is a genuine supply-chain concern: the redirect destination could change silently, the checksums use a broken hash algorithm, and there is no way to audit the actual source host. This matches the medium severity definition of executed binaries from an unofficial/unverifiable host.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: asm0dey <pavel.finkelshtein@gmail.com>
    
      2pkgname=torrentv-bin
    
      3pkgver=0.9.6
    
      4pkgrel=1
    
      5pkgdesc="Stream Torrents to your AppleTV/Roku/Chromecast"
    
      6arch=('x86_64' 'i686')
    
      7url="http://torrentv.github.io/"
    
      8license=('GPL3')
    
      9
    
      10source=("$pkgname.desktop")
    
      11sha1sums=('167dd21bff7a803192cc7a7f98a0c0bd2f5e00d0')
    
      12
    
      13source_x86_64=("torrentv-$CARCH.tar.gz::http://goo.gl/zZUOXk")
    
      14sha1sums_x86_64=("b66190c64258fc8f13fae036842f9c46d4c770d1")
    
      15
    
      16source_i686=("torrentv-$CARCH.tar.gz::http://goo.gl/vlVWHw")
    
      17sha1sums_i686=("630366626cacf74a48c91690ba869860bd6ad8ed")
    
      18
    
      19depends=('gconf' 'nss' 'libxtst' 'alsa-lib')
    
      20
    
      21package() {
    
      22    cd "$srcdir/TorrenTV"
    
      23    install -Dm644 "$srcdir/$pkgname.desktop" "$pkgdir/usr/share/applications/$pkgname.desktop"
    
      24    install -Dm755 TorrenTV "$pkgdir/opt/torrentv/TorrenTV"
    
      25    install -Dm644 nw.pak "$pkgdir/opt/torrentv/nw.pak"
    
      26    install -Dm644 libffmpegsumo.so "$pkgdir/opt/torrentv/libffmpegsumo.so"
    
      27}
    
      28
    
      29
    
      30

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2