truepng

maintainer dbermond · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt Windows executable (TruePNG.exe) from x128.ho.ua, which is a personal/unofficial host, via a PHP redirect script (clicks.php). While a sha256sum is provided for the zip file (mitigating silent substitution risk somewhat), the host is not an official software distribution channel and the redirect adds opacity. The exe is installed to /usr/share/truepng and executed via wine through a shell wrapper. A compromised or swapped binary at this host would result in arbitrary code execution on the user's system. The sha256 pinning reduces but does not eliminate the supply-chain concern, since the host operator could swap the file at any time and the sum would catch it only if the PKGBUILD is updated. This is a genuine medium-severity supply-chain concern: an executed binary from an unofficial personal host, not a false positive.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("$_srcfile"::"http://x128.ho.ua/clicks/clicks.php?uri=${_srcfile}"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt Windows executable (TruePNG.exe) from x128.ho.ua, which is a personal/unofficial host, via a PHP redirect script (clicks.php). While a sha256sum is provided for the zip file (mitigating silent substitution risk somewhat), the host is not an official software distribution channel and the redirect adds opacity. The exe is installed to /usr/share/truepng and executed via wine through a shell wrapper. A compromised or swapped binary at this host would result in arbitrary code execution on the user's system. The sha256 pinning reduces but does not eliminate the supply-chain concern, since the host operator could swap the file at any time and the sum would catch it only if the PKGBUILD is updated. This is a genuine medium-severity supply-chain concern: an executed binary from an unofficial personal host, not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Daniel Bermond < gmail-com: danielbermond >
    
      2
    
      3pkgname=truepng
    
      4pkgver=0.6.2.5
    
      5_srcfile="TruePNG_${pkgver//./}.zip"
    
      6_extractdir="${_srcfile%.*}"
    
      7pkgrel=2
    
      8pkgdesc='An advanced and very efficient PNG image optimizer with lossless and lossy modes (uses wine)'
    
      9arch=('any')
    
      10url='http://x128.ho.ua/pngutils.html'
    
      11license=('unknown')
    
      12depends=('bash' 'wine')
    
      13makedepends=('git')
    
      14source=("$_srcfile"::"http://x128.ho.ua/clicks/clicks.php?uri=${_srcfile}"
    
      15        'git+https://github.com/dbermond/shellutils.git')
    
      16noextract=("$_srcfile")
    
      17sha256sums=('a20d7121bf377e9ddb2d7d04995bb4b032d523caeb7f7ea3360acad6bc5901ab'
    
      18            'SKIP')
    
      19
    
      20prepare() {
    
      21    mkdir -p "$_extractdir"
    
      22    cd "$_extractdir"
    
      23    bsdtar -x -f "${srcdir}/${_srcfile}"
    
      24}
    
      25
    
      26package() {
    
      27    install -D -m755 shellutils/image/truepng     -t "${pkgdir}/usr/bin"
    
      28    install -D -m644 "${_extractdir}/TruePNG.exe" -t "${pkgdir}/usr/share/truepng"
    
      29}
    
      30

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2