uhe-hive-vst

maintainer RX14 · 4 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt binary from a plausible project-owned CDN (uhe-dl.b-cdn.net) for a commercial VST; the build process only patches hardcoded paths in the binary to support system-wide installation, which is normal for AUR packages; no remote code execution or malicious behavior is present.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt binary from a plausible project-owned CDN (uhe-dl.b-cdn.net) for a commercial VST; the build process only patches hardcoded paths in the binary to support system-wide installation, which is normal for AUR packages; no remote code execution or malicious behavior is present.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 source=("https://uhe-dl.b-cdn.net/releases/Hive_211_${pkgver}_Linux.tar.xz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Stephanie Wilde-Hobbs <git@stephanie.is>
    
      2# Maintainer: Colin Wallace <wallacoloo@gmail.com>
    
      3# Download links to other u-he VSTs can be found here: http://www.kvraudio.com/forum/viewtopic.php?f=31&t=424953
    
      4# Note: These VSTs require purchase/activation.
    
      5
    
      6_vstname=Hive
    
      7_vstdir=/usr/lib/vst # Note: these are Linux VSTs (.so files)
    
      8
    
      9pkgname=uhe-hive-vst
    
      10pkgver=12092
    
      11pkgrel=1
    
      12pkgdesc='Commercial virtual-analog synthesizer from u-he'
    
      13arch=('x86_64' 'i686')
    
      14url='http://www.u-he.com/products/hive'
    
      15license=('custom')
    
      16depends=('gtk3')
    
      17makedepends=('xxd')
    
      18_untardir=$_vstname-$pkgver
    
      19_tarname=$_untardir.tar.gz
    
      20source=("https://uhe-dl.b-cdn.net/releases/Hive_211_${pkgver}_Linux.tar.xz")
    
      21sha256sums=('d24c2488121556afb63a4989278fe1e246baae80a726f3b802ee29c2a157124f')
    
      22install=user.install
    
      23
    
      24_bits=$(echo "$CARCH" | sed "s/x86_64/64/" | sed "s/i686/32/")
    
      25_binaryname=$_vstname.$_bits.so
    
      26
    
      27
    
      28function patch_strings_in_file() {
    
      29    # Source (Johan Hedin): http://everydaywithlinux.blogspot.com/2012/11/patch-strings-in-binary-files-with-sed.html
    
      30    # Slight modification by Colin Wallace to force the pattern to capture the entire line
    
      31    # Usage: patch_strings_in_file <file> <pattern> <replacement>
    
      32    # replaces all occurances of <pattern> with <replacement> in <file>, padding
    
      33    # <replacement> with null characters to match the length
    
      34    # Unlike sed or patch, this works on binary files
    
      35    local FILE="$1"
    
      36    local PATTERN="$2"
    
      37    local REPLACEMENT="$3"
    
      38
    
      39    # Find all unique strings in FILE that contain the pattern 
    
      40    STRINGS=$(strings ${FILE} | grep "^${PATTERN}$" | sort -u -r)
    
      41
    
      42    if [ "${STRINGS}" != "" ] ; then
    
      43        echo "File '${FILE}' contains strings equal to '${PATTERN}':"
    
      44
    
      45        for OLD_STRING in ${STRINGS} ; do
    
      46            # Create null terminated ASCII HEX representations of the strings
    
      47            OLD_STRING_HEX="$(echo -n ${OLD_STRING} | xxd -g 0 -u -ps -c 256)00"
    
      48            NEW_STRING_HEX="$(echo -n ${REPLACEMENT} | xxd -g 0 -u -ps -c 256)00"
    
      49
    
      50            if [ ${#NEW_STRING_HEX} -le ${#OLD_STRING_HEX} ] ; then
    
      51                # Pad the replacement string with null terminations so the
    
      52                # length matches the original string
    
      53                while [ ${#NEW_STRING_HEX} -lt ${#OLD_STRING_HEX} ] ; do
    
      54                    NEW_STRING_HEX="${NEW_STRING_HEX}00"
    
      55                done
    
      56
    
      57                # Now, replace every occurrence of OLD_STRING with NEW_STRING 
    
      58                echo -n "Replacing ${OLD_STRING} with ${REPLACEMENT}... "
    
      59                hexdump -ve '1/1 "%.2X"' ${FILE} | \
    
      60                sed "s/${OLD_STRING_HEX}/${NEW_STRING_HEX}/g" | \
    
      61                xxd -r -p > ${FILE}.tmp
    
      62                chmod --reference ${FILE} ${FILE}.tmp
    
      63                mv ${FILE}.tmp ${FILE}
    
      64                echo "Done!"
    
      65            else
    
      66                echo "New string '${NEW_STRING}' is longer than old" \
    
      67                     "string '${OLD_STRING}'. Skipping."
    
      68            fi
    
      69        done
    
      70    fi
    
      71}
    
      72
    
      73
    
      74build() {
    
      75    cd "$srcdir/$_untardir/$_vstname"
    
      76
    
      77    # The binaries use a scheme that causes paths to all be ~/.uhe/$_vstname
    
      78    # This includes paths to the plugin's own static resources (images, fonts)
    
      79    # Patch the binary such that static resources will be loaded from a system dir:
    
      80    # Note: these paths can be located in the binary by hand via `strings $_binaryname`
    
      81    patch_strings_in_file "$_binaryname" "%s/.%s/%s/Data" "/opt/%3\$s/Data"
    
      82    patch_strings_in_file "$_binaryname" "%s/.%s/%s/Modules" "/opt/%3\$s/Modules"
    
      83    # This is for accessing the user guide & the dialog binaries
    
      84    patch_strings_in_file "$_binaryname" "%s/.%s/%s/" "/opt/%3\$s/"
    
      85}
    
      86
    
      87package() {
    
      88    local instdir=/opt/$_vstname
    
      89
    
      90    cd "$srcdir/$_untardir/$_vstname"
    
      91    # Install custom license
    
      92    install -Dm644 license.txt "$pkgdir/usr/share/licenses/$pkgname/license.txt"
    
      93
    
      94    # Install the binary and the correct dialog version
    
      95    install -D "$_binaryname" "$pkgdir/$instdir/$_binaryname"
    
      96    install -D "dialog" "$pkgdir/$instdir/dialog"
    
      97    install -D "dialog.$_bits" "$pkgdir/$instdir/dialog.$_bits"
    
      98
    
      99    # Link the binary onto the path
    
      100    mkdir -p "$pkgdir/usr/lib/vst"
    
      101    ln -s "$instdir/$_binaryname" "$pkgdir/usr/lib/vst/$_vstname.so"
    
      102
    
      103    # Install all the files
    
      104    find Data/ Modules/ -type f -exec install -Dm644 {} $pkgdir/$instdir/{} \;
    
      105    rm -Rf Data/ Modules/ dialog* *.so *.pdf *.rtf *.txt
    
      106
    
      107    cp -r "$srcdir/$_untardir/$_vstname" "${pkgdir}/${instdir}/u-he"
    
      108}
    
      109

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2