upak

maintainer donpicoro · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The source tarball is fetched from orruba.org via a PHP document-management endpoint (?mdocs-file=1159) rather than the official ORNL FTP server (ftp.phy.ornl.gov, which is commented out). ORRUBA (Oak Ridge Rutgers University Barrel Array) is a legitimate nuclear physics collaboration that uses UPAK, so the host is plausibly project-affiliated rather than a random personal server. However, the distribution point is still unofficial/non-canonical, the URL is opaque (a numeric file ID rather than a named artifact), and the package compiles and installs Fortran/C binaries directly into the system. The md5sum provides only weak integrity assurance. The commented-out official ORNL source suggests the maintainer switched away from the canonical host, which is a mild supply-chain concern. The build also executes installed binaries (./txx, ./txxps) during the package() phase to generate documentation, meaning any compromise of the tarball could lead to code execution at build time. Overall this is a genuine medium-risk pattern: executed compiled code from a non-canonical host with weak integrity checking, but not clearly malicious.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 "upak-2021.tar.bz2::https://orruba.org/?mdocs-file=1159"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 65%): The source tarball is fetched from orruba.org via a PHP document-management endpoint (?mdocs-file=1159) rather than the official ORNL FTP server (ftp.phy.ornl.gov, which is commented out). ORRUBA (Oak Ridge Rutgers University Barrel Array) is a legitimate nuclear physics collaboration that uses UPAK, so the host is plausibly project-affiliated rather than a random personal server. However, the distribution point is still unofficial/non-canonical, the URL is opaque (a numeric file ID rather than a named artifact), and the package compiles and installs Fortran/C binaries directly into the system. The md5sum provides only weak integrity assurance. The commented-out official ORNL source suggests the maintainer switched away from the canonical host, which is a mild supply-chain concern. The build also executes installed binaries (./txx, ./txxps) during the package() phase to generate documentation, meaning any compromise of the tarball could lead to code execution at build time. Overall this is a genuine medium-risk pattern: executed compiled code from a non-canonical host with weak integrity checking, but not clearly malicious.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Luis Sarmiento <Luis.Sarmiento-ala-nuclear.lu.se>
    
      2# Co-Maintainer: effeffe - Filippo Falezza <filippo dot falezza at outlook dot com>
    
      3
    
      4pkgname=upak
    
      5pkgver=10.6.8 # <-- current source doesn't have a version. We keep the last known one
    
      6pkgrel=14
    
      7pkgdesc="HRIBF Data Acquisition and analysis."
    
      8url="ftp://ftp.phy.ornl.gov/pub/upak/README.html"
    
      9arch=('x86_64')
    
      10license=('unknown')
    
      11depends=('libx11' 'tcsh' 'bash')
    
      12makedepends=('gcc-fortran>=4.2')
    
      13options=(staticlibs emptydirs)
    
      14source=(
    
      15  "upak-2021.tar.bz2::https://orruba.org/?mdocs-file=1159"
    
      16  #"https://ftp.phy.ornl.gov/fauxtp/${pkgname}/${pkgname}-src.tgz"
    
      17  "upak.install")
    
      18md5sums=(
    
      19  '75b58c32a5e339dcba36c2ca3039bff6'
    
      20  '28ee91c3b9ad3ac1be306fb8c0eb1f35')
    
      21
    
      22install="${pkgname}.install"
    
      23
    
      24prepare(){
    
      25  cd ${srcdir}/${pkgname}
    
      26  #replace /usr/hhirf with /opt/hhirf
    
      27  find . -type f -exec sed -i 's|/usr/hhirf|/opt/hhirf|g' {} +
    
      28  find . -type f -exec sed -i 's|/usr/local/hhirf|/opt/hhirf|g' {} +
    
      29}
    
      30
    
      31package(){
    
      32  cd ${srcdir}/${pkgname}
    
      33  make clean
    
      34  make -j1 INSTALLDIR="${pkgdir}/opt/hhirf" all  # <-- this already goes to ${pkgdir} therefore must be package() not build()
    
      35
    
      36  cd ${srcdir}/${pkgname}
    
      37  install -m644 Dreadme/README-Apr07 ${pkgdir}/opt/hhirf/doc
    
      38  install -m644 Dreadme/readme.{tex,doc} ${pkgdir}/opt/hhirf/doc
    
      39  install -m644 Dreadme/dvd.{tex,doc} ${pkgdir}/opt/hhirf/doc
    
      40
    
      41  ## This is for compatibility while we work on patching most files of the program
    
      42  #ln -s /opt/hhirf ${pkgdir}/usr/local/hhirf
    
      43  #ln -s /opt/hhirf ${pkgdir}/usr/hhirf
    
      44
    
      45  cd $pkgdir/opt/hhirf
    
      46  for file in $(ls doc/*.doc);do
    
      47    file=$(basename -s .doc $file)
    
      48    ./txx doc/$file x
    
      49    ./txxps $file
    
      50    rm $file.txx
    
      51    mv $file.ps doc/
    
      52  done
    
      53}
    
      54

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2