v2mixer-bin

maintainer arliweng · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads prebuilt binary tarballs (a Java application with native components) from the vendor's own domain (v2mixer.livev2.com), which is a personal/small-vendor host rather than a well-known official distribution channel. The sha256sums are set to SKIP for the tarballs, relying instead on separately downloaded sha256.txt and md5.txt files from the same host — but since those checksum files are also fetched from the same server with SKIP verification, a compromised or MITM'd server could serve both a malicious binary and matching checksums simultaneously, providing no real integrity guarantee. The package installs and executes these prebuilt binaries (a shell script v2mixer.sh launching a JVM application with bundled native libraries). This is a genuine supply-chain concern: no pinned cryptographic verification of the binary against an independently-held hash, and the host is not a recognized software distribution mirror. The pattern is not clearly malicious but represents a real medium-severity supply-chain risk.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source_x86_64=('http://v2mixer.livev2.com/f/cms/10/v2mixer-linux-x86_64.tgz'

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 78%): The PKGBUILD downloads prebuilt binary tarballs (a Java application with native components) from the vendor's own domain (v2mixer.livev2.com), which is a personal/small-vendor host rather than a well-known official distribution channel. The sha256sums are set to SKIP for the tarballs, relying instead on separately downloaded sha256.txt and md5.txt files from the same host — but since those checksum files are also fetched from the same server with SKIP verification, a compromised or MITM'd server could serve both a malicious binary and matching checksums simultaneously, providing no real integrity guarantee. The package installs and executes these prebuilt binaries (a shell script v2mixer.sh launching a JVM application with bundled native libraries). This is a genuine supply-chain concern: no pinned cryptographic verification of the binary against an independently-held hash, and the host is not a recognized software distribution mirror. The pattern is not clearly malicious but represents a real medium-severity supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: livev2 <co@livev2.com>
    
      2# Contributor: arliweng <arliweng@outlook.com>
    
      3
    
      4pkgname=v2mixer-bin
    
      5pkgver=1.20250419
    
      6pkgrel=2
    
      7pkgdesc='v2mixer, the movie editor, video mixer'
    
      8arch=('x86_64' 'aarch64')
    
      9license=('custom')
    
      10url="http://v2mixer.livev2.com/"
    
      11depends=('jre8-openjdk')
    
      12#makedepends=('zip')
    
      13#depends=('jre8-openjdk' 'ffmpeg')
    
      14
    
      15source_x86_64=('http://v2mixer.livev2.com/f/cms/10/v2mixer-linux-x86_64.tgz'
    
      16	'http://v2mixer.livev2.com/f/cms/10/sha256.txt'
    
      17	'http://v2mixer.livev2.com/f/cms/10/md5.txt'
    
      18	'v2mixer.desktop')
    
      19sha256sums_x86_64=('SKIP' 'SKIP' 'SKIP'
    
      20	'7e441f0cb26feddebad5622bfafd8271bd6db00ca64035339cbc40cdbde2de78')
    
      21
    
      22source_aarch64=('http://v2mixer.livev2.com/f/cms/10/v2mixer-linux-arm64.tgz'
    
      23	'http://v2mixer.livev2.com/f/cms/10/sha256.txt'
    
      24	'http://v2mixer.livev2.com/f/cms/10/md5.txt'
    
      25	'v2mixer.desktop')
    
      26sha256sums_aarch64=('SKIP' 'SKIP' 'SKIP'
    
      27	'7e441f0cb26feddebad5622bfafd8271bd6db00ca64035339cbc40cdbde2de78')
    
      28
    
      29prepare() {
    
      30	if [ $CARCH == 'aarch64' ]; then
    
      31		grep v2mixer-linux-arm64.tgz sha256.txt | sha256sum -c || exit 1
    
      32		grep v2mixer-linux-arm64.tgz md5.txt | md5sum -c || exit 1
    
      33	else
    
      34		grep v2mixer-linux-${CARCH}.tgz sha256.txt | sha256sum -c || exit 1
    
      35		grep v2mixer-linux-${CARCH}.tgz md5.txt | md5sum -c || exit 1
    
      36	fi
    
      37}
    
      38
    
      39build() {
    
      40	rm -fr v2mixer/bin/jre
    
      41# uncomment for FFmpeg native, including GPL license, but only same version of v2mixer
    
      42#	zip -d v2mixer/bin/com.livev2.v2mixer_lib/ffmpeg-linux-*.jar \
    
      43#		/org/bytedeco/ffmpeg/*/libav* \
    
      44#		/org/bytedeco/ffmpeg/*/libsw*
    
      45}
    
      46
    
      47package() {
    
      48	mkdir -p ${pkgdir}/usr/share/livev2.com
    
      49	cp -rL v2mixer ${pkgdir}/usr/share/livev2.com
    
      50	mkdir -p ${pkgdir}/usr/bin
    
      51	ln -sr ${pkgdir}/usr/share/livev2.com/v2mixer/v2mixer.sh ${pkgdir}/usr/bin/v2mixer
    
      52	install -D -m644 v2mixer.desktop ${pkgdir}/usr/share/applications/v2mixer.desktop
    
      53}
    
      54

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2