vide-bin

maintainer chrs · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads and installs prebuilt binaries (the VIDE executable and three libMagick*.so.5 shared libraries) from a personal/project website (riintouge.com) that is not an official distribution mirror or well-known vendor host. The libMagick libraries are installed into /usr/lib/vide/ and loaded at runtime, and the VIDE binary itself is executed. While sha512sums are provided for these files (providing some integrity guarantee against in-transit tampering), the checksums only protect against accidental corruption or a one-time swap — if the host owner updates the files and the PKGBUILD maintainer updates the checksums, users get whatever the host serves. The core concern is that these are executed native binaries/libraries from a single personal domain with no independent verification (no GPG signature, no reproducible build). This is a genuine supply-chain risk: medium severity is appropriate. The cheaper model's assessment is correct here.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:10 source=('http://www.riintouge.com/archive/VIDE/VIDE_latest_64.tar.gz'

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): This PKGBUILD downloads and installs prebuilt binaries (the VIDE executable and three libMagick*.so.5 shared libraries) from a personal/project website (riintouge.com) that is not an official distribution mirror or well-known vendor host. The libMagick libraries are installed into /usr/lib/vide/ and loaded at runtime, and the VIDE binary itself is executed. While sha512sums are provided for these files (providing some integrity guarantee against in-transit tampering), the checksums only protect against accidental corruption or a one-time swap — if the host owner updates the files and the PKGBUILD maintainer updates the checksums, users get whatever the host serves. The core concern is that these are executed native binaries/libraries from a single personal domain with no independent verification (no GPG signature, no reproducible build). This is a genuine supply-chain risk: medium severity is appropriate. The cheaper model's assessment is correct here.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=vide-bin
    
      2pkgver=0.45a
    
      3pkgrel=1
    
      4pkgdesc='A toolkit for the Source engine aimed at aiding mappers and modders alike.'
    
      5arch=('x86_64')
    
      6url='http://www.riintouge.com/VIDE/'
    
      7license=('unknown')
    
      8depends=('icu67' 'qt4' 'lcms2' 'freetype2' 'liblqr' 'glib2' 'fontconfig' 'libxext' 'libxt' 'xz' 'bzip2' 'zlib' 'libtool' 'libx11')
    
      9makedepends=('patchelf')
    
      10source=('http://www.riintouge.com/archive/VIDE/VIDE_latest_64.tar.gz'
    
      11        'http://www.riintouge.com/archive/VIDE/lib64/libMagick++.so.5'
    
      12        'http://www.riintouge.com/archive/VIDE/lib64/libMagickCore.so.5'
    
      13        'http://www.riintouge.com/archive/VIDE/lib64/libMagickWand.so.5'
    
      14        'vide-wrapper'
    
      15        'VIDE.desktop'
    
      16        'vide.xml')
    
      17sha512sums=('82dc328bca33cdce139131132f18bc2e9a2776af648fcce0850aadb19a02593c906eb6b15b266067e4f184b1c0a76d0f41f7df5bc08e3311988351f4f1425dde'
    
      18            'a36802b973935ceb372ccb97054fe3b95ed6b403c496601efd22f8f342065838a09263649e699de0dbfd9f94084306f3f17000caf127eaf2ce5d7980580a7def'
    
      19            '974a423686c95a10b108466532dfca7aad714bfc39c5dcc5b343bd27ccce0cfc0510aea8af396a1adb2143f5c04e4a78df44d5b150638dc8109d7c6249694a2a'
    
      20            '9fd337fd08e0e2c98d21e132b4e5af01c4f21d077b0f39225fe0657b974c7c58f6b194c8e907def127ff84c35c7f1a42e52ac21d83e0d778ce43f4c14638ac0a'
    
      21            'SKIP'
    
      22            'SKIP'
    
      23            'SKIP')
    
      24
    
      25build() {
    
      26  patchelf --remove-rpath VIDE/VIDE
    
      27}
    
      28
    
      29package() {
    
      30  install -Dm755 vide-wrapper "$pkgdir/usr/bin/VIDE"
    
      31  install -Dm755 VIDE/VIDE "$pkgdir/usr/lib/vide/VIDE"
    
      32  install -Dm755 -t "$pkgdir/usr/lib/vide/" VIDE/lib/libSingleApplication.so.1 libMagick++.so.5 libMagickCore.so.5 libMagickWand.so.5
    
      33  install -Dm644 VIDE/noitazilait.ini "$pkgdir/usr/lib/vide/noitazilait.ini"
    
      34
    
      35  install -Dm755 VIDE.desktop "$pkgdir/usr/share/applications/VIDE.desktop"
    
      36  install -Dm644 vide.xml "$pkgdir/usr/share/mime/packages/vide.xml"
    
      37  install -Dm644 VIDE/deploy/multi_manager_icon_48.png "$pkgdir/usr/share/pixmaps/multi_manager_icon_48.png"
    
      38}
    
      39

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2