xairedit-bin

maintainer Sokoloft · 7 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads prebuilt binaries from a non-whitelisted but plausibly official CDN (empowertribe.com) used by the vendor; checksums are provided and match, reducing supply-chain risk, and the binaries are for a legitimate Behringer tool.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt binaries from a non-whitelisted but plausibly official CDN (empowertribe.com) used by the vendor; checksums are provided and match, reducing supply-chain risk, and the binaries are for a legitimate Behringer tool.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 source_x86_64=("X-AIR-Edit_LINUX_${pkgver}.tar.gz::https://cdn-media.empowertribe.com/4240ddc8835149e486922840e9379af0/X-AIR-Edit_LINUX_${pkgver}.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Sokoloft <sokoloft nospamat protonmail nospamdot com>
    
      2# Maintainer: olivierlm <mail nospamat olivierlemoal nospamdot fr>
    
      3# Contributor redtide <redtid3 nospamat gmail nospamdot com>
    
      4# Contributor Anders Thomsen <mail nospamat andersthomsen nospamdot dk>
    
      5
    
      6pkgname=xairedit-bin
    
      7_pkgname="${pkgname%-bin}" # Removes trailing "-bin"
    
      8pkgver=1.8.1
    
      9pkgrel=2
    
      10pkgdesc="Remote control program for Behringer X-AIR mixers"
    
      11arch=("x86_64" "armv7h")
    
      12url="https://www.behringer.com/series.html?category=R-BEHRINGER-XAIRSERIES"
    
      13license=('custom')
    
      14makedepends=("gendesk")
    
      15depends=("alsa-lib" "freetype2" "curl" "libglvnd" "gcc-libs" "glibc")
    
      16
    
      17source=('EULA_2012-09-12.pdf'
    
      18        "${_pkgname}.png::https://raw.githubusercontent.com/flathub/com.behringer.XAirEdit/refs/heads/master/com.behringer.XAirEdit.png")
    
      19source_x86_64=("X-AIR-Edit_LINUX_${pkgver}.tar.gz::https://cdn-media.empowertribe.com/4240ddc8835149e486922840e9379af0/X-AIR-Edit_LINUX_${pkgver}.tar.gz")
    
      20source_armv7h=("X-AIR-Edit_RASPI_${pkgver}.tar.gz::https://cdn-media.empowertribe.com/a354c773fc524f449572031c75f245fe/X-AIR-Edit_RASPI_${pkgver}.tar.gz")
    
      21sha512sums=('fe39285768937d82f31844b789d1075de8196495727653595e59f4f1b282f6dbe18a8a8bc51b837f284601dc37c52211d3d494a8636512f5398da31ff3d30284'
    
      22            '6b4f55ec1867bc16280483e3672ce15c2bcc3a27bfb79d346945618ecbf9e6d757a3fc2dd6752e7f37a6c5cf6d039cd81d63c178ba077575c1850d92e8039438')
    
      23sha512sums_x86_64=('cd5f2b3a6bb25416724a4a2418d0407ce7914115ebcf10c218e66bc7560f584d3e467d1bf1214a4fb5ac2fb301f8cf3ce7db638fde4a675255266d73798f508e')
    
      24sha512sums_armv7h=('6a22527cc34a87960f2f54623322bd0d1178509edcd7310c8ddd53cbbb6983ec9e1217ac49cbe3a660e700b1ebeb3b567ca8f324c82083318e357ea0d51915af')
    
      25b2sums=('f3af5fcb0044782d51ef976375b6184d781bab5110fb2184ac40443df7b21fdfc12ffa534448bb0aa41df8210c5e63a7d2995ee54279c2ec0824de5eb83aae64'
    
      26        'e5dd2bfcb89b2236b36a38d4c3be30b04e5ba43410923aeee28aca53876ab2d3d81893f0ce6abf66783aaabbdab99f2928bd521d6653016ac9fd14af9c9c8305')
    
      27b2sums_x86_64=('0065d4a6306fde3a854bb213ce427eae035dd89b23cb065ba0e1f801feaf8fc952c048cc0b4823e4604787a59381fe9d5d4b7f89404f7bd2599e92975fd9a138')
    
      28b2sums_armv7h=('9517ed8552680fd11f19da6da840d55d50aa3378377a3cec63ff245e1a809e17a4d819525a52265a4004609b7c05b92462e53ac1830547294881ccbf9ded6bb5')
    
      29
    
      30
    
      31prepare() {
    
      32	gendesk -n --pkgname "${_pkgname}" --pkgdesc "${pkgdesc}" --exec="${_pkgname}" --name "X-AIR Edit" --icon "${_pkgname}.png" --categories "AudioVideo;Audio" --terminal=false --custom="Keywords=Mixer;Behringer;"
    
      33}
    
      34
    
      35package() {
    
      36    install -Dm755 "X-AIR-Edit" "${pkgdir}/usr/bin/${_pkgname}"
    
      37    install -Dm644 "EULA_2012-09-12.pdf" "${pkgdir}/usr/share/licenses/${_pkgname}/license.pdf"
    
      38    install -Dm644 "${_pkgname}.desktop" "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      39    install -Dm644 "${_pkgname}.png" "${pkgdir}/usr/share/pixmaps/${_pkgname}.png"
    
      40}
    
      41

Changes since previous scan

--- PKGBUILD @ 2026-07-21 00:24
+++ PKGBUILD @ 2026-08-03 00:08
@@ -6,7 +6,7 @@
 pkgname=xairedit-bin
 _pkgname="${pkgname%-bin}" # Removes trailing "-bin"
 pkgver=1.8.1
-pkgrel=1
+pkgrel=2
 pkgdesc="Remote control program for Behringer X-AIR mixers"
 arch=("x86_64" "armv7h")
 url="https://www.behringer.com/series.html?category=R-BEHRINGER-XAIRSERIES"
@@ -16,17 +16,16 @@
 
 source=('EULA_2012-09-12.pdf'
         "${_pkgname}.png::https://raw.githubusercontent.com/flathub/com.behringer.XAirEdit/refs/heads/master/com.behringer.XAirEdit.png")
-source_x86_64=("X-AIR-Edit_LINUX_${pkgver}.tar.gz::https://cdn.mediavalet.com/aunsw/musictribe/VX4UkGFjQ0a1DH2Q8zg3sg/_KJ6tGIG7kGVqPxP-OsnLQ/Original/X-AIR-Edit_LINUX_${pkgver}.tar.gz")
-source_armv7h=("X-AIR-Edit_RASPI_${pkgver}.tar.gz::https://cdn.mediavalet.com/aunsw/musictribe/VX4UkGFjQ0a1DH2Q8zg3sg/_KJ6tGIG7kGVqPxP-OsnLQ/Original/X-AIR-Edit_RASPI_${pkgver}.tar.gz")
-
+source_x86_64=("X-AIR-Edit_LINUX_${pkgver}.tar.gz::https://cdn-media.empowertribe.com/4240ddc8835149e486922840e9379af0/X-AIR-Edit_LINUX_${pkgver}.tar.gz")
+source_armv7h=("X-AIR-Edit_RASPI_${pkgver}.tar.gz::https://cdn-media.empowertribe.com/a354c773fc524f449572031c75f245fe/X-AIR-Edit_RASPI_${pkgver}.tar.gz")
 sha512sums=('fe39285768937d82f31844b789d1075de8196495727653595e59f4f1b282f6dbe18a8a8bc51b837f284601dc37c52211d3d494a8636512f5398da31ff3d30284'
             '6b4f55ec1867bc16280483e3672ce15c2bcc3a27bfb79d346945618ecbf9e6d757a3fc2dd6752e7f37a6c5cf6d039cd81d63c178ba077575c1850d92e8039438')
 sha512sums_x86_64=('cd5f2b3a6bb25416724a4a2418d0407ce7914115ebcf10c218e66bc7560f584d3e467d1bf1214a4fb5ac2fb301f8cf3ce7db638fde4a675255266d73798f508e')
-sha512sums_armv7h=('cd5f2b3a6bb25416724a4a2418d0407ce7914115ebcf10c218e66bc7560f584d3e467d1bf1214a4fb5ac2fb301f8cf3ce7db638fde4a675255266d73798f508e')
+sha512sums_armv7h=('6a22527cc34a87960f2f54623322bd0d1178509edcd7310c8ddd53cbbb6983ec9e1217ac49cbe3a660e700b1ebeb3b567ca8f324c82083318e357ea0d51915af')
 b2sums=('f3af5fcb0044782d51ef976375b6184d781bab5110fb2184ac40443df7b21fdfc12ffa534448bb0aa41df8210c5e63a7d2995ee54279c2ec0824de5eb83aae64'
         'e5dd2bfcb89b2236b36a38d4c3be30b04e5ba43410923aeee28aca53876ab2d3d81893f0ce6abf66783aaabbdab99f2928bd521d6653016ac9fd14af9c9c8305')
 b2sums_x86_64=('0065d4a6306fde3a854bb213ce427eae035dd89b23cb065ba0e1f801feaf8fc952c048cc0b4823e4604787a59381fe9d5d4b7f89404f7bd2599e92975fd9a138')
-b2sums_armv7h=('0065d4a6306fde3a854bb213ce427eae035dd89b23cb065ba0e1f801feaf8fc952c048cc0b4823e4604787a59381fe9d5d4b7f89404f7bd2599e92975fd9a138')
+b2sums_armv7h=('9517ed8552680fd11f19da6da840d55d50aa3378377a3cec63ff245e1a809e17a4d819525a52265a4004609b7c05b92462e53ac1830547294881ccbf9ded6bb5')
 
 
 prepare() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 15:17:04	MEDIUM	1
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2