zedle

maintainer most · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary .deb package via a POST request to client.primx.eu in the prepare() phase, outside the source=() array, meaning makepkg's integrity verification does not cover it. The sha256sum check in check() uses a hardcoded hash, but this is a manual check that runs after the binary is already extracted and could be bypassed or differ between builds. The host (client.primx.eu) appears to be the vendor's own distribution server (primx.eu is the official PRIMX vendor site), so this is not a random personal host — it is the official vendor portal. However, the pattern of downloading an executed binary outside source=() with no reproducible, verifiable source URL is a genuine supply-chain concern: the downloaded binary cannot be audited by makepkg, the POST request means the server can return different content at any time, and the hardcoded hash in check() is the only integrity gate. This is a real medium-severity packaging concern (unofficial/unverifiable binary download path) rather than a clear attack, but it is not merely sloppy — it installs a prebuilt proprietary binary that executes on the user's system with no standard integrity guarantee.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:15 curl 'https://client.primx.eu/PublicSoftware/zedlimitededition/' -X POST \

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:10 source=('https://client.primx.eu/Legal/Terms')

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 85%): The PKGBUILD downloads a prebuilt binary .deb package via a POST request to client.primx.eu in the prepare() phase, outside the source=() array, meaning makepkg's integrity verification does not cover it. The sha256sum check in check() uses a hardcoded hash, but this is a manual check that runs after the binary is already extracted and could be bypassed or differ between builds. The host (client.primx.eu) appears to be the vendor's own distribution server (primx.eu is the official PRIMX vendor site), so this is not a random personal host — it is the official vendor portal. However, the pattern of downloading an executed binary outside source=() with no reproducible, verifiable source URL is a genuine supply-chain concern: the downloaded binary cannot be audited by makepkg, the POST request means the server can return different content at any time, and the hardcoded hash in check() is the only integrity gate. This is a real medium-severity packaging concern (unofficial/unverifiable binary download path) rather than a clear attack, but it is not merely sloppy — it installs a prebuilt proprietary binary that executes on the user's system with no standard integrity guarantee.

PKGBUILD

2 offending line(s) highlighted

      1pkgname=zedle
    
      2pkgver=2025.1.14
    
      3pkgrel=2
    
      4pkgdesc="A graphical interface to create, read and modify encrypted Zed! containers."
    
      5arch=('x86_64')
    
      6url="https://www.primx.eu"
    
      7license=('custom')
    
      8depends=('libxslt' 'libxml2-legacy' 'qt5-base' 'hicolor-icon-theme' 'icu')
    
      9makedepends=('curl' 'unzip' 'coreutils')
    
      10source=('https://client.primx.eu/Legal/Terms')
    
      11sha256sums=('c4c7a856f63bf1849faa931919f70ec7649599a55c113b01819258b01dbd09ce')
    
      12
    
      13prepare() {
    
      14    # No deeplink available, need to submit the form on the website
    
      15    curl 'https://client.primx.eu/PublicSoftware/zedlimitededition/' -X POST \
    
      16        --data-raw "Version=$pkgver-Linux+Ubuntu-x64" --output "${pkgname^^}.zip"
    
      17    unzip -p "${pkgname^^}.zip" "Ubuntu 24.04/${pkgname^^}-$pkgver.Ubuntu24.04.amd64.deb" > "${pkgname^^}.deb"
    
      18    sha256sum "${pkgname^^}.deb"
    
      19    rm "${pkgname^^}.zip"
    
      20}
    
      21
    
      22package() {
    
      23    ar x "${pkgname^^}.deb"
    
      24    tar -xvf data.tar.zst -C "$pkgdir"
    
      25
    
      26    # Change directory permissions from 775 to 755
    
      27    chmod 755 -R "$pkgdir/usr"
    
      28
    
      29    install -dm1777 "$pkgdir/etc/primx/accessfiles"
    
      30    install -dm1777 "$pkgdir/var/log/zed"
    
      31
    
      32    touch "$pkgdir/etc/primx/users.registry"
    
      33    chmod 666 "$pkgdir/etc/primx/users.registry"
    
      34
    
      35    install -Dm644 "$srcdir/Terms" -t "$pkgdir/usr/share/licenses/$pkgname/Terms.html"
    
      36}
    
      37
    
      38check() {
    
      39    # SHA verification needs to be done manually because the file is downloaded manually as well
    
      40    SHA_SUM=feeb57991df2bccff818cf6dfafa4a679dd51ca8ba983ea9b79964a6a82c4283
    
      41    echo "$SHA_SUM ${pkgname^^}.deb" | sha256sum --check --status
    
      42}
    
      43

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 00:29:32	MEDIUM	3
2026-07-21 00:24:15	MEDIUM	3
2026-07-20 00:19:49	MEDIUM	3
2026-07-19 00:17:08	MEDIUM	3
2026-07-18 00:14:48	MEDIUM	3
2026-07-17 00:06:16	MEDIUM	3
2026-07-16 00:05:41	MEDIUM	3
2026-07-15 00:09:25	MEDIUM	3