zedpro

maintainer benjaminvialle · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads prebuilt binaries (a Debian package inside a ZIP and a tarball) from zedencrypt.com, which is the official vendor site for Prim'X ZED! encryption software (primx.eu). The download URLs use opaque item_key paths rather than versioned filenames, making it harder to verify what is being fetched. The build process extracts the .deb with 'ar' and repackages the binaries without compilation. There are no GPG signature checks on the downloaded archives, only sha512sums. The sha512sums provide integrity protection against accidental corruption but not against a targeted substitution at the vendor host. Since these are executed binaries (encryption software) from a vendor host with non-transparent download URLs and no cryptographic signing verification beyond checksums, this is a genuine medium-severity supply-chain concern: if the vendor host or the opaque download endpoint were compromised, malicious binaries could be distributed. However, zedencrypt.com appears to be the legitimate vendor distribution channel for this proprietary software, so this is not clearly malicious — it is the standard pattern for proprietary closed-source AUR packages, just with less transparent download URLs than ideal.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("ZEDPRO-${pkgver}.Ubuntu.amd64.zip::https://www.zedencrypt.com/file/get/-/item_key/13802-25-299e76f8"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads prebuilt binaries (a Debian package inside a ZIP and a tarball) from zedencrypt.com, which is the official vendor site for Prim'X ZED! encryption software (primx.eu). The download URLs use opaque item_key paths rather than versioned filenames, making it harder to verify what is being fetched. The build process extracts the .deb with 'ar' and repackages the binaries without compilation. There are no GPG signature checks on the downloaded archives, only sha512sums. The sha512sums provide integrity protection against accidental corruption but not against a targeted substitution at the vendor host. Since these are executed binaries (encryption software) from a vendor host with non-transparent download URLs and no cryptographic signing verification beyond checksums, this is a genuine medium-severity supply-chain concern: if the vendor host or the opaque download endpoint were compromised, malicious binaries could be distributed. However, zedencrypt.com appears to be the legitimate vendor distribution channel for this proprietary software, so this is not clearly malicious — it is the standard pattern for proprietary closed-source AUR packages, just with less transparent download URLs than ideal.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Benjamin Vialle <archlinux@vialle.io>
    
      2# PGP ID: 72DF86FBBBBD5EDAE8FF1834826884A347F9FD9A
    
      3# Contributor: puleiya <ninettristan@gmail.com>
    
      4pkgname=zedpro
    
      5pkgver=2024.2.b2
    
      6pkgrel=1
    
      7pkgdesc="Zed! Encrypted containers manager"
    
      8arch=("x86_64")
    
      9url="http://www.primx.eu"
    
      10license=("Prim'X")
    
      11depends=("libxslt" "qt5-base" "hicolor-icon-theme" "libldap-2.5")
    
      12makedepends=("unzip")
    
      13conflicts=("zedfree")
    
      14options=("!strip" "!emptydirs")
    
      15install=${pkgname}.install
    
      16source=("ZEDPRO-${pkgver}.Ubuntu.amd64.zip::https://www.zedencrypt.com/file/get/-/item_key/13802-25-299e76f8"
    
      17        "AdminPack.Ubuntu.2023.5.tar.gz::https://www.zedencrypt.com/file/get/-/item_key/13802-52-8bb9a063")
    
      18sha512sums=("74c702b85fb99314b281c6dc7798f57025c39f86b7c85a8028c6c6cd6f804f6a0ee51750346edeee2907a4280d0ef282e84c26ebf8b5d663bf768d923ea63938"
    
      19            "c995b2312446918f80b4d89e25fcce58c7425919f603733063494ad497c2867b75ae888e40a06778a37e141499624facf5b628632c58aad7a2a1f3d66ab02ed0")
    
      20
    
      21build() {
    
      22    # Extract package data from Debian packages
    
      23    cd ${srcdir}
    
      24    ar -x Ubuntu\ 22.04/ZEDPRO-${pkgver%.b*}.Ubuntu22.04.amd64.deb
    
      25}
    
      26
    
      27package() {
    
      28    # Extract package data
    
      29    tar -xf "${srcdir}"/data.tar.zst -C "${pkgdir}"
    
      30    install -m755 zedcmd ${pkgdir}/usr/bin
    
      31    install -m644 "ZEDPRO Configuration Guide EN.pdf" "${pkgdir}/usr/share/doc/zed_pro/en/ZEDPRO Configuration Guide.pdf"
    
      32    find "${pkgdir}" -type d -print0 | xargs -0 chmod 755
    
      33}
    
      34

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2