zvvbook

maintainer Agafron · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary .deb package from Dropbox (a personal/unofficial host with no content-addressable guarantee beyond an MD5 checksum, which is cryptographically weak). The .deb is extracted and its contents installed directly into the package directory without any source compilation. Dropbox links can be swapped by the account owner at any time, and MD5 is insufficient to prevent a determined attacker from crafting a collision. The installed content is executed code (a Python/Qt application), not pure data. This is a genuine supply-chain concern: an unofficial, mutable host serving a prebuilt binary with only MD5 verification. The cheaper model's MEDIUM rating is correct.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("${_pkgname}_${pkgver}.deb::https://www.dropbox.com/s/tvyl44vt821bn7s/ZVVBook_051.deb?dl=0" "$pkgname" "${_pkgname}.desktop")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 85%): The PKGBUILD downloads a prebuilt binary .deb package from Dropbox (a personal/unofficial host with no content-addressable guarantee beyond an MD5 checksum, which is cryptographically weak). The .deb is extracted and its contents installed directly into the package directory without any source compilation. Dropbox links can be swapped by the account owner at any time, and MD5 is insufficient to prevent a determined attacker from crafting a collision. The installed content is executed code (a Python/Qt application), not pure data. This is a genuine supply-chain concern: an unofficial, mutable host serving a prebuilt binary with only MD5 verification. The cheaper model's MEDIUM rating is correct.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Вячеслав Зубик
    
      2
    
      3pkgname=zvvbook
    
      4_pkgname=ZVVBook
    
      5pkgbeta=beta
    
      6pkgver=5.1_$pkgbeta
    
      7pkgrel=3
    
      8pkgdesc="fb2, epub & pdf reader"
    
      9arch=('i386' 'x86_64')
    
      10url="https://zvvubuntu.blogspot.com"
    
      11license=('custom')
    
      12depends=('python-pyqt5') 
    
      13
    
      14source=("${_pkgname}_${pkgver}.deb::https://www.dropbox.com/s/tvyl44vt821bn7s/ZVVBook_051.deb?dl=0" "$pkgname" "${_pkgname}.desktop")
    
      15md5sums=('db903a0084e51cea040a2bb6b45a4bbf'
    
      16         'be29d1142c22607c19fefbf42f7aa2e4'
    
      17         '4c97905e644c0a2a8cdc1df864659828')
    
      18
    
      19package() {
    
      20  cd "${srcdir}"
    
      21  bsdtar -xf data.tar.xz -C "$pkgdir"
    
      22  install -Dm755 $pkgname $pkgdir/usr/bin/$pkgname
    
      23  install -Dm755 ${_pkgname}.desktop $pkgdir/usr/share/applications/$_pkgname.desktop
    
      24}
    
      25

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2