zvvradio

maintainer Agafron · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged A prebuilt binary .deb is downloaded from Dropbox (a personal/unofficial host with no content-addressable guarantee beyond a weak MD5 checksum). The .deb's data.tar.xz is extracted and installed directly into the package tree, meaning whatever binaries/scripts are inside get installed to the system. Dropbox links can be silently replaced by the owner at any time, and MD5 is cryptographically broken and trivially collided. The maintainer's blog URL suggests this is a personal project distributed via personal cloud storage rather than any official release infrastructure. This is a genuine supply-chain concern: an executed binary from an unofficial, swappable host with only a broken hash for integrity. The cheaper model's MEDIUM rating is correct.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("${_pkgname}_${pkgver}.deb::https://www.dropbox.com/s/ad7llycxk5km9ps/ZVVRadio2.deb?dl=0" "$pkgname" "Radio.desktop")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): A prebuilt binary .deb is downloaded from Dropbox (a personal/unofficial host with no content-addressable guarantee beyond a weak MD5 checksum). The .deb's data.tar.xz is extracted and installed directly into the package tree, meaning whatever binaries/scripts are inside get installed to the system. Dropbox links can be silently replaced by the owner at any time, and MD5 is cryptographically broken and trivially collided. The maintainer's blog URL suggests this is a personal project distributed via personal cloud storage rather than any official release infrastructure. This is a genuine supply-chain concern: an executed binary from an unofficial, swappable host with only a broken hash for integrity. The cheaper model's MEDIUM rating is correct.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Вячеслав Зубик
    
      2
    
      3pkgname=zvvradio
    
      4_pkgname=ZVVRadio
    
      5pkgver=2.0
    
      6#_pkgver=2
    
      7pkgrel=2
    
      8pkgdesc="radio player"
    
      9arch=('i386' 'x86_64')
    
      10url="https://zvvubuntu.blogspot.com"
    
      11license=('custom')
    
      12depends=('python-pyqt5' 'vlc') 
    
      13conflicts=("zvvradio-git")
    
      14source=("${_pkgname}_${pkgver}.deb::https://www.dropbox.com/s/ad7llycxk5km9ps/ZVVRadio2.deb?dl=0" "$pkgname" "Radio.desktop")
    
      15md5sums=('970583d63a06fed0d2ee8079a61a3e13'
    
      16         'dc95737680e936786d9e23eb7a9a1514'
    
      17         'eafda782b08cc9e7246a95d49ef04418')
    
      18
    
      19package() {
    
      20  cd "${srcdir}"
    
      21  bsdtar -xf data.tar.xz -C "$pkgdir"
    
      22  install -Dm755 $pkgname $pkgdir/usr/bin/$pkgname
    
      23  install -Dm755 Radio.desktop $pkgdir/usr/share/applications/$_pkgname.desktop
    
      24}
    
      25

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2