aiot-ide

maintainer OrPudding · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary .deb from 'vela-ide.cnbj3-fusion.mi-fds.com', which is a Xiaomi/Mi CDN/storage subdomain (mi-fds.com is Xiaomi's file distribution service). The URL structure and package content (AIoT IDE for Xiaomi Vela/quickApp development) are consistent with an official Xiaomi developer tool. However, this is still a prebuilt, closed-source binary blob from a vendor CDN rather than a reproducible build from source, and the host is not the primary project domain (iot.mi.com). A sha256sum is provided, which mitigates substitution risk at the current version. The PKGBUILD itself is straightforward: it extracts the .deb and installs files. The main concern is the standard supply-chain risk of executing a proprietary prebuilt binary from a CDN — if the CDN were compromised or the URL reused for a different binary, the sha256 check would catch it for the pinned version but future updates could silently introduce malicious code. This is a legitimate medium-severity concern (prebuilt binary from unofficial/CDN host) but not an active attack.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:40 source=("$pkgname-$pkgver.deb::https://vela-ide.cnbj3-fusion.mi-fds.com/vela-ide/ide/v1.7.0/AIoT_IDE_ubuntu.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary .deb from 'vela-ide.cnbj3-fusion.mi-fds.com', which is a Xiaomi/Mi CDN/storage subdomain (mi-fds.com is Xiaomi's file distribution service). The URL structure and package content (AIoT IDE for Xiaomi Vela/quickApp development) are consistent with an official Xiaomi developer tool. However, this is still a prebuilt, closed-source binary blob from a vendor CDN rather than a reproducible build from source, and the host is not the primary project domain (iot.mi.com). A sha256sum is provided, which mitigates substitution risk at the current version. The PKGBUILD itself is straightforward: it extracts the .deb and installs files. The main concern is the standard supply-chain risk of executing a proprietary prebuilt binary from a CDN — if the CDN were compromised or the URL reused for a different binary, the sha256 check would catch it for the pinned version but future updates could silently introduce malicious code. This is a legitimate medium-severity concern (prebuilt binary from unofficial/CDN host) but not an active attack.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: OrPudding <t3164473115@163.com>
    
      2pkgname=aiot-ide
    
      3pkgver=1.7.0
    
      4pkgrel=1
    
      5pkgdesc="Code editing. Redefined. AIoT IDE is the first choice for developing quickApp."
    
      6arch=('x86_64')
    
      7url="https://iot.mi.com/vela/quickapp/"
    
      8license=('custom')
    
      9options=('!debug')
    
      10depends=(
    
'ca-certificates'
    
'alsa-lib'
    
'at-spi2-core'
    
'atk'
    
'cairo'
    
'cups'
    
'curl'
    
'dbus'
    
'expat'
    
'gcc-libs'
    
'glib2'
    
'gtk3'
    
'libx11'
    
'libxcb'
    
'libxcomposite'
    
'libxdamage'
    
'libxext'
    
'libxfixes'
    
'libxkbcommon'
    
'libxkbfile'
    
'libxrandr'
    
'mesa'
    
'nspr'
    
'nss'
    
'pango'
    
'systemd-libs'
    
'xdg-utils'
    
'vulkan-icd-loader'
    
      39)
    
      40source=("$pkgname-$pkgver.deb::https://vela-ide.cnbj3-fusion.mi-fds.com/vela-ide/ide/v1.7.0/AIoT_IDE_ubuntu.deb")
    
      41sha256sums=('37809fde16cac7838e757e81754236f235af7180a56ecf40c78ad8030f5533e6')
    
      42
    
      43prepare() {
    
# Extract DEB package
    
ar x "$pkgname-$pkgver.deb"
    
tar -xf data.tar.*
    
      47}
    
      48
    
      49package() {
    
# Copy all files
    
cp -r usr "$pkgdir"
    

    
# Create executable symlink
    
install -d "$pkgdir/usr/bin/"
    
ln -s "/usr/share/$pkgname/bin/$pkgname" "$pkgdir/usr/bin/$pkgname"
    

    
# Fix permissions
    
find "$pkgdir/usr/share/$pkgname" -type d -exec chmod 755 {} \;
    
find "$pkgdir/usr/share/$pkgname" -type f -executable -exec chmod 755 {} \;
    

    
# Fix desktop files
    
find "$pkgdir/usr/share/applications" -name "*.desktop" -exec chmod 644 {} \;
    

    
# Install license
    
if [ -f "$pkgdir/usr/share/$pkgname/LICENSE.txt" ]; then
    
  install -Dm644 "$pkgdir/usr/share/$pkgname/LICENSE.txt" \
    
    "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
elif [ -f "$pkgdir/usr/share/$pkgname/LICENSES.chromium.html" ]; then
    
  install -Dm644 "$pkgdir/usr/share/$pkgname/LICENSES.chromium.html" \
    
    "$pkgdir/usr/share/licenses/$pkgname/LICENSE.html"
    
else
    
  install -Dm644 /dev/null "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
  echo "Proprietary license - see package source" > "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
fi
    

    
# Fix icon permissions
    
if [ -d "$pkgdir/usr/share/pixmaps" ]; then
    
  find "$pkgdir/usr/share/pixmaps" -type f -exec chmod 644 {} \;
    
fi
    

    
# Ensure sandbox is executable
    
if [ -f "$pkgdir/usr/share/$pkgname/chrome-sandbox" ]; then
    
  chmod 4755 "$pkgdir/usr/share/$pkgname/chrome-sandbox"
    
fi
    
      85}
    
      86

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2