apollo-neo-env-manager-dev

maintainer SakuraPuare · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD installs a prebuilt binary .deb package from apollo-pkg-beta.cdn.bcebos.com, which is Baidu's CDN (bcebos.com is Baidu Cloud Object Storage). Apollo is an open-source autonomous driving platform by Baidu (github.com/ApolloAuto/apollo), so this is the official upstream vendor's CDN, not a random personal host. However, several concerns remain: (1) The LICENSE file from GitHub has SKIP'd checksum, which is sloppy but low risk. (2) The .deb binary itself has a pinned sha256sum (a51f016...), which is good practice and mitigates silent substitution risk. (3) The GPG key also has a pinned checksum. The main residual concern is that the binary is a prebuilt executable from a CDN (even if vendor-owned) rather than built from source, and the GPG key is installed as a data file rather than used to verify the .deb before installation — meaning the package doesn't actually cryptographically verify the .deb contents at install time. The sha256 pin on the .deb provides some integrity guarantee, but the overall pattern of installing an unverified prebuilt binary (GPG key not used for verification during build) from a CDN warrants medium severity. The host is plausibly official (Baidu's own CDN for Apollo), which lowers confidence that this is a genuine threat, but the execution of unverified prebuilt binaries remains a real supply-chain concern.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 "apollo-gpg-key::https://apollo-pkg-beta.cdn.bcebos.com/neo/beta/key/deb.gpg.key"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD installs a prebuilt binary .deb package from apollo-pkg-beta.cdn.bcebos.com, which is Baidu's CDN (bcebos.com is Baidu Cloud Object Storage). Apollo is an open-source autonomous driving platform by Baidu (github.com/ApolloAuto/apollo), so this is the official upstream vendor's CDN, not a random personal host. However, several concerns remain: (1) The LICENSE file from GitHub has SKIP'd checksum, which is sloppy but low risk. (2) The .deb binary itself has a pinned sha256sum (a51f016...), which is good practice and mitigates silent substitution risk. (3) The GPG key also has a pinned checksum. The main residual concern is that the binary is a prebuilt executable from a CDN (even if vendor-owned) rather than built from source, and the GPG key is installed as a data file rather than used to verify the .deb before installation — meaning the package doesn't actually cryptographically verify the .deb contents at install time. The sha256 pin on the .deb provides some integrity guarantee, but the overall pattern of installing an unverified prebuilt binary (GPG key not used for verification during build) from a CDN warrants medium severity. The host is plausibly official (Baidu's own CDN for Apollo), which lowers confidence that this is a genuine threat, but the execution of unverified prebuilt binaries remains a real supply-chain concern.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: SakuraPuare <sakurapuare@sakurapuare.com>
    
      2
    
      3pkgname=apollo-neo-env-manager-dev
    
      4pkgver=10.0.0rc1.r4
    
      5pkgrel=3
    
      6pkgdesc="Apollo Environment Manager"
    
      7arch=('x86_64')
    
      8url="https://apollo.baidu.com/"
    
      9license=('custom')
    
      10depends=('bash-completion' 'python' 'python-requests' 'sudo' 'curl' 'gnupg' 'ca-certificates' 'inetutils')
    
      11optdepends=('google-cloud-cli: 对接Google云服务')
    
      12makedepends=('binutils')
    
      13provides=("${pkgname}")
    
      14conflicts=("${pkgname}")
    
      15install="${pkgname}.install"
    
      16source=("apollo_neo_license::https://github.com/ApolloAuto/apollo/raw/refs/heads/master/LICENSE"
    
      17        "apollo-gpg-key::https://apollo-pkg-beta.cdn.bcebos.com/neo/beta/key/deb.gpg.key"
    
      18        "${pkgname}-deb::https://apollo-pkg-beta.cdn.bcebos.com/apollo/core/pool/main/a/${pkgname}/${pkgname}_10.0.0-rc1-r4_amd64.deb")
    
      19noextract=("${pkgname}-deb")
    
      20sha256sums=('SKIP'
    
      21            '52fe1c504d1bae9d48f977ef4d181fd7f916747c32d8649a1d290e77dc70800d'
    
      22            'a51f016eaf57d0e1d13e838978b6fbd67f7a6275bf271fdca782746edddda9ef')
    
      23options=('!strip')
    
      24
    
      25prepare() {
    
      26  cd "${srcdir}"
    
      27  # 创建提取目录
    
      28  mkdir -p extract
    
      29  
    
      30  # 提取deb包
    
      31  bsdtar -xf "${pkgname}-deb" -C extract
    
      32  
    
      33  # 检查数据包是否存在
    
      34  if ! ls extract/data.tar.* >/dev/null 2>&1; then
    
      35    echo "错误：无法找到deb包中的数据文件"
    
      36    exit 1
    
      37  fi
    
      38}
    
      39
    
      40package() {
    
      41  # 提取deb包内容到目标目录
    
      42  cd "${srcdir}"
    
      43  
    
      44  # 根据deb包中的数据包格式自动决定如何提取
    
      45  if tar -tf extract/data.tar.* 2>/dev/null | grep -q .; then
    
      46    for archive in extract/data.tar.*; do
    
      47      case "$archive" in
    
      48        *.tar.xz)
    
      49          bsdtar -xf "$archive" -C "${pkgdir}"
    
      50          ;;
    
      51        *.tar.gz)
    
      52          bsdtar -xf "$archive" -C "${pkgdir}"
    
      53          ;;
    
      54        *.tar.zst)
    
      55          bsdtar -xf "$archive" -C "${pkgdir}"
    
      56          ;;
    
      57        *)
    
      58          echo "未知的压缩格式: $archive"
    
      59          exit 1
    
      60          ;;
    
      61      esac
    
      62    done
    
      63  else
    
      64    echo "无法识别deb包中的数据文件格式"
    
      65    exit 1
    
      66  fi
    
      67  
    
      68  # 安装GPG密钥
    
      69  install -dm755 "${pkgdir}/usr/share/${pkgname}"
    
      70  install -Dm644 "${srcdir}/apollo-gpg-key" "${pkgdir}/usr/share/${pkgname}/apollo.gpg.key"
    
      71  
    
      72  # 安装许可证文件
    
      73  install -Dm644 "${srcdir}/apollo_neo_license" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      74}
    
      75

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2