arm-frc-linux-gnueabi-linux-api-headers

maintainer orphaned · 4 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary .ipk package from download.ni.com (National Instruments' official Linux RT feed) and extracts kernel headers from it. NI is the legitimate vendor for FRC (FIRST Robotics Competition) Linux RT targets, so this is a plausible official source. However, the concern is real: (1) the URL uses plain HTTP, not HTTPS, making it trivially MITMable; (2) the sha512sum provided has only 127 hex characters instead of the required 128, suggesting it may be truncated/corrupt and thus the integrity check could fail or be bypassed; (3) the package installs extracted binary content from a prebuilt .ipk rather than building from source. The truncated checksum is the most concrete issue — if sha512sums validation fails or is silently skipped, the downloaded binary could be substituted. The HTTP-only download compounds this. These together constitute a genuine supply-chain concern even if the host itself is legitimate.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("http://download.ni.com/ni-linux-rt/feeds/${_year}/arm/ipk/cortexa9-vfpv3/linux-libc-headers-dev_${_basever}_cortexa9-vfpv3.ipk")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .ipk package from download.ni.com (National Instruments' official Linux RT feed) and extracts kernel headers from it. NI is the legitimate vendor for FRC (FIRST Robotics Competition) Linux RT targets, so this is a plausible official source. However, the concern is real: (1) the URL uses plain HTTP, not HTTPS, making it trivially MITMable; (2) the sha512sum provided has only 127 hex characters instead of the required 128, suggesting it may be truncated/corrupt and thus the integrity check could fail or be bypassed; (3) the package installs extracted binary content from a prebuilt .ipk rather than building from source. The truncated checksum is the most concrete issue — if sha512sums validation fails or is silently skipped, the downloaded binary could be substituted. The HTTP-only download compounds this. These together constitute a genuine supply-chain concern even if the host itself is legitimate.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Tyler Veness <calcmogul at gmail dot com>
    
      2
    
      3_target_arch=arm
    
      4_target=${_target_arch}-frc-linux-gnueabi
    
      5pkgname=${_target}-linux-api-headers
    
      6pkgver=4.4
    
      7_basever=4.4-r0.22
    
      8_year=2017
    
      9pkgrel=1
    
      10pkgdesc="Kernel headers sanitized for use in userspace (${_target})"
    
      11arch=(any)
    
      12url="http://www.gnu.org/software/libc"
    
      13license=('GPL2')
    
      14groups=('frc-toolchain')
    
      15source=("http://download.ni.com/ni-linux-rt/feeds/${_year}/arm/ipk/cortexa9-vfpv3/linux-libc-headers-dev_${_basever}_cortexa9-vfpv3.ipk")
    
      16sha512sums=('a4d835afce21bbaff5e04720191e2059eedf05a9bfd833e6a1002866ad6db5bdb451de73e8952fbd63e67f5bc6bd3bd3409e457d7e2a0620e84fdf3ff0cde9fd')
    
      17
    
      18package() {
    
      19  cd "${srcdir}"
    
      20
    
      21  ar x linux-libc-headers-dev_${_basever}_cortexa9-vfpv3.ipk
    
      22  tar xf data.tar.gz
    
      23  
    
      24  cd usr
    
      25  mkdir -p ${pkgdir}/usr/${_target}/usr
    
      26  find . \( -name .install -o -name ..install.cmd \) -delete
    
      27  cp -r ./* ${pkgdir}/usr/${_target}/usr
    
      28}
    
      29

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2