azure-sphere-sdk

maintainer orphaned · 2 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is downloaded from Microsoft's official aka.ms redirector to their Azure Sphere SDK, which is a legitimate product; the package builds from an official vendor release, so despite the non-standard host, it is not a supply-chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is downloaded from Microsoft's official aka.ms redirector to their Azure Sphere SDK, which is a legitimate product; the package builds from an official vendor release, so despite the non-standard host, it is not a supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:21 source=("${pkgname}-${pkgver}.tar.gz::https://aka.ms/AzureSphereSDKDownload/Linux"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Felipe Balbi <felipe.balbi@microsoft.com>
    
      2pkgname=azure-sphere-sdk
    
      3pkgmajor=22
    
      4pkgminor=11
    
      5pkgver=${pkgmajor}.${pkgminor}
    
      6pkgrel=1
    
      7pkgdesc="Azure Sphere SDK Preview for Linux"
    
      8arch=('x86_64')
    
      9url="https://aka.ms/AzureSphereSDK"
    
      10license=('custom')
    
      11depends=('cmake'
    
      12	 'curl'
    
      13	 'flex'
    
      14	 'libmpc'
    
      15	 'net-tools'
    
      16	 'ninja')
    
      17install="${pkgname}".install
    
      18optdepends=('minicom: for serial communication with the Sphere board'
    
      19	    'code: for software development')
    
      20options=(!strip staticlibs)
    
      21source=("${pkgname}-${pkgver}.tar.gz::https://aka.ms/AzureSphereSDKDownload/Linux"
    
      22        "azure-sphere-sdk.udev"
    
      23        "azure-sphere-sdk.sysusers")
    
      24sha256sums=('47418d96466c91ede13828d8ad2773e5a2a008f880c25d436a058c87ad502e27'
    
      25            '649ec04bdd0c052838bf3364fdd32313264891c4f7f60039cb644ef79c3c589f'
    
      26            '0afb48362c9684940c02d45136998267cbda7196ce04ab9933687f82165af9d4')
    
      27
    
      28prepare() {
    
      29  tar -zxf "Azure_Sphere_SDK.tar.gz"
    
      30}
    
      31
    
      32build() {
    
      33  find "${srcdir}" -type d -exec chmod 755 {} \;
    
      34  find "${srcdir}" -type f -exec chmod 644 {} \;
    
      35
    
      36  mkdir -p "${srcdir}"/azurespheresdk/Tools_v2
    
      37  tar -zxf "${srcdir}"/azurespheresdk/Tools_v2_Installer/azsphere-cli-v2.tar.gz -C "${srcdir}"/azurespheresdk/Tools_v2
    
      38  cp "${srcdir}"/azurespheresdk/Tools_v2_Installer/azsphere.completion "${srcdir}"/azurespheresdk/Tools_v2/azsphere.completion
    
      39  rm -rf "${srcdir}"/azurespheresdk/Tools_v2_Installer
    
      40
    
      41  chmod 755 "${srcdir}"/azurespheresdk/Tools_v2/azsphere
    
      42  chmod 755 "${srcdir}"/azurespheresdk/Tools/azsphere
    
      43  chmod 755 "${srcdir}"/azurespheresdk/DeviceConnection/azsphere_slattach
    
      44  chmod 755 "${srcdir}"/azurespheresdk/DeviceConnection/azsphere_connect.sh
    
      45
    
      46  for sysroot in $(ls "${srcdir}"/azurespheresdk/Sysroots/); do
    
      47    chmod 755 "${srcdir}"/azurespheresdk/Sysroots/"${sysroot}"/tools/exp23-appsdk-linux-blanca.sh
    
      48  done
    
      49}
    
      50
    
      51package() {
    
      52  install -Dm644 "${srcdir}"/azurespheresdk/LICENSE_en-US.TXT "${pkgdir}"/usr/share/licenses/"${pkgname}"/LICENSE_en-US
    
      53  install -Dm644 "${srcdir}"/azurespheresdk/LICENSE_fr-FR.TXT "${pkgdir}"/usr/share/licenses/"${pkgname}"/LICENSE_fr-FR
    
      54  install -Dm644 "${srcdir}"/"${pkgname}".udev "${pkgdir}"/etc/udev/rules.d/75-mt3620.rules
    
      55  install -Dm644 "${srcdir}"/"${pkgname}".sysusers "${pkgdir}"/usr/lib/sysusers.d/"${pkgname}".conf
    
      56
    
      57  mkdir -p "${pkgdir}"/opt/azurespheresdk
    
      58
    
      59  for DIRPATH in $(ls -d "${srcdir}"/azurespheresdk/*/); do
    
      60    cp -r "${DIRPATH}" "${pkgdir}"/opt/azurespheresdk
    
      61  done
    
      62  echo "${pkgver}" > "${pkgdir}"/opt/azurespheresdk/VERSION
    
      63
    
      64  mkdir -p "${pkgdir}"/usr/bin
    
      65  mkdir -p "${pkgdir}"/usr/share/bash-completion/completions
    
      66  ln -s ../../../../opt/azurespheresdk/Tools_v2/azsphere.completion \
    
      67     "${pkgdir}"/usr/share/bash-completion/completions/azsphere
    
      68  ln -s ../../opt/azurespheresdk/Tools/azsphere "${pkgdir}"/usr/bin/azsphere_v1
    
      69  ln -s ../../opt/azurespheresdk/Tools_v2/azsphere "${pkgdir}"/usr/bin/azsphere_v2
    
      70  ln -s azsphere_v2 "${pkgdir}"/usr/bin/azsphere
    
      71  ln -s ../../opt/azurespheresdk/DeviceConnection/azsphere_connect.sh "${pkgdir}"/usr/bin/azsphere_connect.sh
    
      72  ln -s ../../opt/azurespheresdk/DeviceConnection/azsphere_slattach "${pkgdir}"/usr/bin/azsphere_slattach
    
      73}
    
      74

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2