c2prog

maintainer giomba · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt self-extracting .run binary from c2prog.com (the vendor's own website) and executes it during the build phase. The sha256sum is pinned, which mitigates tampering in transit, but the fundamental concern remains: this is a closed-source, prebuilt executable from a small commercial vendor's website being executed on the build host. If c2prog.com were compromised or the file replaced (even with the same hash if the attacker controls the host before the hash was recorded), arbitrary code would run. The host is the official vendor URL matching the package URL field, so this is not a random personal host — it is the canonical upstream. However, executing a .run installer (which is essentially a shell script + binary payload) rather than extracting a clean archive is a legitimate supply-chain concern for AUR packaging. This is a real medium-severity concern: not clearly malicious, but an executed binary from a small commercial host with no independent verification beyond a single sha256sum.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:10 source=('https://c2prog.com/downloads/unpack_c2prog_2.0.5.run' 'c2prog-icon-128x128.png' 'c2prog.desktop')

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt self-extracting .run binary from c2prog.com (the vendor's own website) and executes it during the build phase. The sha256sum is pinned, which mitigates tampering in transit, but the fundamental concern remains: this is a closed-source, prebuilt executable from a small commercial vendor's website being executed on the build host. If c2prog.com were compromised or the file replaced (even with the same hash if the attacker controls the host before the hash was recorded), arbitrary code would run. The host is the official vendor URL matching the package URL field, so this is not a random personal host — it is the canonical upstream. However, executing a .run installer (which is essentially a shell script + binary payload) rather than extracting a clean archive is a legitimate supply-chain concern for AUR packaging. This is a real medium-severity concern: not clearly malicious, but an executed binary from a small commercial host with no independent verification beyond a single sha256sum.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Giovan Battista "giomba" Rolandi <giomba at glgprograms dot it>
    
      2pkgname=c2prog
    
      3pkgver=2.0.5
    
      4pkgrel=2
    
      5pkgdesc="Fast and easy-to-use programming tool for TI C2000 MCUs"
    
      6arch=('x86_64')
    
      7url="https://c2prog.com"
    
      8license=('custom')
    
      9depends=()
    
      10source=('https://c2prog.com/downloads/unpack_c2prog_2.0.5.run' 'c2prog-icon-128x128.png' 'c2prog.desktop')
    
      11sha256sums=('221651fcbd679f35ddb1b4f5a78f8374e4a2ccac768e02124dd519608ebc0e88' '0a35202e2865d620d306bee8b45455d7db005535d8aaf66610b6eb31a5819def' '5db9d89bbf009775f4cf079563eabf30b8b004a1c2eda51d44411dfb3139a211')
    
      12
    
      13prepare() {
    
      14  # apply patches here
    
      15  true
    
      16}
    
      17
    
      18build() {
    
      19  chmod +x unpack_c2prog_${pkgver}.run
    
      20  ./unpack_c2prog_${pkgver}.run
    
      21}
    
      22
    
      23package() {
    
      24  mkdir -p ${pkgdir}/opt/c2prog
    
      25  cp -r ${srcdir}/c2prog_v2.x/* ${pkgdir}/opt/c2prog
    
      26
    
      27  cp c2prog-icon-128x128.png ${pkgdir}/opt/c2prog
    
      28
    
      29  mkdir -p ${pkgdir}/usr/share/applications
    
      30  cp c2prog.desktop ${pkgdir}/usr/share/applications
    
      31}
    
      32
    
      33

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2