cangjie-nightly-bin

LOW
maintainer AscendLiu 0 votes scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

Downloads a prebuilt binary toolchain from gitcode.com/Cangjie/nightly_build, which is plausibly the official Cangjie language project release infrastructure, but checksums are SKIP'd and the host is non-standard; no obfuscation, exfiltration, or malicious payload is present, making this a low-risk packaging quality issue rather than a genuine threat.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Downloads a prebuilt binary toolchain from gitcode.com/Cangjie/nightly_build, which is plausibly the official Cangjie language project release infrastructure, but checksums are SKIP'd and the host is non-standard; no obfuscation, exfiltration, or malicious payload is present, making this a low-risk packaging quality issue rather than a genuine threat.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:27 source_x86_64=("cangjie-sdk-linux-x64-${pkgver}.tar.gz::https://gitcode.com/Cangjie/nightly_build/releases/download/${pkgver//_/-}/cangjie-sdk-linux-x64-${pkgver//_/-}.tar.gz")

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: AscendLiu <ascendliu@qq.com>
2# Contributor: ...
3
4pkgname=cangjie-nightly-bin
5pkgver=1.2.0_alpha.20260707020028
6pkgrel=1
7pkgdesc='Cangjie programming language toolchain - Nightly channel (binary distribution)'
8arch=('x86_64' 'aarch64')
9url='https://cangjie-lang.cn'
10license=('Apache-2.0')
11options=('!strip' '!debug' '!emptydirs')
12depends=(
13 'glibc>=2.22'
14 'gcc-libs'
15 'openssl>=3.0.7'
16 'zlib'
17)
18makedepends=('curl')
19optdepends=(
20 'clang: for Cangjie-C interop'
21 'lldb: for cjdb debugger'
22)
23provides=('cangjie')
24conflicts=('cangjie')
25install=cangjie-nightly-bin.install
26
27source_x86_64=("cangjie-sdk-linux-x64-${pkgver}.tar.gz::https://gitcode.com/Cangjie/nightly_build/releases/download/${pkgver//_/-}/cangjie-sdk-linux-x64-${pkgver//_/-}.tar.gz")
28source_aarch64=("cangjie-sdk-linux-aarch64-${pkgver}.tar.gz::https://gitcode.com/Cangjie/nightly_build/releases/download/${pkgver//_/-}/cangjie-sdk-linux-aarch64-${pkgver//_/-}.tar.gz")
29sha256sums_x86_64=('SKIP')
30sha256sums_aarch64=('SKIP')
31
32pkgver() {
33 curl -sL 'https://api.gitcode.com/api/v5/repos/Cangjie/nightly_build/releases/latest' \
34 | python3 -c "import sys,json;print(json.load(sys.stdin)['tag_name'].replace('-','_'))"
35}
36
37build() {
38 cd "$srcdir/cangjie"
39
40 # Remove non-Linux, non-current-arch runtime libraries
41 if [[ -d runtime/lib ]]; then
42 for _d in runtime/lib/*/; do
43 [[ -d "$_d" ]] || continue
44 _base="${_d%/}"; _base="${_base##*/}"
45 [[ "$_base" == linux_${CARCH}_* ]] && continue
46 rm -rf "$_d"
47 done
48 fi
49
50 # Remove non-Linux, non-current-arch compiler libraries
51 if [[ -d lib ]]; then
52 for _d in lib/*/; do
53 [[ -d "$_d" ]] || continue
54 _base="${_d%/}"; _base="${_base##*/}"
55 [[ "$_base" == linux_${CARCH}_* ]] && continue
56 rm -rf "$_d"
57 done
58 fi
59
60 # Remove non-Linux, non-current-arch modules
61 if [[ -d modules ]]; then
62 for _d in modules/*/; do
63 [[ -d "$_d" ]] || continue
64 _base="${_d%/}"; _base="${_base##*/}"
65 [[ "$_base" == linux_${CARCH}_* ]] && continue
66 rm -rf "$_d"
67 done
68 fi
69}
70
71package() {
72 cd "$srcdir/cangjie"
73
74 # 1. Install SDK to /opt/cangjie-nightly
75 install -d "$pkgdir/opt/cangjie-nightly"
76 cp -ar . "$pkgdir/opt/cangjie-nightly/"
77
78 # Fix permissions: SDK tarball ships 0750 (group-only), need world-read/exec
79 chmod -R a+rX "$pkgdir/opt/cangjie-nightly"
80
81 # 2. Symlink all executables to /usr/bin/ for immediate PATH access
82 install -d "$pkgdir/usr/bin"
83 while IFS= read -r -d '' _bin; do
84 _rel="${_bin#$pkgdir/}"
85 ln -s "/$_rel" "$pkgdir/usr/bin/${_bin##*/}"
86 done < <(find "$pkgdir/opt/cangjie-nightly/bin" "$pkgdir/opt/cangjie-nightly/tools/bin" -type f -executable -print0 2>/dev/null; :)
87
88 # 3. Register runtime libraries with ldconfig
89 install -d "$pkgdir/etc/ld.so.conf.d"
90 while IFS= read -r -d '' _libdir; do
91 _rel="${_libdir#$pkgdir/}"
92 echo "/$_rel" >> "$pkgdir/etc/ld.so.conf.d/cangjie-nightly.conf"
93 done < <(find "$pkgdir/opt/cangjie-nightly/runtime/lib" -maxdepth 1 -type d -name 'linux_*' -print0 2>/dev/null; :)
94
95 # 4. Profile.d script for interactive-shell environment variables
96 install -d "$pkgdir/etc/profile.d"
97 cat > "$pkgdir/etc/profile.d/cangjie-nightly.sh" << 'PROFEOF'
98# /etc/profile.d/cangjie-nightly.sh — Cangjie Nightly environment
99
100CANGJIE_HOME=/opt/cangjie-nightly
101export CANGJIE_HOME
102
103case ":${PATH}:" in
104 *:"${CANGJIE_HOME}/bin":*) ;;
105 *) PATH="${CANGJIE_HOME}/bin:${PATH}" ;;
106esac
107
108case ":${PATH}:" in
109 *:"${CANGJIE_HOME}/tools/bin":*) ;;
110 *) PATH="${CANGJIE_HOME}/tools/bin:${PATH}" ;;
111esac
112PROFEOF
113 chmod 644 "$pkgdir/etc/profile.d/cangjie-nightly.sh"
114
115 # 5. Install license
116 if [[ -f LICENSE ]]; then
117 install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
118 fi
119}
120

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Low 2
2026-09-16 00:03:17 Low 2
2026-09-15 00:25:31 Low 2
2026-09-14 00:27:57 Low 2
2026-09-13 00:19:54 Low 2
2026-09-12 00:25:17 Low 2
2026-09-11 00:19:22 Low 2
2026-09-10 00:22:44 Low 2
2026-09-09 00:04:09 Low 2
2026-09-08 00:18:08 Low 2
2026-09-07 00:30:15 Low 2
2026-09-06 00:17:06 Low 2
2026-09-05 00:16:27 Low 2
2026-09-04 00:03:13 Low 2
2026-09-03 00:15:47 Low 2
2026-09-02 00:02:31 Low 2
2026-09-01 00:11:19 Low 2
2026-08-31 00:19:57 Low 2
2026-08-30 00:04:14 Low 2
2026-08-29 00:29:17 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion