cangjie-nightly-bin

maintainer AscendLiu · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged Downloads a prebuilt binary toolchain from gitcode.com/Cangjie/nightly_build, which is plausibly the official Cangjie language project release infrastructure, but checksums are SKIP'd and the host is non-standard; no obfuscation, exfiltration, or malicious payload is present, making this a low-risk packaging quality issue rather than a genuine threat.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Downloads a prebuilt binary toolchain from gitcode.com/Cangjie/nightly_build, which is plausibly the official Cangjie language project release infrastructure, but checksums are SKIP'd and the host is non-standard; no obfuscation, exfiltration, or malicious payload is present, making this a low-risk packaging quality issue rather than a genuine threat.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:27 source_x86_64=("cangjie-sdk-linux-x64-${pkgver}.tar.gz::https://gitcode.com/Cangjie/nightly_build/releases/download/${pkgver//_/-}/cangjie-sdk-linux-x64-${pkgver//_/-}.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: AscendLiu <ascendliu@qq.com>
    
      2# Contributor: ...
    
      3
    
      4pkgname=cangjie-nightly-bin
    
      5pkgver=1.2.0_alpha.20260707020028
    
      6pkgrel=1
    
      7pkgdesc='Cangjie programming language toolchain - Nightly channel (binary distribution)'
    
      8arch=('x86_64' 'aarch64')
    
      9url='https://cangjie-lang.cn'
    
      10license=('Apache-2.0')
    
      11options=('!strip' '!debug' '!emptydirs')
    
      12depends=(
    
      13  'glibc>=2.22'
    
      14  'gcc-libs'
    
      15  'openssl>=3.0.7'
    
      16  'zlib'
    
      17)
    
      18makedepends=('curl')
    
      19optdepends=(
    
      20  'clang: for Cangjie-C interop'
    
      21  'lldb: for cjdb debugger'
    
      22)
    
      23provides=('cangjie')
    
      24conflicts=('cangjie')
    
      25install=cangjie-nightly-bin.install
    
      26
    
      27source_x86_64=("cangjie-sdk-linux-x64-${pkgver}.tar.gz::https://gitcode.com/Cangjie/nightly_build/releases/download/${pkgver//_/-}/cangjie-sdk-linux-x64-${pkgver//_/-}.tar.gz")
    
      28source_aarch64=("cangjie-sdk-linux-aarch64-${pkgver}.tar.gz::https://gitcode.com/Cangjie/nightly_build/releases/download/${pkgver//_/-}/cangjie-sdk-linux-aarch64-${pkgver//_/-}.tar.gz")
    
      29sha256sums_x86_64=('SKIP')
    
      30sha256sums_aarch64=('SKIP')
    
      31
    
      32pkgver() {
    
      33  curl -sL 'https://api.gitcode.com/api/v5/repos/Cangjie/nightly_build/releases/latest' \
    
      34    | python3 -c "import sys,json;print(json.load(sys.stdin)['tag_name'].replace('-','_'))"
    
      35}
    
      36
    
      37build() {
    
      38  cd "$srcdir/cangjie"
    
      39
    
      40  # Remove non-Linux, non-current-arch runtime libraries
    
      41  if [[ -d runtime/lib ]]; then
    
      42    for _d in runtime/lib/*/; do
    
      43      [[ -d "$_d" ]] || continue
    
      44      _base="${_d%/}"; _base="${_base##*/}"
    
      45      [[ "$_base" == linux_${CARCH}_* ]] && continue
    
      46      rm -rf "$_d"
    
      47    done
    
      48  fi
    
      49
    
      50  # Remove non-Linux, non-current-arch compiler libraries
    
      51  if [[ -d lib ]]; then
    
      52    for _d in lib/*/; do
    
      53      [[ -d "$_d" ]] || continue
    
      54      _base="${_d%/}"; _base="${_base##*/}"
    
      55      [[ "$_base" == linux_${CARCH}_* ]] && continue
    
      56      rm -rf "$_d"
    
      57    done
    
      58  fi
    
      59
    
      60  # Remove non-Linux, non-current-arch modules
    
      61  if [[ -d modules ]]; then
    
      62    for _d in modules/*/; do
    
      63      [[ -d "$_d" ]] || continue
    
      64      _base="${_d%/}"; _base="${_base##*/}"
    
      65      [[ "$_base" == linux_${CARCH}_* ]] && continue
    
      66      rm -rf "$_d"
    
      67    done
    
      68  fi
    
      69}
    
      70
    
      71package() {
    
      72  cd "$srcdir/cangjie"
    
      73
    
      74  # 1. Install SDK to /opt/cangjie-nightly
    
      75  install -d "$pkgdir/opt/cangjie-nightly"
    
      76  cp -ar . "$pkgdir/opt/cangjie-nightly/"
    
      77
    
      78  # Fix permissions: SDK tarball ships 0750 (group-only), need world-read/exec
    
      79  chmod -R a+rX "$pkgdir/opt/cangjie-nightly"
    
      80
    
      81  # 2. Symlink all executables to /usr/bin/ for immediate PATH access
    
      82  install -d "$pkgdir/usr/bin"
    
      83  while IFS= read -r -d '' _bin; do
    
      84    _rel="${_bin#$pkgdir/}"
    
      85    ln -s "/$_rel" "$pkgdir/usr/bin/${_bin##*/}"
    
      86  done < <(find "$pkgdir/opt/cangjie-nightly/bin" "$pkgdir/opt/cangjie-nightly/tools/bin" -type f -executable -print0 2>/dev/null; :)
    
      87
    
      88  # 3. Register runtime libraries with ldconfig
    
      89  install -d "$pkgdir/etc/ld.so.conf.d"
    
      90  while IFS= read -r -d '' _libdir; do
    
      91    _rel="${_libdir#$pkgdir/}"
    
      92    echo "/$_rel" >> "$pkgdir/etc/ld.so.conf.d/cangjie-nightly.conf"
    
      93  done < <(find "$pkgdir/opt/cangjie-nightly/runtime/lib" -maxdepth 1 -type d -name 'linux_*' -print0 2>/dev/null; :)
    
      94
    
      95  # 4. Profile.d script for interactive-shell environment variables
    
      96  install -d "$pkgdir/etc/profile.d"
    
      97  cat > "$pkgdir/etc/profile.d/cangjie-nightly.sh" << 'PROFEOF'
    
      98# /etc/profile.d/cangjie-nightly.sh — Cangjie Nightly environment
    
      99
    
      100CANGJIE_HOME=/opt/cangjie-nightly
    
      101export CANGJIE_HOME
    
      102
    
      103case ":${PATH}:" in
    
      104  *:"${CANGJIE_HOME}/bin":*)  ;;
    
      105  *) PATH="${CANGJIE_HOME}/bin:${PATH}" ;;
    
      106esac
    
      107
    
      108case ":${PATH}:" in
    
      109  *:"${CANGJIE_HOME}/tools/bin":*)  ;;
    
      110  *) PATH="${CANGJIE_HOME}/tools/bin:${PATH}" ;;
    
      111esac
    
      112PROFEOF
    
      113  chmod 644 "$pkgdir/etc/profile.d/cangjie-nightly.sh"
    
      114
    
      115  # 5. Install license
    
      116  if [[ -f LICENSE ]]; then
    
      117    install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      118  fi
    
      119}
    
      120

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 00:17:08	LOW	3
2026-07-18 00:14:48	LOW	3
2026-07-17 00:06:16	LOW	3
2026-07-16 00:05:41	LOW	3
2026-07-15 00:09:25	LOW	3