cformat

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads and installs two prebuilt binaries (cformat and clang-format) from Gitee file attachment URLs belonging to a personal/unofficial repository. These are not official upstream release artifacts — clang-format in particular should come from LLVM's official releases, not a personal Gitee account's attachment storage. The binaries are installed as executable (Dm777) system binaries. While MD5 checksums are provided, MD5 is cryptographically weak and the checksums only verify file integrity against the specific hosted files, not authenticity. The attachment URL scheme (attach_files/NNNNNN/download/) is opaque and not tied to a tagged release or verifiable build. This is a genuine supply-chain concern: users are running arbitrary prebuilt binaries from an unofficial personal host with no source build, no GPG signing, and weak checksums. The cheaper model's MEDIUM rating is correct.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("https://gitee.com/duapple/go_projects/attach_files/904851/download/clang-format"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 85%): This PKGBUILD downloads and installs two prebuilt binaries (cformat and clang-format) from Gitee file attachment URLs belonging to a personal/unofficial repository. These are not official upstream release artifacts — clang-format in particular should come from LLVM's official releases, not a personal Gitee account's attachment storage. The binaries are installed as executable (Dm777) system binaries. While MD5 checksums are provided, MD5 is cryptographically weak and the checksums only verify file integrity against the specific hosted files, not authenticity. The attachment URL scheme (attach_files/NNNNNN/download/) is opaque and not tied to a tagged release or verifiable build. This is a genuine supply-chain concern: users are running arbitrary prebuilt binaries from an unofficial personal host with no source build, no GPG signing, and weak checksums. The cheaper model's MEDIUM rating is correct.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: duapple <2832893880@qq.com>
    
      2
    
      3pkgname=cformat
    
      4pkgver=0.1.0
    
      5pkgrel=1
    
      6pkgdesc="format C/C++ file"
    
      7arch=('x86_64')
    
      8url="https://gitee.com/duapple/go_projects/attach_files/904852/download/cformat"
    
      9license=('unknow')
    
      10depends=()
    
      11makedepends=("git")
    
      12optdepends=()
    
      13source=("https://gitee.com/duapple/go_projects/attach_files/904851/download/clang-format"
    
      14        "${url}"
    
      15        "https://gitee.com/duapple/go_projects/attach_files/904850/download/.clang-format")
    
      16noextract=()
    
      17md5sums=("ae1f245d659b0a180d483b4240f7ebd6" "6061ca24978dbd8dd50e7b03571c7111" "da2c17594374202bff1d26677c633176")
    
      18
    
      19prepare() {
    
      20    rm -rf ${pkgname}-${pkgver}
    
      21    mkdir -p ${pkgname}-${pkgver}
    
      22    mv cformat ${pkgname}-${pkgver}
    
      23    mv clang-format ${pkgname}-${pkgver}
    
      24    mv .clang-format ${pkgname}-${pkgver}
    
      25}
    
      26
    
      27package() {
    
      28    mkdir -p ${pkgdir}/usr/share/${pkgname}/  
    
      29    mkdir -p ${pkgdir}/usr/share/${pkgname}/config
    
      30    mkdir -p ${pkgdir}/usr/share/${pkgname}/bin
    
      31    cd ${pkgname}-${pkgver}
    
      32    install -Dm777 ${pkgname} ${pkgdir}/usr/bin/${pkgname}
    
      33    install -Dm777 clang-format ${pkgdir}/usr/share/${pkgname}/bin/
    
      34    cp .clang-format ${pkgdir}/usr/share/${pkgname}/config/
    
      35}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2