cgpt-bin

maintainer leahanderson · 3 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt x86_64 binary from files.tree123.org, which has no affiliation with the Chromium OS project or Google. The binary is installed directly to /usr/bin and executed on the user's system. While a sha512sum is provided, this only guarantees integrity against the specific file on that host — if the host was compromised at the time the checksum was recorded, or if the maintainer controls both the host and the PKGBUILD, the checksum provides no meaningful trust guarantee. The official source for cgpt is the ChromiumOS vboot_reference repository (chromium.googlesource.com), and prebuilt binaries should come from official ChromiumOS image releases or be compiled from source. Distributing an opaque prebuilt binary from a personal/unofficial host is a genuine supply-chain concern. This is a textbook medium-severity case: executed binary from an unofficial host.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("cgpt::https://files.tree123.org/utils/x86_64/gnu/cgpt")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 85%): This PKGBUILD downloads a prebuilt x86_64 binary from files.tree123.org, which has no affiliation with the Chromium OS project or Google. The binary is installed directly to /usr/bin and executed on the user's system. While a sha512sum is provided, this only guarantees integrity against the specific file on that host — if the host was compromised at the time the checksum was recorded, or if the maintainer controls both the host and the PKGBUILD, the checksum provides no meaningful trust guarantee. The official source for cgpt is the ChromiumOS vboot_reference repository (chromium.googlesource.com), and prebuilt binaries should come from official ChromiumOS image releases or be compiled from source. Distributing an opaque prebuilt binary from a personal/unofficial host is a genuine supply-chain concern. This is a textbook medium-severity case: executed binary from an unofficial host.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Leah Anderson <leah.anderson4435@proton.me>
    
      2pkgname=cgpt-bin
    
      3pkgver=15054.B
    
      4pkgrel=1
    
      5_rel=R106
    
      6pkgdesc="GPT manipulation tool with support for Chromium OS extensions"
    
      7arch=('x86_64')
    
      8url="https://chromium.googlesource.com/chromiumos/platform/vboot_reference/"
    
      9license=('BSD')
    
      10depends=('glibc' 'libuuid.so')
    
      11provides=('cgpt')
    
      12source=("cgpt::https://files.tree123.org/utils/x86_64/gnu/cgpt")
    
      13sha512sums=("2ba43dd521971517c0eabca2b82dfa812f336fd9b34f5725b1eab6be9b49d8f07eb9148bec698f42bc35b852212240e1d82353a8aa329cbbf322637ef4123a83")
    
      14
    
      15package() {
    
      16	cd "$srcdir"
    
      17	chmod 755 cgpt
    
      18	mkdir -p "$pkgdir"/usr/bin
    
      19	cp cgpt "$pkgdir"/usr/bin
    
      20}
    
      21

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2