cloner-bin
MEDIUM
maintainer guglovich
0 votes
scanned 2026-10-17 00:21:55.226236
Why flagged
The package installs a prebuilt binary from a GitHub release without source code, creating a supply-chain risk due to unverifiable origins, though it otherwise follows safe packaging practices and only installs data and udev rules alongside the binary.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Medium
AI review of an ambiguous pattern
llm_review
The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package installs a prebuilt binary from a GitHub release without source code, creating a supply-chain risk due to unverifiable origins, though it otherwise follows safe packaging practices and only installs data and udev rules alongside the binary.
PKGBUILD
1
# Maintainer: guglovich <guglovich164@gmail.com>
2
# Created with assistance from Space Bunny Free.
3
4
pkgname=cloner-bin
5
pkgver=2.5.36.1
6
pkgrel=2
7
pkgdesc='USB download/flashing tool for Ingenic SoCs — prebuilt binary, upstream provides no source code'
8
arch=('x86_64')
9
url='https://github.com/Ingenic-community/Cloner'
10
license=('LicenseRef-Unfree')
11
options=('!strip' '!debug')
12
depends=('libx11' 'fontconfig' 'freetype2' 'zlib' 'systemd-libs' 'glib2')
13
optdepends=('android-tools: bundled adb support for connected targets')
14
install=cloner-bin.install
15
16
source=("cloner-$pkgver-ubuntu_alpha.tar.gz::https://github.com/Ingenic-community/Cloner/releases/download/v2.5.36/cloner-2.5.36.1-ubuntu_alpha.tar.gz")
17
sha256sums=('87438a0a8aa8af32bc4833c8b3adc7b80dda3e592d00a387957ad5c7b38f854a')
18
19
package() {
20
local src="cloner-$pkgver-ubuntu_alpha"
21
local dest="$pkgdir/usr/share/cloner"
22
23
install -d "$dest"
24
cp -a "$src"/bin "$src"/configs "$src"/ddrs "$src"/firmwares \
25
"$src"/lib "$src"/scripts "$src"/securitytool \
26
"$dest/"
27
28
# Upstream ships 24 data files with mode 0600 (visible in the tarball itself).
29
# Copied in as root they would stay unreadable for every user, which breaks the
30
# tool. Normalise the whole tree to a world-readable, read-only install.
31
# (fakeroot applies umask 022 when archiving, so 664/775 never survive; the tool
32
# has been verified to run fine from a read-only tree.)
33
find "$dest" -type d -exec chmod 755 {} +
34
find "$dest" -type f -exec chmod 644 {} +
35
find "$dest/bin" -type f -exec chmod 755 {} +
36
37
install -Dm644 "$src/docs/English/USBCloner The Burn tool Quick Guide.pdf" \
38
"$pkgdir/usr/share/doc/$pkgname/quick-guide.pdf"
39
install -Dm644 "$src/docs/English/USBCloner_Tool_Description_Document_V2.pdf" \
40
"$pkgdir/usr/share/doc/$pkgname/tool-description.pdf"
41
42
# Bundled adb: prefer it when present, but it is not required
43
install -d "$pkgdir/usr/lib/$pkgname"
44
cp -a "$src"/adb/unix "$pkgdir/usr/lib/$pkgname/" 2>/dev/null || true
45
46
# udev access rules shipped as a package file.
47
# Upstream writes these via sudo tee at every launch, which a package must not do.
48
# GROUP is plugdev (upstream used $LOGNAME, which is invalid in udev rules).
49
install -Dm644 /dev/stdin "$pkgdir/usr/lib/udev/rules.d/50-cloner.rules" <<'EOF'
50
# Ingenic SoC USB devices used by Cloner (vendor a108).
51
SUBSYSTEM=="usb", ATTR{idVendor}=="a108", ATTR{idProduct}=="d002", MODE="0660", GROUP="plugdev"
52
SUBSYSTEM=="usb", ATTR{idVendor}=="a108", ATTR{idProduct}=="1000", MODE="0660", GROUP="plugdev"
53
SUBSYSTEM=="usb", ATTR{idVendor}=="a108", ATTR{idProduct}=="4775", MODE="0660", GROUP="plugdev"
54
SUBSYSTEM=="usb", ATTR{idVendor}=="a108", ATTR{idProduct}=="4785", MODE="0660", GROUP="plugdev"
55
SUBSYSTEM=="usb", ATTR{idVendor}=="a108", ATTR{idProduct}=="4780", MODE="0660", GROUP="plugdev"
56
SUBSYSTEM=="usb", ATTR{idVendor}=="a108", ATTR{idProduct}=="c309", MODE="0660", GROUP="plugdev"
57
SUBSYSTEM=="usb", ATTR{idVendor}=="a108", ATTR{idProduct}=="eaef", MODE="0660", GROUP="plugdev"
58
EOF
59
60
# Launcher replacing upstream's ./cloner script, which installs udev rules and
61
# ld.so.conf entries through sudo on every run and chowns its own directory.
62
# Installed as "cloner" (project name), not as the AUR package name.
63
install -Dm755 /dev/stdin "$pkgdir/usr/bin/cloner" <<'EOF'
64
#!/bin/bash
65
set -euo pipefail
66
67
CLONER_DIR=/usr/share/cloner
68
69
bits=$(getconf LONG_BIT)
70
case "$bits" in
71
64) arch=64 ;;
72
32) arch=32 ;;
73
*) echo "$0: unsupported architecture word size: $bits" >&2; exit 1 ;;
74
esac
75
76
GUIBIN="$CLONER_DIR/bin/${arch}bit/cloner_${arch}"
77
COREBIN="$CLONER_DIR/bin/${arch}bit/core_${arch}"
78
79
if [[ ! -x "$GUIBIN" ]]; then
80
echo "$0: missing $GUIBIN" >&2
81
exit 1
82
fi
83
84
export LD_LIBRARY_PATH="$CLONER_DIR/lib/${arch}bit${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
85
86
if [[ -x "/usr/lib/cloner-bin/unix/${arch}bit/adb" ]]; then
87
export PATH="/usr/lib/cloner-bin/unix/${arch}bit:$PATH"
88
fi
89
90
# The GUI spawns a "core_<arch>" helper and uses Qt shared-memory IPC for
91
# single-instance detection. Both survive a crash: an orphaned core_64 makes
92
# the next launch print "Find another core_64 is running" and die with SIGSEGV,
93
# and stale /tmp/qipc_*ingenicburner* IPC files do the same. Upstream masked
94
# this with "sudo killall" in its launcher script; here we clean up only our own
95
# leftovers, matching the resolved executable path and the file owner so that
96
# nothing else is ever touched.
97
uid=$(id -u)
98
stale=()
99
for pid in $(pgrep -u "$uid" -f "core_${arch}" 2>/dev/null || true); do
100
if [[ "$(readlink -f "/proc/$pid/exe" 2>/dev/null || true)" == "$COREBIN" ]]; then
101
stale+=("$pid")
102
fi
103
done
104
105
if (( ${#stale[@]} )); then
106
echo "$0: removing stale core_${arch} (pid: ${stale[*]})" >&2
107
kill "${stale[@]}" 2>/dev/null || true
108
for _ in {1..20}; do
109
kill -0 "${stale[0]}" 2>/dev/null || break
110
sleep 0.1
111
done
112
kill -9 "${stale[@]}" 2>/dev/null || true
113
sleep 0.5
114
fi
115
116
# Stale single-instance IPC markers left behind by a previous crash.
117
for f in /tmp/qipc_*ingenicburner*; do
118
[[ -e "$f" ]] || continue
119
[[ "$(stat -c %u "$f" 2>/dev/null || echo 0)" == "$uid" ]] || continue
120
rm -f "$f" 2>/dev/null || true
121
done
122
123
# The tool resolves configs/, ddrs/ and firmwares/ relative to the working directory.
124
cd "$CLONER_DIR"
125
126
exec "$GUIBIN" "$@"
127
EOF
128
}
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-17 00:21:55 | Medium | 2 |
| 2026-10-16 00:12:47 | Medium | 2 |
| 2026-10-15 00:28:05 | Medium | 2 |
| 2026-10-14 23:21:11 | Medium | 2 |