config-tools-for-imx

MEDIUM

maintainer metamacro 2 votes scanned 2026-09-27 13:18:29.354985

View on AUR

Why flagged

The package installs a prebuilt binary (.deb.bin) from a local file without a verifiable upstream source, posing a supply-chain risk if the bundled binary was tampered with, though it originates from NXP's official distribution.

Triggered rules

Medium Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package installs a prebuilt binary (.deb.bin) from a local file without a verifiable upstream source, posing a supply-chain risk if the bundled binary was tampered with, though it originates from NXP's official distribution.

PKGBUILD

      1# Maintainer: hendy643 <hendy643@hotmail.com>
    
      2
    
      3pkgname=config-tools-for-imx
    
      4pkgver=16.1
    
      5pkgrel=1
    
      6epoch=
    
      7pkgdesc="Integrated suite of configuration tools for NXP's i.MX Application Processors. From BIN package distributed by NXP."
    
      8arch=('x86_64')
    
      9url="https://www.nxp.com/design/development-boards/i-mx-evaluation-and-development-boards/config-tools-for-i-mx-applications-processors:CONFIG-TOOLS-IMX"
    
      10license=('custom:"NXP"')
    
      11depends=('java-environment' 'libxslt' 'libxtst' 'gcc-libs-multilib' 'gtk2' 'alsa-lib' 'libnet')
    
      12source=("file://config-tools-for-imx-v${pkgver}-${pkgrel}_amd64.deb.bin" "LICENSE" "${pkgname}.install")
    
      13sha256sums=('5f97c8a7268149f92b2a6d5deb07d0ae5a52810995db950f1e55093c18f16e8d'
    
      14            '41beb81990892ba157f85cd6c008f65191a763c97331ac6c8cceb18700883af5'
    
      15            'a1f53f36f04d98667717092eedc6ccb6c5a5a3ea7ad6ded79a9ac6f004f6307c')
    
      16
    
      17options=('!strip' '!debug')
    
      18
    
      19prepare() {
    
      20    chmod +x config-tools-for-imx-v${pkgver}-${pkgrel}_amd64.deb.bin
    
      21    ./config-tools-for-imx-v${pkgver}-${pkgrel}_amd64.deb.bin --noexec --keep --nox11 --target ${srcdir}
    
      22    rm config-tools-for-imx-v${pkgver}-${pkgrel}_amd64.deb.bin
    
      23    cd "${srcdir}"/ || exit
    
      24    mkdir -p config-tools-for-imx
    
      25    bsdtar -x -f config-tools-for-imx-v${pkgver}-${pkgrel}_amd64.deb -C config-tools-for-imx
    
      26    rm config-tools-for-imx-v${pkgver}-${pkgrel}_amd64.deb
    
      27    bsdtar -x -f config-tools-for-imx/data.tar.gz -C config-tools-for-imx
    
      28    rm config-tools-for-imx/data.tar.gz
    
      29}
    
      30
    
      31
    
      32package() {
    
      33        cp -r "${srcdir}"/config-tools-for-imx/usr "${pkgdir}"/;
    
      34        cp -r "${srcdir}"/config-tools-for-imx/opt "${pkgdir}"/;
    
      35        install -D -m644 "${srcdir}"/LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE";        
    
      36}
    
      37

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-27 13:18:29	Medium	2
2026-06-18 16:11:54	Clean	0