cppcheck-premium

maintainer pattop · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD installs a prebuilt binary tarball from files.cppchecksolutions.com, which is the official vendor domain for Cppcheck Premium (cppchecksolutions.com is the legitimate commercial arm of the cppcheck project). However, the source is still a prebuilt binary blob from a vendor host rather than source code compiled locally, and there is no GPG signature verification — only a SHA1 checksum (which is weak). The wrapper script 'cppcheck' is also installed to /usr/bin without inspection. This is a legitimate commercial product distributed as a binary, but the lack of strong integrity verification (no GPG, weak SHA1) and the binary-blob nature of the install constitute a real, if low-probability, supply-chain concern. The cheaper model's MEDIUM rating is appropriate: this is not clearly malicious, but it is an executed binary from an external host with only SHA1 verification.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source=("https://files.cppchecksolutions.com/${pkgver}/debian/cppcheckpremium-${pkgver}.tar.gz"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD installs a prebuilt binary tarball from files.cppchecksolutions.com, which is the official vendor domain for Cppcheck Premium (cppchecksolutions.com is the legitimate commercial arm of the cppcheck project). However, the source is still a prebuilt binary blob from a vendor host rather than source code compiled locally, and there is no GPG signature verification — only a SHA1 checksum (which is weak). The wrapper script 'cppcheck' is also installed to /usr/bin without inspection. This is a legitimate commercial product distributed as a binary, but the lack of strong integrity verification (no GPG, weak SHA1) and the binary-blob nature of the install constitute a real, if low-probability, supply-chain concern. The cheaper model's MEDIUM rating is appropriate: this is not clearly malicious, but it is an executed binary from an external host with only SHA1 verification.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Patrick Oppenlander <patrick.oppenlander@gmail.com>
    
      2
    
      3#
    
      4# NOTE: requires paid license
    
      5# TODO: missing man pages
    
      6#
    
      7
    
      8pkgname=cppcheck-premium
    
      9pkgver=22.8.0
    
      10pkgrel=1
    
      11pkgdesc='Premium (nonfree) version of cppcheck'
    
      12conflicts=('cppcheck')
    
      13arch=('x86_64')
    
      14url='https://www.cppchecksolutions.com/'
    
      15license=('custom' 'GPL')
    
      16depends=('python-pygments')
    
      17source=("https://files.cppchecksolutions.com/${pkgver}/debian/cppcheckpremium-${pkgver}.tar.gz"
    
      18	'cppcheck')
    
      19sha1sums=('62fa7dfc1ecc802fdf17456b08564a7b56a6bea0'
    
      20          'ec77e2fe5e24e3ba3125ea9f145cb8e62193b5b3')
    
      21
    
      22package() {
    
      23	# cppcheck premium doesn't search /usr/{lib,share}/cppcheck for files
    
      24	# so we need to install to /opt maintaining directory layout. It also
    
      25	# fails to find its configuration files if it's called via symlink so
    
      26	# we need to put a small script in /usr/bin/ to help it out.
    
      27	mkdir -p "${pkgdir}"/opt/cppcheckpremium/
    
      28	cp -r "${srcdir}"/cppcheckpremium-"${pkgver}"/* "${pkgdir}"/opt/cppcheckpremium/
    
      29	install -Dt "${pkgdir}"/usr/bin/ "${srcdir}"/cppcheck
    
      30}
    
      31

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2