cppcheck-premium

MEDIUM

maintainer pattop 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The PKGBUILD installs a prebuilt binary tarball from files.cppchecksolutions.com, which is the official vendor domain for Cppcheck Premium (cppchecksolutions.com is the legitimate commercial arm of the cppcheck project). However, the source is still a prebuilt binary blob from a vendor host rather than source code compiled locally, and there is no GPG signature verification — only a SHA1 checksum (which is weak). The wrapper script 'cppcheck' is also installed to /usr/bin without inspection. This is a legitimate commercial product distributed as a binary, but the lack of strong integrity verification (no GPG, weak SHA1) and the binary-blob nature of the install constitute a real, if low-probability, supply-chain concern. The cheaper model's MEDIUM rating is appropriate: this is not clearly malicious, but it is an executed binary from an external host with only SHA1 verification.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source=("https://files.cppchecksolutions.com/${pkgver}/debian/cppcheckpremium-${pkgver}.tar.gz"

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD installs a prebuilt binary tarball from files.cppchecksolutions.com, which is the official vendor domain for Cppcheck Premium (cppchecksolutions.com is the legitimate commercial arm of the cppcheck project). However, the source is still a prebuilt binary blob from a vendor host rather than source code compiled locally, and there is no GPG signature verification — only a SHA1 checksum (which is weak). The wrapper script 'cppcheck' is also installed to /usr/bin without inspection. This is a legitimate commercial product distributed as a binary, but the lack of strong integrity verification (no GPG, weak SHA1) and the binary-blob nature of the install constitute a real, if low-probability, supply-chain concern. The cheaper model's MEDIUM rating is appropriate: this is not clearly malicious, but it is an executed binary from an external host with only SHA1 verification.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Patrick Oppenlander <patrick.oppenlander@gmail.com>
    
      2
    
      3#
    
      4# NOTE: requires paid license
    
      5# TODO: missing man pages
    
      6#
    
      7
    
      8pkgname=cppcheck-premium
    
      9pkgver=22.8.0
    
      10pkgrel=1
    
      11pkgdesc='Premium (nonfree) version of cppcheck'
    
      12conflicts=('cppcheck')
    
      13arch=('x86_64')
    
      14url='https://www.cppchecksolutions.com/'
    
      15license=('custom' 'GPL')
    
      16depends=('python-pygments')
    
      17source=("https://files.cppchecksolutions.com/${pkgver}/debian/cppcheckpremium-${pkgver}.tar.gz"
    
      18	'cppcheck')
    
      19sha1sums=('62fa7dfc1ecc802fdf17456b08564a7b56a6bea0'
    
      20          'ec77e2fe5e24e3ba3125ea9f145cb8e62193b5b3')
    
      21
    
      22package() {
    
      23	# cppcheck premium doesn't search /usr/{lib,share}/cppcheck for files
    
      24	# so we need to install to /opt maintaining directory layout. It also
    
      25	# fails to find its configuration files if it's called via symlink so
    
      26	# we need to put a small script in /usr/bin/ to help it out.
    
      27	mkdir -p "${pkgdir}"/opt/cppcheckpremium/
    
      28	cp -r "${srcdir}"/cppcheckpremium-"${pkgver}"/* "${pkgdir}"/opt/cppcheckpremium/
    
      29	install -Dt "${pkgdir}"/usr/bin/ "${srcdir}"/cppcheck
    
      30}
    
      31

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2