csky-debugserver-bin

MEDIUM

maintainer taotieren 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt installer script from an untrusted, non-standard host (aliyuncs.com, a cloud storage service), which is then processed to extract and install a binary; this creates a supply-chain risk as the source is not verifiable and could be silently swapped.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:29 "${pkgname}-${pkgver}.sh.tar.gz::https://occ-oss-prod.oss-cn-hangzhou.aliyuncs.com/resource//1781751151864/XuanTie-DebugServer-linux-x86_64-V5.18.10-20260603.sh.tar.gz"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt installer script from an untrusted, non-standard host (aliyuncs.com, a cloud storage service), which is then processed to extract and install a binary; this creates a supply-chain risk as the source is not verifiable and could be silently swapped.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: taotieren <admin@taotieren.com>
    
      2
    
      3pkgname=csky-debugserver-bin
    
      4pkgver=5.18.10
    
      5pkgrel=3
    
      6epoch=
    
      7pkgdesc="C-Sky Debugger Server"
    
      8arch=('x86_64')
    
      9url="https://www.xrvm.cn/community/download?id=4380347564587814912"
    
      10license=('BSD')
    
      11groups=()
    
      12depends=(
    
      13    sh
    
      14    libgcc_s.so
    
      15    libstdc++.so
    
      16    libusb
    
      17)
    
      18makedepends=(libarchive)
    
      19checkdepends=()
    
      20optdepends=()
    
      21provides=()
    
      22conflicts=()
    
      23replaces=()
    
      24backup=()
    
      25options=(!strip !debug)
    
      26install=
    
      27changelog=
    
      28source=(
    
      29    "${pkgname}-${pkgver}.sh.tar.gz::https://occ-oss-prod.oss-cn-hangzhou.aliyuncs.com/resource//1781751151864/XuanTie-DebugServer-linux-x86_64-V5.18.10-20260603.sh.tar.gz"
    
      30    "DebugServer User Guide_v5.18.pdf::https://occ-oss-prod.oss-cn-hangzhou.aliyuncs.com/resource//1781751413408/Debugger+Server+User+Guide%28ZH-CN%29.pdf"
    
      31)
    
      32noextract=()
    
      33sha256sums=('24413810f02160e262a04cf22835adadf061c120f5ad9a7a4b3f2c821a122194'
    
      34            '97888c3dc282f167cf2f627e2bde70ea678169c4855b98b8a4cf157b963c3b11')
    
      35#validpgpkeys=()
    
      36
    
      37package() {
    
      38    tail -n +285 "${srcdir}"/*${pkgver}*.sh >"${srcdir}/${pkgname}-${pkgver}.tar.gz"
    
      39
    
      40    install -dm0755 "${pkgdir}/opt/t-head/${pkgname%-bin}"
    
      41
    
      42    bsdtar -xf "${srcdir}/${pkgname}-${pkgver}.tar.gz" --no-same-owner --no-same-permissions --strip-components=1 -C "${pkgdir}/opt/t-head/${pkgname%-bin}"
    
      43
    
      44    install -Dm0644 "${srcdir}"/*.pdf -t "${pkgdir}/opt/t-head/${pkgname%-bin}"
    
      45
    
      46    #     install -Dm0644 /dev/stdin "${pkgdir}/etc/profile.d/${pkgname%-bin}.csh" <<EOF
    
      47    # setenv PATH "${PATH}:/opt/t-head/${pkgname%-bin}"
    
      48    # EOF
    
      49
    
      50    install -Dm0755 /dev/stdin "${pkgdir}/usr/bin/${pkgname%-bin}" <<EOF
    
      51#!/bin/env bash
    
      52export PATH=/opt/t-head/${pkgname%-bin}:\$PATH
    
      53cd /opt/t-head/${pkgname%-bin}
    
      54exec DebugServerConsole.elf "\$@"
    
      55EOF
    
      56}
    
      57

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2