eagle6

maintainer ckoba · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary installer (eagle-lin.run) from eagle.autodesk.com (the official Autodesk/CadSoft EAGLE download host), makes it executable, and runs it directly during the package() function. The host is the legitimate official vendor host for EAGLE EDA software, so this is not an unofficial or personal host — it is the canonical Autodesk distribution point. However, the pattern of executing a downloaded .run installer directly in package() is a genuine supply-chain concern: if Autodesk ever rotates or changes the file at that URL, the checksum would catch it — and indeed a sha256sum IS provided for the installer (only the .desktop file has SKIP). The checksum for the .run file is present and non-SKIP, which mitigates the risk significantly. The main residual concern is that a .run installer is executed directly rather than being unpacked/inspected, which is non-ideal but common for proprietary software AUR packages. Overall this is a legitimate official-vendor binary with a checksum, making it closer to clean/low than a true medium supply-chain risk, but the direct execution of a proprietary installer binary keeps it at low rather than clean.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source=('http://eagle.autodesk.com/eagle/download-software/54'

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary installer (eagle-lin.run) from eagle.autodesk.com (the official Autodesk/CadSoft EAGLE download host), makes it executable, and runs it directly during the package() function. The host is the legitimate official vendor host for EAGLE EDA software, so this is not an unofficial or personal host — it is the canonical Autodesk distribution point. However, the pattern of executing a downloaded .run installer directly in package() is a genuine supply-chain concern: if Autodesk ever rotates or changes the file at that URL, the checksum would catch it — and indeed a sha256sum IS provided for the installer (only the .desktop file has SKIP). The checksum for the .run file is present and non-SKIP, which mitigates the risk significantly. The main residual concern is that a .run installer is executed directly rather than being unpacked/inspected, which is non-ideal but common for proprietary software AUR packages. Overall this is a legitimate official-vendor binary with a checksum, making it closer to clean/low than a true medium supply-chain risk, but the direct execution of a proprietary installer binary keeps it at low rather than clean.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Christopher Kobayashi <software+aur@disavowed.jp>
    
      2
    
      3pkgname=eagle6
    
      4pkgver=6.6.0
    
      5pkgrel=2
    
      6pkgdesc="CadSoft EAGLE 6.x"
    
      7provides=("${pkgname}")
    
      8conflicts=()
    
      9arch=('i686' 'x86_64')
    
      10url='http://eagle.autodesk.com/eagle/software-versions/10'
    
      11license=('Proprietary')
    
      12depends=(
    
      13	'libjpeg6-turbo'
    
      14	'lib32-libjpeg6-turbo'
    
      15	'lib32-openssl-1.0'
    
      16)
    
      17makedepends=()
    
      18source=('http://eagle.autodesk.com/eagle/download-software/54'
    
      19        'eagle6.desktop'
    
      20)
    
      21sha256sums=('1dd8f59a4c6b3a741e4c5e7eaa88347b9c12be8076c7cbb3580541a55a42a254'
    
      22        'SKIP'
    
      23)
    
      24
    
      25package() {
    
      26    mv 54 eagle-lin.run
    
      27    chmod +x eagle-lin.run
    
      28    ./eagle-lin.run "${pkgdir}/opt"
    
      29    mkdir -p "${pkgdir}/usr/bin"
    
      30    ln -s "/opt/eagle-${pkgver}/bin/eagle" "${pkgdir}/usr/bin/eagle-${pkgver}"
    
      31
    
      32    # provide desktop integration
    
      33    install -Dm644 "$pkgname.desktop" \
    
      34        "$pkgdir/usr/share/applications/$pkgname.desktop"
    
      35    install -Dm644 "$pkgdir/opt/eagle-$pkgver/bin/eagleicon50.png" \
    
      36        "$pkgdir/usr/share/pixmaps/eagle.png"
    
      37}
    
      38

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2