ibm-bob-bin

MEDIUM
maintainer empyrealm 0 votes scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

The package downloads a prebuilt RPM from an IBM API endpoint using a resolved redirect URL not listed in source=(), with a hardcoded checksum; while the source is plausibly official, the download mechanism is opaque and the binary artifact is not independently verifiable, creating a supply-chain risk if the API or host were compromised.

Triggered rules

Medium External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

  • PKGBUILD:81 curl -fsS -D - -o /dev/null -X POST 'https://bob.ibm.com/api/download/bobide' \
Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt RPM from an IBM API endpoint using a resolved redirect URL not listed in source=(), with a hardcoded checksum; while the source is plausibly official, the download mechanism is opaque and the binary artifact is not independently verifiable, creating a supply-chain risk if the API or host were compromised.

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: empyrealm
2
3pkgname=ibm-bob-bin
4pkgver=1.126.0.bob2.1.0
5pkgrel=1
6pkgdesc='IBM Bob IDE repackaged from IBM upstream Linux binaries'
7arch=('x86_64')
8url='https://bob.ibm.com/download'
9license=('custom:IBM')
10depends=(
11 'alsa-lib'
12 'at-spi2-core'
13 'cairo'
14 'dbus'
15 'glib2'
16 'gtk3'
17 'libdrm'
18 'libxcomposite'
19 'libxdamage'
20 'libxfixes'
21 'libxkbcommon'
22 'libxrandr'
23 'mesa'
24 'nspr'
25 'nss'
26 'pango'
27)
28makedepends=('curl')
29optdepends=('org.freedesktop.secrets: credential storage integration')
30provides=('bobide')
31conflicts=('bobide')
32options=('!strip')
33source=()
34sha256sums=()
35
36# Decode compound pkgver back into the two parts needed for the upstream filename.
37# pkgver uses only alphanumerics and dots (AUR rule); the upstream format is
38# "${_vs}+bob${_bob}", e.g. "1.126.0+bob2.1.0".
39_decode_ver() {
40 # pkgver = "1.126.0.bob2.1.0" → _vs="1.126.0" _bob="2.1.0"
41 _vs="${pkgver%.bob*}"
42 _bob="${pkgver##*.bob}"
43}
44
45_decode_ver
46_upstream_ver="${_vs}+bob${_bob}"
47_rpm="IBM-Bob-linux-x64-${_upstream_ver}.rpm"
48_rpm_sha256='b328e31682b9028686fa08a063ae8e79b0b22b186a6020b5360ea981f1c08764'
49
50# pkgver() queries the IBM Bob download page for the latest upstream version
51# string and emits it in AUR-legal dot-only form. makepkg --nobuild (or any
52# AUR helper that supports VCS-style pkgver bumping) will call this and update
53# pkgver in PKGBUILD automatically when a new release is published.
54pkgver() {
55 local raw
56 raw="$(
57 curl -fsS -A 'Mozilla/5.0' 'https://bob.ibm.com/download' \
58 | grep -oE 'IBM-Bob-linux-x64-[0-9]+\.[0-9]+\.[0-9]+\+bob[0-9]+\.[0-9]+\.[0-9]+\.rpm' \
59 | grep -oE '[0-9]+\.[0-9]+\.[0-9]+\+bob[0-9]+\.[0-9]+\.[0-9]+' \
60 | sort -Vr | head -1
61 )"
62 [[ -n "$raw" ]] || { echo "pkgver: could not detect upstream version" >&2; return 1; }
63 # Convert "1.126.0+bob2.1.0" → "1.126.0.bob2.1.0"
64 echo "${raw/+bob/.bob}"
65}
66
67prepare() {
68 cd "${srcdir}"
69
70 if [[ -f "${_rpm}" ]]; then
71 local current
72 current="$(sha256sum "${_rpm}" | awk '{print $1}')"
73 if [[ "${current}" == "${_rpm_sha256}" ]]; then
74 return
75 fi
76 rm -f "${_rpm}"
77 fi
78
79 local download_url
80 download_url="$(
81 curl -fsS -D - -o /dev/null -X POST 'https://bob.ibm.com/api/download/bobide' \
82 -F 'platform=linux' \
83 -F "version=${_upstream_ver}" \
84 -F 'architecture=x64' \
85 -F 'packageType=rpm' \
86 | awk 'BEGIN { IGNORECASE=1 } /^location: / { sub(/\r$/, "", $2); print $2 }'
87 )"
88
89 [[ -n "${download_url}" ]] || {
90 echo 'Failed to resolve IBM Bob RPM download URL from bob.ibm.com API.' >&2
91 return 1
92 }
93
94 curl -fL "${download_url}" -o "${_rpm}"
95
96 echo "${_rpm_sha256} ${_rpm}" | sha256sum -c -
97}
98
99package() {
100 cd "${srcdir}"
101
102 bsdtar --no-same-owner -xf "${_rpm}" -C "${pkgdir}"
103
104 install -Dm644 \
105 "${pkgdir}/usr/share/bobide/LICENSES.chromium.html" \
106 "${pkgdir}/usr/share/licenses/${pkgname}/LICENSES.chromium.html"
107}
108

Changes since previous scan

--- PKGBUILD @ 2026-09-16 00:03
+++ PKGBUILD @ 2026-09-17 00:27
@@ -1,9 +1,7 @@
# Maintainer: empyrealm
pkgname=ibm-bob-bin
-pkgver=1.121.0
-_bobrel=2.0.0
-_upstream_ver="${pkgver}+bob${_bobrel}"
+pkgver=1.126.0.bob2.1.0
pkgrel=1
pkgdesc='IBM Bob IDE repackaged from IBM upstream Linux binaries'
arch=('x86_64')
@@ -35,8 +33,36 @@
source=()
sha256sums=()
+# Decode compound pkgver back into the two parts needed for the upstream filename.
+# pkgver uses only alphanumerics and dots (AUR rule); the upstream format is
+# "${_vs}+bob${_bob}", e.g. "1.126.0+bob2.1.0".
+_decode_ver() {
+ # pkgver = "1.126.0.bob2.1.0" → _vs="1.126.0" _bob="2.1.0"
+ _vs="${pkgver%.bob*}"
+ _bob="${pkgver##*.bob}"
+}
+
+_decode_ver
+_upstream_ver="${_vs}+bob${_bob}"
_rpm="IBM-Bob-linux-x64-${_upstream_ver}.rpm"
-_rpm_sha256='70d84f2f301de377e5d76ce090cd5583a0629aa800fd91d7c089ae5a8639583e'
+_rpm_sha256='b328e31682b9028686fa08a063ae8e79b0b22b186a6020b5360ea981f1c08764'
+
+# pkgver() queries the IBM Bob download page for the latest upstream version
+# string and emits it in AUR-legal dot-only form. makepkg --nobuild (or any
+# AUR helper that supports VCS-style pkgver bumping) will call this and update
+# pkgver in PKGBUILD automatically when a new release is published.
+pkgver() {
+ local raw
+ raw="$(
+ curl -fsS -A 'Mozilla/5.0' 'https://bob.ibm.com/download' \
+ | grep -oE 'IBM-Bob-linux-x64-[0-9]+\.[0-9]+\.[0-9]+\+bob[0-9]+\.[0-9]+\.[0-9]+\.rpm' \
+ | grep -oE '[0-9]+\.[0-9]+\.[0-9]+\+bob[0-9]+\.[0-9]+\.[0-9]+' \
+ | sort -Vr | head -1
+ )"
+ [[ -n "$raw" ]] || { echo "pkgver: could not detect upstream version" >&2; return 1; }
+ # Convert "1.126.0+bob2.1.0" → "1.126.0.bob2.1.0"
+ echo "${raw/+bob/.bob}"
+}
prepare() {
cd "${srcdir}"

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Medium 2
2026-09-16 17:23:26 Medium 2
2026-09-16 00:03:17 Medium 2
2026-09-15 00:25:31 Medium 2
2026-09-14 00:27:57 Medium 2
2026-09-13 00:19:54 Medium 2
2026-09-12 00:25:17 Medium 2
2026-09-11 00:19:22 Medium 2
2026-09-10 00:22:44 Medium 2
2026-09-09 00:04:09 Medium 2
2026-09-08 00:18:08 Medium 2
2026-09-07 00:30:15 Medium 2
2026-09-06 00:17:06 Medium 2
2026-09-05 00:16:27 Medium 2
2026-09-04 00:03:13 Medium 2
2026-09-03 00:15:47 Medium 2
2026-09-02 00:02:31 Medium 2
2026-09-01 00:11:19 Medium 2
2026-08-31 00:19:57 Medium 2
2026-08-30 00:04:14 Medium 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion