ingenic-cloner-bin
LOW
maintainer guglovich
0 votes
scanned 2026-10-19 19:26:12.253336
Why flagged
The package installs a prebuilt binary from a project-owned GitHub repository, which is normal for proprietary tools; it does not execute untrusted remote code, exfiltrate data, or modify the system beyond standard udev rules and group membership advice.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt binary from a project-owned GitHub repository, which is normal for proprietary tools; it does not execute untrusted remote code, exfiltrate data, or modify the system beyond standard udev rules and group membership advice.
PKGBUILD
1
# Maintainer: guglovich <guglovich164@gmail.com>
2
# Created with assistance from Space Bunny Free.
3
4
pkgname=ingenic-cloner-bin
5
pkgver=2.5.80.1
6
pkgrel=2
7
pkgdesc='USB download tool for the Ingenic SoCs — prebuilt binary, upstream provides no source code'
8
arch=('x86_64')
9
url='https://github.com/guglovich/Ingenic-Cloner'
10
license=('LicenseRef-Unfree')
11
options=('!strip' '!debug')
12
depends=('libx11' 'fontconfig' 'freetype2' 'zlib' 'systemd-libs' 'glib2')
13
optdepends=('android-tools: bundled adb support for connected targets')
14
install=ingenic-cloner-bin.install
15
16
source=("cloner-$pkgver-ubuntu_alpha.tar.gz::https://github.com/guglovich/Ingenic-Cloner/releases/download/v$pkgver/cloner-$pkgver-ubuntu_alpha.tar.gz")
17
sha256sums=('8951251f348269cb54cb04a1b75e153a786466dfb521fc69bea745b0f6befb86')
18
19
package() {
20
local src="cloner-$pkgver-ubuntu_alpha"
21
local dest="$pkgdir/usr/share/ingenic-cloner"
22
23
install -d "$dest"
24
cp -a "$src"/bin "$src"/configs "$src"/ddrs "$src"/firmwares \
25
"$src"/lib "$src"/scripts "$src"/security "$src"/securitytool \
26
"$dest/"
27
install -Dm644 "$src/qm_cn.qm" "$dest/qm_cn.qm"
28
29
# Upstream ships several data files with mode 0600, and the security tooling
30
# contains RSA private keys. Normalise the readable data, but keep the private
31
# keys restricted: those tools are meant to run as root.
32
find "$dest" -type d -exec chmod 755 {} +
33
find "$dest" -type f -exec chmod 644 {} +
34
find "$dest/bin" -type f -exec chmod 755 {} +
35
find "$dest/security" "$dest/securitytool" -type f -exec chmod 600 {} +
36
find "$dest/security" "$dest/securitytool" -type d -exec chmod 700 {} +
37
38
# Bundled adb: prefer it when present, but it is not required
39
install -d "$pkgdir/usr/lib/$pkgname"
40
cp -a "$src"/adb/unix "$pkgdir/usr/lib/$pkgname/" 2>/dev/null || true
41
42
# udev access rules shipped as a package file.
43
# Upstream writes these via sudo tee at every launch, which a package must not do.
44
# GROUP is "uucp": it is defined by systemd's sysusers.d and therefore always
45
# present. "plugdev" is NOT guaranteed to exist (udev silently drops rules whose
46
# group does not resolve), which left the device inaccessible.
47
install -Dm644 /dev/stdin "$pkgdir/usr/lib/udev/rules.d/50-ingenic-cloner.rules" <<'EOF'
48
# Ingenic SoC USB devices used by Cloner (vendor a108).
49
SUBSYSTEM=="usb", ATTR{idVendor}=="a108", ATTR{idProduct}=="d002", MODE="0660", GROUP="uucp"
50
SUBSYSTEM=="usb", ATTR{idVendor}=="a108", ATTR{idProduct}=="1000", MODE="0660", GROUP="uucp"
51
SUBSYSTEM=="usb", ATTR{idVendor}=="a108", ATTR{idProduct}=="4775", MODE="0660", GROUP="uucp"
52
SUBSYSTEM=="usb", ATTR{idVendor}=="a108", ATTR{idProduct}=="4785", MODE="0660", GROUP="uucp"
53
SUBSYSTEM=="usb", ATTR{idVendor}=="a108", ATTR{idProduct}=="4780", MODE="0660", GROUP="uucp"
54
SUBSYSTEM=="usb", ATTR{idVendor}=="a108", ATTR{idProduct}=="c309", MODE="0660", GROUP="uucp"
55
SUBSYSTEM=="usb", ATTR{idVendor}=="a108", ATTR{idProduct}=="eaef", MODE="0660", GROUP="uucp"
56
EOF
57
58
# Launcher replacing upstream's ./cloner script.
59
#
60
# Upstream's script installs a permanent sudoers credential cache
61
# (timestamp_timeout=-1) and renames /etc/ld.so.preload. A package must not
62
# modify the system that way, so the subcommands are implemented here instead.
63
#
64
# Installed as "cloner" (project name), not as the AUR package name.
65
install -Dm755 /dev/stdin "$pkgdir/usr/bin/cloner" <<'EOF'
66
#!/bin/bash
67
set -euo pipefail
68
69
CLONER_DIR=/usr/share/ingenic-cloner
70
71
bits=$(getconf LONG_BIT)
72
case "$bits" in
73
64) arch=64 ;;
74
32) arch=32 ;;
75
*) echo "$0: unsupported architecture word size: $bits" >&2; exit 1 ;;
76
esac
77
78
BINDIR="$CLONER_DIR/bin/${arch}bit"
79
GUIBIN="$BINDIR/cloner_${arch}"
80
COREBIN="$BINDIR/core_${arch}"
81
82
export LD_LIBRARY_PATH="$CLONER_DIR/lib/${arch}bit${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
83
84
if [[ -x "/usr/lib/ingenic-cloner-bin/unix/${arch}bit/adb" ]]; then
85
export PATH="/usr/lib/ingenic-cloner-bin/unix/${arch}bit:$PATH"
86
fi
87
88
# The GUI spawns a "core_<arch>" helper and uses Qt shared-memory IPC for
89
# single-instance detection. Both survive a crash: an orphaned core_64 makes
90
# the next launch print "Find another core_64 is running" and die with SIGSEGV,
91
# and stale /tmp/qipc_*ingenicburner* IPC files do the same. Upstream masked
92
# this with "sudo killall" in its launcher script; here we clean up only our own
93
# leftovers, matching the resolved executable path and the file owner so that
94
# nothing else is ever touched.
95
stale=()
96
for pid in $(pgrep -f "$COREBIN" 2>/dev/null || true); do
97
if [[ "$(readlink -f "/proc/$pid/exe" 2>/dev/null || true)" == "$COREBIN" ]]; then
98
stale+=("$pid")
99
fi
100
done
101
102
if (( ${#stale[@]} )); then
103
echo "$0: removing stale core_${arch} (pid: ${stale[*]})" >&2
104
kill "${stale[@]}" 2>/dev/null || true
105
for _ in {1..20}; do
106
kill -0 "${stale[0]}" 2>/dev/null || break
107
sleep 0.1
108
done
109
kill -9 "${stale[@]}" 2>/dev/null || true
110
sleep 0.5
111
fi
112
113
# Stale single-instance IPC markers left behind by a previous crash.
114
for f in /tmp/qipc_*ingenicburner*; do
115
[[ -e "$f" ]] || continue
116
owner=$(stat -c %u "$f" 2>/dev/null || echo 0)
117
[[ "$owner" == "$(id -u)" || $EUID -eq 0 ]] || continue
118
rm -f "$f" 2>/dev/null || true
119
done
120
121
# The tool resolves configs/, ddrs/ and firmwares/ relative to the working directory.
122
cd "$CLONER_DIR"
123
124
# Since 2.5.80 the core program enumerates USB devices itself at startup and
125
# needs raw access to the device node: libusb has to claim the interface and
126
# detach the kernel driver, which requires privileges. Upstream therefore always
127
# ran the binaries through sudo. Without them the board is not listed at all.
128
# Upstream additionally installed a permanent sudoers credential cache
129
# (timestamp_timeout=-1); a package must not do that, so the password is simply
130
# asked for when it is needed.
131
run() {
132
if [[ $EUID -ne 0 ]] && command -v sudo >/dev/null 2>&1; then
133
exec sudo env "LD_LIBRARY_PATH=$LD_LIBRARY_PATH" "$@"
134
else
135
exec env "LD_LIBRARY_PATH=$LD_LIBRARY_PATH" "$@"
136
fi
137
}
138
139
case "${1:-}" in
140
no-gui)
141
shift
142
run "$COREBIN" "$@"
143
;;
144
factory)
145
shift
146
run "$BINDIR/USBClonerFactoryTool_${arch}" "$@"
147
;;
148
cfgcli)
149
shift
150
run "$BINDIR/cfgcli_${arch}" "$@"
151
;;
152
help|-h|--help)
153
echo "Usage: cloner [command] [options]"
154
echo
155
echo " cloner Start the graphical USBCloner interface (default)"
156
echo " cloner no-gui Run the core program without the interface"
157
echo " cloner factory Start the USBCloner factory tool"
158
echo " cloner cfgcli ... Run the configuration command line tool"
159
exit 0
160
;;
161
*)
162
if [[ ! -x "$GUIBIN" ]]; then
163
echo "$0: missing $GUIBIN" >&2
164
exit 1
165
fi
166
run "$GUIBIN" "$@"
167
;;
168
esac
169
EOF
170
}
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-19 19:26:12 | Low | 2 |