intel-sgx-psw-bin
LOW
maintainer marmis
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a Debian repository archive from Intel's official download domain (download.01.org) to extract and repackage SGX components for Arch Linux; this is a legitimate source for Intel SGX software, despite the non-whitelisted host, and installs only verified binaries and configuration files without executing remote code.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a Debian repository archive from Intel's official download domain (download.01.org) to extract and repackage SGX components for Arch Linux; this is a legitimate source for Intel SGX software, despite the non-whitelisted host, and installs only verified binaries and configuration files without executing remote code.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:20
source=("sgx_${pkgver}_debian_local_repo.tgz::https://download.01.org/intel-sgx/sgx-linux/${pkgver}/distro/Debian13/sgx_debian_local_repo.tgz"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: marmis <tiagodepalves@gmail.com>
2
# Contributor: "marmis" Tiago de Paula <tiagodepalves@gmail.com>
3
4
pkgname=intel-sgx-psw-bin
5
pkgdesc='Intel® Software Guard Extensions Platform Software for Linux* OS'
6
pkgver=2.30.1
7
pkgrel=1
8
url='https://github.com/intel/confidential-computing.sgx.sdk'
9
arch=(x86_64)
10
license=('BSD-3-Clause AND LicenseRef-Intel-SGX-Third-Party') # https://github.com/intel/confidential-computing.sgx.sdk/blob/main/License.txt
11
provides=("intel-sgx-psw=${pkgver}")
12
conflicts=('intel-sgx-psw')
13
options=(!strip !debug)
14
backup=(
15
'etc/aesmd.conf'
16
'etc/mpa_registration.conf'
17
'etc/qgs.conf'
18
'etc/sgx_default_qcnl.conf'
19
)
20
source=("sgx_${pkgver}_debian_local_repo.tgz::https://download.01.org/intel-sgx/sgx-linux/${pkgver}/distro/Debian13/sgx_debian_local_repo.tgz"
21
'intel-sgx-sysusers.conf')
22
b2sums=('93bb0d60a1312adc66388cbe4dc250929eb29c10622833f83e371d279a6337bf77d0a9923852f87a612362bad34aab33a2287a414693e57514ebcd22b49e2445'
23
'f0a1415f8e88ffe2fe189c56a701a9756f74947375f142aa3965679129d3182f1b380beea02d70e07cbe7c9443461b8cbb674193ae07f71d543d13a10ecaf7ff')
24
25
# Move files to standard Arch Linux folders (namcap rule: directoryname).
26
# See https://wiki.archlinux.org/title/Arch_package_guidelines#Directories
27
_fix_non_standard_paths() {
28
# /etc/udev is for user files, packages should use /usr/lib/udev instead
29
install -vd "${pkgdir}/usr/lib/udev/"
30
mv -v --no-copy "${pkgdir}/etc/udev/rules.d" \
31
-T "${pkgdir}/usr/lib/udev/rules.d"
32
rmdir -v "${pkgdir}/etc/udev"
33
34
# Debian has a /usr/lib/$TARGET folder, but not in Arch
35
mv -v -t "${pkgdir}/usr/lib/" \
36
--no-copy "${pkgdir}/usr/lib/${CARCH}-linux-gnu"/*.so*
37
rmdir -v "${pkgdir}/usr/lib/${CARCH}-linux-gnu"
38
39
# Debian has an actual /lib folder, which in Arch is just a symlink to /usr/lib
40
mv -v -t "${pkgdir}/usr/lib/systemd/system/" \
41
--no-copy "${pkgdir}/lib/systemd/system"/*.service
42
rmdir -v "${pkgdir}/lib/systemd/system" "${pkgdir}/lib/systemd" "${pkgdir}/lib"
43
44
# Debian also supports /include, which should be empty here
45
rmdir -v "${pkgdir}/include"
46
}
47
48
# Update symbolic links generated by the installer (namcap rule: symlink).
49
_fix_symlink() {
50
ln -v -sr "${pkgdir}/usr/lib/$(basename "${1}")" \
51
-fT "${1}"
52
}
53
54
package() {
55
depends=('glibc' 'libstdc++' 'bash')
56
optdepends=(
57
'protobuf-21: required for the AESM service'
58
'nodejs: for running the SGX DCAP PCCS Server'
59
'curl: required for SGX Remote Attestation Service (RA)'
60
'boost183: required by the TDX Quote Generation Service (QGS)'
61
)
62
63
find sgx_debian_local_repo -name '*.deb' -print \
64
-exec sh -euc 'ar -p "$1" -O data.tar.xz | tar -x --xz -C "$2"' -- {} "${pkgdir}" \;
65
66
# required users and groups
67
install -vD -m644 intel-sgx-sysusers.conf \
68
-T "${pkgdir}/usr/lib/sysusers.d/intel-sgx.conf"
69
70
# composed license
71
install -vD -t "${pkgdir}/usr/share/licenses/${pkgname}/" \
72
-m644 "${pkgdir}/usr/share/doc/libsgx-enclave-common/copyright"
73
74
_fix_non_standard_paths
75
_fix_symlink "${pkgdir}/opt/intel/sgx-aesm-service/aesm/libsgx_pce.signed.so"
76
_fix_symlink "${pkgdir}/opt/intel/sgx-aesm-service/aesm/libsgx_pce.signed.so.1"
77
_fix_symlink "${pkgdir}/opt/intel/sgx-aesm-service/aesm/libsgx_qe3.signed.so"
78
_fix_symlink "${pkgdir}/opt/intel/sgx-aesm-service/aesm/libsgx_qe3.signed.so.1"
79
_fix_symlink "${pkgdir}/opt/intel/sgx-pck-id-retrieval-tool/libsgx_id_enclave.signed.so.1"
80
_fix_symlink "${pkgdir}/opt/intel/sgx-pck-id-retrieval-tool/libsgx_pce.signed.so.1"
81
}
82
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |