intel-sgx-psw-bin

maintainer marmis · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a Debian repository archive from Intel's official download domain for extracting and repackaging into Arch Linux; the source is unverifiable but from a legitimate vendor host, and no remote code execution or obfuscation is present.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a Debian repository archive from Intel's official download domain for extracting and repackaging into Arch Linux; the source is unverifiable but from a legitimate vendor host, and no remote code execution or obfuscation is present.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 source=("sgx_${pkgver}_debian_local_repo.tgz::https://download.01.org/intel-sgx/sgx-linux/${pkgver}/distro/Debian13/sgx_debian_local_repo.tgz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: marmis <tiagodepalves@gmail.com>
    
      2# Contributor: "marmis" Tiago de Paula <tiagodepalves@gmail.com>
    
      3
    
      4pkgname=intel-sgx-psw-bin
    
      5pkgdesc='Intel® Software Guard Extensions Platform Software for Linux* OS'
    
      6pkgver=2.30
    
      7pkgrel=1
    
      8url='https://github.com/intel/confidential-computing.sgx'
    
      9arch=(x86_64)
    
      10license=('BSD-3-Clause AND LicenseRef-Intel-SGX-Third-Party') # https://github.com/intel/confidential-computing.sgx/blob/main/License.txt
    
      11depends=('glibc' 'libstdc++' 'bash')
    
      12optdepends=(
    
      13  'protobuf-21: required for the AESM service'
    
      14  'nodejs: for running the SGX DCAP PCCS Server'
    
      15  'curl: required for SGX Remote Attestation Service (RA)'
    
      16  'boost183: required by the TDX Quote Generation Service (QGS)'
    
      17)
    
      18provides=("intel-sgx-psw=${pkgver}")
    
      19conflicts=('intel-sgx-psw')
    
      20options=(!strip !debug) # debug symbols already included from upstream, better not to strip them
    
      21backup=('etc/aesmd.conf' 'etc/mpa_registration.conf' 'etc/qgs.conf' 'etc/sgx_default_qcnl.conf')
    
      22source=("sgx_${pkgver}_debian_local_repo.tgz::https://download.01.org/intel-sgx/sgx-linux/${pkgver}/distro/Debian13/sgx_debian_local_repo.tgz"
    
      23       'intel-sgx-sysusers.conf')
    
      24b2sums=('18d61906b851196a0f955b1cdbf86f2d36e8914d0fab0608c1c8b9e0c7857d7b3eb2e104d2bb765ff718d162c810db9762350e75672fb2c85b7d07c3db7cba44'
    
      25        'f0a1415f8e88ffe2fe189c56a701a9756f74947375f142aa3965679129d3182f1b380beea02d70e07cbe7c9443461b8cbb674193ae07f71d543d13a10ecaf7ff')
    
      26
    
      27package() {
    
      28  find sgx_debian_local_repo -name '*.deb' -print -exec \
    
      29    sh -euc 'ar -p "$1" -O data.tar.xz | tar -x --xz -C "$2"' -- {} "${pkgdir}" \;
    
      30
    
      31  # required users and groups
    
      32  install -vD -m644 intel-sgx-sysusers.conf \
    
      33    -T "${pkgdir}/usr/lib/sysusers.d/intel-sgx.conf"
    
      34
    
      35  # composed license
    
      36  install -vD -t "${pkgdir}/usr/share/licenses/${pkgname}/" \
    
      37    -m644 "${pkgdir}/usr/share/doc/libsgx-enclave-common/copyright"
    
      38
    
      39  _fix_debian_paths # namcap rule: directoryname
    
      40  _fix_binary_symlinks # namcap rule: symlink
    
      41}
    
      42
    
      43# Move files to standard Arch Linux folders.
    
      44# See https://wiki.archlinux.org/title/Arch_package_guidelines#Directories
    
      45_fix_debian_paths() {
    
      46  # /etc/udev is for user files, packages should use /usr/lib/udev instead
    
      47  install -vd "${pkgdir}/usr/lib/udev/"
    
      48  mv -v --no-copy "${pkgdir}/etc/udev/rules.d" \
    
      49    -T "${pkgdir}/usr/lib/udev/rules.d"
    
      50  rmdir "${pkgdir}/etc/udev"
    
      51
    
      52  # Debian has a /usr/lib/$TARGET folder, but you won't find them in Arch
    
      53  mv -v -t "${pkgdir}/usr/lib/" \
    
      54    --no-copy "${pkgdir}/usr/lib/${CARCH}-linux-gnu"/*.so*
    
      55  rmdir "${pkgdir}/usr/lib/${CARCH}-linux-gnu"
    
      56
    
      57  # Debian has an actual /lib folder, which in Arch is just a symlink to /usr/lib
    
      58  mv -v -t "${pkgdir}/usr/lib/systemd/system/" \
    
      59    --no-copy "${pkgdir}/lib/systemd/system"/*.service
    
      60  rmdir "${pkgdir}/lib/systemd/system" "${pkgdir}/lib/systemd" "${pkgdir}/lib"
    
      61
    
      62  # Debian also supports /include, which is empty here
    
      63  rmdir "${pkgdir}/include"
    
      64}
    
      65
    
      66# Update symbolic links generated by the installer.
    
      67_fix_binary_symlinks() {
    
      68  local -a broken_symlinks=(
    
      69    "${pkgdir}/opt/intel/sgx-aesm-service/aesm/libsgx_pce.signed.so"
    
      70    "${pkgdir}/opt/intel/sgx-aesm-service/aesm/libsgx_pce.signed.so.1"
    
      71    "${pkgdir}/opt/intel/sgx-aesm-service/aesm/libsgx_qe3.signed.so"
    
      72    "${pkgdir}/opt/intel/sgx-aesm-service/aesm/libsgx_qe3.signed.so.1"
    
      73    "${pkgdir}/opt/intel/sgx-pck-id-retrieval-tool/libsgx_id_enclave.signed.so.1"
    
      74    "${pkgdir}/opt/intel/sgx-pck-id-retrieval-tool/libsgx_pce.signed.so.1"
    
      75  )
    
      76
    
      77  local symlink target
    
      78  for symlink in "${broken_symlinks[@]}"; do
    
      79    ln -v -sr "${pkgdir}/usr/lib/$(basename "${symlink}")" \
    
      80      -fT "${symlink}"
    
      81  done
    
      82}
    
      83

Changes since previous scan

--- PKGBUILD @ 2026-08-01 00:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -3,8 +3,8 @@
 
 pkgname=intel-sgx-psw-bin
 pkgdesc='Intel® Software Guard Extensions Platform Software for Linux* OS'
-pkgver=2.29
-pkgrel=2
+pkgver=2.30
+pkgrel=1
 url='https://github.com/intel/confidential-computing.sgx'
 arch=(x86_64)
 license=('BSD-3-Clause AND LicenseRef-Intel-SGX-Third-Party') # https://github.com/intel/confidential-computing.sgx/blob/main/License.txt
@@ -13,20 +13,20 @@
   'protobuf-21: required for the AESM service'
   'nodejs: for running the SGX DCAP PCCS Server'
   'curl: required for SGX Remote Attestation Service (RA)'
-  'boost190: required by the TDX Quote Generation Service (QGS)'
+  'boost183: required by the TDX Quote Generation Service (QGS)'
 )
 provides=("intel-sgx-psw=${pkgver}")
 conflicts=('intel-sgx-psw')
 options=(!strip !debug) # debug symbols already included from upstream, better not to strip them
 backup=('etc/aesmd.conf' 'etc/mpa_registration.conf' 'etc/qgs.conf' 'etc/sgx_default_qcnl.conf')
-source=("sgx_${pkgver}_debian_local_repo.tgz::https://download.01.org/intel-sgx/sgx-linux/${pkgver}/distro/ubuntu26.04-server/sgx_debian_local_repo.tgz"
+source=("sgx_${pkgver}_debian_local_repo.tgz::https://download.01.org/intel-sgx/sgx-linux/${pkgver}/distro/Debian13/sgx_debian_local_repo.tgz"
        'intel-sgx-sysusers.conf')
-b2sums=('5832a7537c7bb0b50376bf6818e647bd738ba54da6263249ddf7c6a6483b60a0458bc7177c893ea7a364ddfa9c9ab9abcb5925ef12dd30c3f4ab61b9c0d62180'
+b2sums=('18d61906b851196a0f955b1cdbf86f2d36e8914d0fab0608c1c8b9e0c7857d7b3eb2e104d2bb765ff718d162c810db9762350e75672fb2c85b7d07c3db7cba44'
         'f0a1415f8e88ffe2fe189c56a701a9756f74947375f142aa3965679129d3182f1b380beea02d70e07cbe7c9443461b8cbb674193ae07f71d543d13a10ecaf7ff')
 
 package() {
   find sgx_debian_local_repo -name '*.deb' -print -exec \
-    sh -euc 'ar -p "$1" -O data.tar.zst | tar -x --zstd -C "$2"' -- {} "${pkgdir}" \;
+    sh -euc 'ar -p "$1" -O data.tar.xz | tar -x --xz -C "$2"' -- {} "${pkgdir}" \;
 
   # required users and groups
   install -vD -m644 intel-sgx-sysusers.conf \

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 05:20:08	MEDIUM	1
2026-08-01 00:11:18	LOW	2
2026-07-31 11:17:50	MEDIUM	1
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 17:35:03	MEDIUM	1
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2