intel-sgx-sdk-bin
maintainer marmis
· 0 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The source is a prebuilt SDK installer from Intel's official domain (download.01.org), which is plausibly the project's own release infrastructure; despite not being on a whitelist, it is a legitimate and expected source for this software, and the package does not execute arbitrary remote code or exfiltrate data.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a prebuilt SDK installer from Intel's official domain (download.01.org), which is plausibly the project's own release infrastructure; despite not being on a whitelist, it is a legitimate and expected source for this software, and the package does not execute arbitrary remote code or exfiltrate data.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:20
source=("https://download.01.org/intel-sgx/sgx-linux/${pkgver}/distro/Debian13/sgx_linux_x64_sdk_${_pkgver}.bin"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: marmis <tiagodepalves@gmail.com>
2
# Contributor: "marmis" Tiago de Paula <tiagodepalves@gmail.com>
3
4
pkgname=intel-sgx-sdk-bin
5
pkgdesc='Intel® Software Guard Extensions SDK for Linux* OS'
6
pkgver=2.30
7
_pkgver="${pkgver}.100.1"
8
pkgrel=1
9
url='https://github.com/intel/confidential-computing.sgx'
10
arch=(x86_64)
11
license=('BSD-3-Clause AND LicenseRef-Intel-SGX-Third-Party') # https://github.com/intel/confidential-computing.sgx/blob/main/License.txt
12
depends=('glibc' 'libstdc++' 'openssl' 'bash' 'python')
13
optdepends=(
14
'intel-sgx-psw: for hardware support'
15
'gdb: GDB plugin for SGX binaries'
16
)
17
provides=("intel-sgx-sdk=${pkgver}")
18
conflicts=('intel-sgx-sdk')
19
options=(!strip !debug) # debug symbols already included from upstream, better not to strip them
20
source=("https://download.01.org/intel-sgx/sgx-linux/${pkgver}/distro/Debian13/sgx_linux_x64_sdk_${_pkgver}.bin"
21
'intel-sgx-sdk-skip-tmp.patch')
22
b2sums=('ac0c159f896bdb50c3dcdb3848ec6b053817c8f7c69569ed64103d372cee2a27fd9f27ab39e7686e90d69dcbd506b9de0e1566f6f7807304f3d4f5485958d663'
23
'7da757aae6410d927b3697a66608b84d10a4902fc522ed4af4453cf8dcece1a2f46a762a55455710433dc516f9a68f662ab32cebe3c5fe28639c1d13f661606c')
24
25
## Here you can change the installation directory.
26
_installdir=/opt/intel
27
28
prepare() {
29
cp "sgx_linux_x64_sdk_${_pkgver}.bin" sgx_linux_x64_sdk.bin
30
patch --binary --force -t -Ni intel-sgx-sdk-skip-tmp.patch
31
chmod +x sgx_linux_x64_sdk.bin
32
}
33
34
package() (
35
local installdir
36
installdir="$(realpath -m "${pkgdir}/${_installdir}")"
37
38
# The installer runs a Makefile which fails when run in parallel.
39
export MAKEFLAGS='-j1'
40
./sgx_linux_x64_sdk.bin --prefix "${installdir}"
41
cd "${installdir}"
42
43
# fix ${srcdir} references
44
sed -i -E "s|\b(SGX_SDK=).*|\1${_installdir}/sgxsdk|g" sgxsdk/environment
45
sed -i -E "s|\b(SGX_LIBRARY_PATH=).*|\1${_installdir}/sgxsdk/lib64|g" sgxsdk/bin/sgx-gdb
46
sed -i -E "s|^(prefix=).*|\1${_installdir}/sgxsdk|g" sgxsdk/pkgconfig/*.pc
47
48
# fix generated symlinks
49
ln -v -s libsgx_urts.so -fT sgxsdk/lib64/libsgx_urts.so.2
50
find sgxsdk/sdk_libs/ -name '*.so' -print -exec \
51
sh -euc 'ln -sr "sgxsdk/lib64/$(basename "$1")" -fT "$1"' -- '{}' \;
52
53
# The uninstall script shouldn't be used with this package.
54
rm "${pkgdir}/opt/intel/sgxsdk/uninstall.sh"
55
56
# composed license
57
install -vD -t "${pkgdir}/usr/share/licenses/${pkgname}/" \
58
-m644 "${pkgdir}/opt/intel/sgxsdk/licenses/License.txt"
59
)
60
Changes since previous scan
--- PKGBUILD @ 2026-08-01 00:11+++ PKGBUILD @ 2026-08-03 00:08@@ -3,9 +3,9 @@ pkgname=intel-sgx-sdk-bin pkgdesc='Intel® Software Guard Extensions SDK for Linux* OS'-pkgver=2.29+pkgver=2.30 _pkgver="${pkgver}.100.1"-pkgrel=2+pkgrel=1 url='https://github.com/intel/confidential-computing.sgx' arch=(x86_64) license=('BSD-3-Clause AND LicenseRef-Intel-SGX-Third-Party') # https://github.com/intel/confidential-computing.sgx/blob/main/License.txt@@ -17,9 +17,9 @@ provides=("intel-sgx-sdk=${pkgver}") conflicts=('intel-sgx-sdk') options=(!strip !debug) # debug symbols already included from upstream, better not to strip them-source=("https://download.01.org/intel-sgx/sgx-linux/${pkgver}/distro/ubuntu26.04-server/sgx_linux_x64_sdk_${_pkgver}.bin"+source=("https://download.01.org/intel-sgx/sgx-linux/${pkgver}/distro/Debian13/sgx_linux_x64_sdk_${_pkgver}.bin" 'intel-sgx-sdk-skip-tmp.patch')-b2sums=('1e9f9c0c1127266483c2cc78df6dd5eabe4827ec464958476e481611e4705d187d86d915c19e19aa023e044f6ff4244971ab5ffc1bd635c4c9fb04b412820a37'+b2sums=('ac0c159f896bdb50c3dcdb3848ec6b053817c8f7c69569ed64103d372cee2a27fd9f27ab39e7686e90d69dcbd506b9de0e1566f6f7807304f3d4f5485958d663' '7da757aae6410d927b3697a66608b84d10a4902fc522ed4af4453cf8dcece1a2f46a762a55455710433dc516f9a68f662ab32cebe3c5fe28639c1d13f661606c') ## Here you can change the installation directory.Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 03:19:42 | MEDIUM | 1 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 11:17:50 | MEDIUM | 1 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 17:35:03 | MEDIUM | 1 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |