libcorecrypto

maintainer AlphaJack · 3 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The download is from Apple's own developer website (developer.apple.com), which is the official upstream source. The maintainer explicitly explains why it cannot be in source=(): Apple doesn't allow redistribution and the download requires browser-like headers/cookies to access. The checksum validation is commented out with an explanation that Apple frequently changes the checksum, which is sloppy but the source itself is Apple's official server. This is not an unofficial or personal host — it's the legitimate vendor. The real concern is the lack of integrity verification (no checksum on the downloaded zip), which is a quality/reproducibility issue rather than a supply-chain attack vector, since the download comes directly from Apple's servers over HTTPS. The build() and package() steps use standard cmake/make. This is low severity: sloppy packaging practice (no checksum, download outside source=()) but not a genuine supply-chain risk given the source is Apple's own infrastructure.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 82%): The download is from Apple's own developer website (developer.apple.com), which is the official upstream source. The maintainer explicitly explains why it cannot be in source=(): Apple doesn't allow redistribution and the download requires browser-like headers/cookies to access. The checksum validation is commented out with an explanation that Apple frequently changes the checksum, which is sloppy but the source itself is Apple's official server. This is not an unofficial or personal host — it's the legitimate vendor. The real concern is the lack of integrity verification (no checksum on the downloaded zip), which is a quality/reproducibility issue rather than a supply-chain attack vector, since the download comes directly from Apple's servers over HTTPS. The build() and package() steps use standard cmake/make. This is low severity: sloppy packaging practice (no checksum, download outside source=()) but not a genuine supply-chain risk given the source is Apple's own infrastructure.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:27 curl -s 'https://developer.apple.com/file/?file=security&agree=Yes' \

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: AlphaJack <alphajack at tuta dot io>
    
      2
    
      3pkgname="libcorecrypto"
    
      4# when apple breaks the checksum, run 
    
      5#    curl -s https://developer.apple.com/security/ | grep 'rel="/file/?file=security&agree=Yes"' | cut -d "(" -f2 | cut -d ")" -f1 | grep -o '[0-9]\+'
    
      6pkgver=2023
    
      7pkgrel=1
    
      8pkgdesc="Library implementing Apple low-level cryptographic primitives"
    
      9url="https://developer.apple.com/security/"
    
      10license=("custom")
    
      11arch=("x86_64" "armv7h" "aarch64")
    
      12makedepends=("clang" "cmake" "curl" "python")
    
      13source=("LICENSE"
    
      #"corecrypto.zip.b2"
    
      #"code-coverage.cmake"
    
      )
    
      17b2sums=('571233903371c819e99b2e39f4b32013b37e3c8a618d54ee27d98b0c61bfb50f702780f597e096df9d8e8e4d0ad0a4e3fcaf6949b7035796ecb5be274c1894d0')
    
      18provides=("libcorecrypto")
    
      19conflicts=("libcorecrypto-git")
    
      20
    
      21prepare(){
    
# get corecrypto.zip from apple website
    
# since apple doesn't allow redistribution of the archive, and that a canonical download link would have been too mainstream, i had to use firefox > copy as curl
    
# also the server doesn't seem to support byte ranges, so to skip the download we cannot rely on curl
    
echo "==> Retrieving corecrypto.zip from Apple (~40MB)..."
    
if [ ! -f "corecrypto.zip" ]; then
    
curl -s 'https://developer.apple.com/file/?file=security&agree=Yes' \
    
     -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0' \
    
     -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8' \
    
     -H 'Accept-Language: en-US,en;q=0.5' \
    
     -H 'Accept-Encoding: gzip, deflate, br' \
    
     -H 'Referer: https://developer.apple.com/security/' \
    
     -H 'DNT: 1' \
    
     -H 'Connection: keep-alive' \
    
     -H 'Cookie: geo=US' \
    
     -H 'Upgrade-Insecure-Requests: 1' \
    
     -H 'Sec-Fetch-Dest: document' \
    
     -H 'Sec-Fetch-Mode: navigate' \
    
     -H 'Sec-Fetch-Site: same-origin' \
    
     -H 'Sec-Fetch-User: ?1' \
    
     -H 'Pragma: no-cache' \
    
     -H 'Cache-Control: no-cache' \
    
     -o "corecrypto.zip" 
    
fi
    
if [ -e "corecrypto.zip" ]; then
    
echo "  -> Found corecrypto.zip"
    
else
    
echo "  [KO] Could not find corecrypto.zip"
    
exit 1
    
fi
    
# removing because checksum changes often
    
#echo "==> Validating corecrypto.zip with b2sums..."
    
#b2sum --check --quiet "corecrypto.zip.b2" || return 1
    
#echo "    corecrypto.zip. ... Passed"
    
bsdtar --extract --file "corecrypto.zip" || exit
    
cd "corecrypto-2023"
    
install -d "scripts"
    
# missing comment character
    
sed 's| Copyright|# Copyright|' -i "CMakeLists.txt"
    
# not needed if removing all coverage entries
    
#install -D "$srcdir/code-coverage.cmake" "scripts/code-coverage.cmake"
    
sed '/coverage/d' -i "CMakeLists.txt"
    
# run cmake
    
# https://wiki.archlinux.org/title/CMake_package_guidelines
    
# https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=cpprestsdk
    
CC=clang CXX=clang++ cmake -B "build" -S . \
    
      -DCMAKE_BUILD_TYPE="Release" \
    
      -DCMAKE_INSTALL_PREFIX="/usr" \
    
      -DCMAKE_INSTALL_LIBDIR="lib" \
    
      -Wno-dev
    
# avoid errors, as per https://github.com/NyaMisty/AltServer-Linux/ 
    
sed '/corecrypto_perf\|corecrypto_test/d' -i "build/CMakeFiles/Makefile2"
    
# avoid error, as per https://aur.archlinux.org/packages/libcorecrypto-git
    
sed 's|CC_MARK_MEMORY_PUBLIC|//&|' -i "ccrng/src/ccrng_entropy.c"
    
# not needed if removing all coverage entries
    
# avoid "error: expected expression"
    
#sed 's|^;|{};|g' -i "build/gen/corecrypto_test/include/cc_generated_test_vectors.h"
    
      78}
    
      79
    
      80build(){
    
cd "corecrypto"
    
cmake --build "build" -j "$(nproc)"
    
      83}
    
      84
    
      85package(){
    
cd "corecrypto"
    
make -C "build" DESTDIR="$pkgdir" install
    
install -D -m 644 "$srcdir/LICENSE" "$pkgdir/usr/share/licenses/libcorecrypto/LICENSE"
    
      89}
    
      90
    
      91

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2