maixpy-ide

MEDIUM

maintainer orphaned 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The PKGBUILD downloads a prebuilt binary installer archive (a 7z containing executables: bin/, lib/, share/) from dl.sipeed.com, which is Sipeed's own official download server for their hardware products. This is a vendor-hosted binary, not a random personal host — Sipeed is the manufacturer of the Maix boards and MaixPy is their official IDE. However, the source is still a prebuilt binary blob from a non-GitHub/non-standard host with no upstream build reproducibility, and the package installs executable binaries and shared libraries directly into /opt and /usr/bin. The sha256 checksum provides integrity verification against tampering in transit, but cannot protect against a compromised upstream host substituting a new binary with the same filename. This is a classic medium-severity supply-chain concern: legitimate vendor binary, but executed code from a non-standard host with no source build. Not high (no evidence of malice, vendor is the actual hardware maker), not low (it's executed binaries, not data).

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 "http://dl.sipeed.com/MAIX/MaixPy/ide/v${pkgver}/maixpy-ide-linux-x86_64-${pkgver}-installer-archive.7z"

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary installer archive (a 7z containing executables: bin/, lib/, share/) from dl.sipeed.com, which is Sipeed's own official download server for their hardware products. This is a vendor-hosted binary, not a random personal host — Sipeed is the manufacturer of the Maix boards and MaixPy is their official IDE. However, the source is still a prebuilt binary blob from a non-GitHub/non-standard host with no upstream build reproducibility, and the package installs executable binaries and shared libraries directly into /opt and /usr/bin. The sha256 checksum provides integrity verification against tampering in transit, but cannot protect against a compromised upstream host substituting a new binary with the same filename. This is a classic medium-severity supply-chain concern: legitimate vendor binary, but executed code from a non-standard host with no source build. Not high (no evidence of malice, vendor is the actual hardware maker), not low (it's executed binaries, not data).

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Masanori Ohgita <mp_aur[at]ohgita[dot]info>
    
      2pkgname=maixpy-ide
    
      3pkgver=0.2.3
    
      4pkgrel=2
    
      5pkgdesc="Micropython env for Sipeed Maix boards"
    
      6url="https://github.com/sipeed/MaixPy"
    
      7arch=('x86_64')
    
      8license=('Apache')
    
      9depends=('libusb' 'python-pyusb' 'qt5-multimedia' 'qt5-script' 'qt5-svg' 'qt5-tools' 'qt5-webengine' 'qt5-3d')
    
      10builddepends=()
    
      11source=(
    
      12	"http://dl.sipeed.com/MAIX/MaixPy/ide/v${pkgver}/maixpy-ide-linux-x86_64-${pkgver}-installer-archive.7z"
    
      13)
    
      14sha256sums=(
    
      15	'a04cedfe656781230d9ce0340e87afa86cc3d35e1fca7e1dfbd1f4f901ada161'
    
      16)
    
      17install=maixpy-ide.install
    
      18
    
      19package() {
    
      20
    
      21	cd "${srcdir}"
    
      22
    
      23	# Install the application to /opt/maixpy-ide/
    
      24	mkdir -p "${pkgdir}/opt/${pkgname}/"
    
      25	cp -a share/ "${pkgdir}/opt/${pkgname}/"
    
      26	cp -a lib/ "${pkgdir}/opt/${pkgname}/"
    
      27	cp -a bin/ "${pkgdir}/opt/${pkgname}/"
    
      28	cp -a README.txt "${pkgdir}/opt/${pkgname}/"
    
      29	chmod 755 "${pkgdir}/opt/${pkgname}/bin/maixpyide.sh"
    
      30
    
      31	# Add the symbolic link to /usr/bin/
    
      32	mkdir -p "${pkgdir}/usr/bin/"
    
      33	ln -s "/opt/${pkgname}/bin/maixpyide.sh" "${pkgdir}/usr/bin/${pkgname}"
    
      34
    
      35	# Add the desktop entry
    
      36	mkdir -p "${pkgdir}/usr/share/applications/"
    
      37	install -Dm644 "../${pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      38
    
      39}
    
      40

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2