maixpy-ide

maintainer orphaned · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary installer archive (a 7z containing executables: bin/, lib/, share/) from dl.sipeed.com, which is Sipeed's own official download server for their hardware products. This is a vendor-hosted binary, not a random personal host — Sipeed is the manufacturer of the Maix boards and MaixPy is their official IDE. However, the source is still a prebuilt binary blob from a non-GitHub/non-standard host with no upstream build reproducibility, and the package installs executable binaries and shared libraries directly into /opt and /usr/bin. The sha256 checksum provides integrity verification against tampering in transit, but cannot protect against a compromised upstream host substituting a new binary with the same filename. This is a classic medium-severity supply-chain concern: legitimate vendor binary, but executed code from a non-standard host with no source build. Not high (no evidence of malice, vendor is the actual hardware maker), not low (it's executed binaries, not data).

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 "http://dl.sipeed.com/MAIX/MaixPy/ide/v${pkgver}/maixpy-ide-linux-x86_64-${pkgver}-installer-archive.7z"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary installer archive (a 7z containing executables: bin/, lib/, share/) from dl.sipeed.com, which is Sipeed's own official download server for their hardware products. This is a vendor-hosted binary, not a random personal host — Sipeed is the manufacturer of the Maix boards and MaixPy is their official IDE. However, the source is still a prebuilt binary blob from a non-GitHub/non-standard host with no upstream build reproducibility, and the package installs executable binaries and shared libraries directly into /opt and /usr/bin. The sha256 checksum provides integrity verification against tampering in transit, but cannot protect against a compromised upstream host substituting a new binary with the same filename. This is a classic medium-severity supply-chain concern: legitimate vendor binary, but executed code from a non-standard host with no source build. Not high (no evidence of malice, vendor is the actual hardware maker), not low (it's executed binaries, not data).

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Masanori Ohgita <mp_aur[at]ohgita[dot]info>
    
      2pkgname=maixpy-ide
    
      3pkgver=0.2.3
    
      4pkgrel=2
    
      5pkgdesc="Micropython env for Sipeed Maix boards"
    
      6url="https://github.com/sipeed/MaixPy"
    
      7arch=('x86_64')
    
      8license=('Apache')
    
      9depends=('libusb' 'python-pyusb' 'qt5-multimedia' 'qt5-script' 'qt5-svg' 'qt5-tools' 'qt5-webengine' 'qt5-3d')
    
      10builddepends=()
    
      11source=(
    
      12	"http://dl.sipeed.com/MAIX/MaixPy/ide/v${pkgver}/maixpy-ide-linux-x86_64-${pkgver}-installer-archive.7z"
    
      13)
    
      14sha256sums=(
    
      15	'a04cedfe656781230d9ce0340e87afa86cc3d35e1fca7e1dfbd1f4f901ada161'
    
      16)
    
      17install=maixpy-ide.install
    
      18
    
      19package() {
    
      20
    
      21	cd "${srcdir}"
    
      22
    
      23	# Install the application to /opt/maixpy-ide/
    
      24	mkdir -p "${pkgdir}/opt/${pkgname}/"
    
      25	cp -a share/ "${pkgdir}/opt/${pkgname}/"
    
      26	cp -a lib/ "${pkgdir}/opt/${pkgname}/"
    
      27	cp -a bin/ "${pkgdir}/opt/${pkgname}/"
    
      28	cp -a README.txt "${pkgdir}/opt/${pkgname}/"
    
      29	chmod 755 "${pkgdir}/opt/${pkgname}/bin/maixpyide.sh"
    
      30
    
      31	# Add the symbolic link to /usr/bin/
    
      32	mkdir -p "${pkgdir}/usr/bin/"
    
      33	ln -s "/opt/${pkgname}/bin/maixpyide.sh" "${pkgdir}/usr/bin/${pkgname}"
    
      34
    
      35	# Add the desktop entry
    
      36	mkdir -p "${pkgdir}/usr/share/applications/"
    
      37	install -Dm644 "../${pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      38
    
      39}
    
      40

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2