maixvision-bin

maintainer semes · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD installs a prebuilt binary .deb from cdn.sipeed.com, which is the official CDN of Sipeed (the hardware vendor for Maix AIoT boards). The domain is plausibly official and the maintainer email matches the vendor domain (sipeed.com). However, it is still a prebuilt binary blob (an Electron app with a bundled Node.js binary) from a CDN rather than a reproducible build from source, which constitutes a genuine supply-chain concern: if the CDN were compromised or the URL redirected, arbitrary code would execute on the user's system. The sha256sums provide integrity verification against the downloaded artifact, which mitigates substitution attacks somewhat, but does not address the trust question of the binary's provenance. The package installs executables directly into /opt and /usr/bin. This is a standard pattern for binary AUR packages (-bin suffix), and cdn.sipeed.com is the vendor's own distribution infrastructure, making this a legitimate but inherently risky pattern rather than a clear attack. Medium severity is appropriate.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:10 source=("https://cdn.sipeed.com/maixvision/${pkgver}/maixvision_${pkgver}_amd64.deb"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD installs a prebuilt binary .deb from cdn.sipeed.com, which is the official CDN of Sipeed (the hardware vendor for Maix AIoT boards). The domain is plausibly official and the maintainer email matches the vendor domain (sipeed.com). However, it is still a prebuilt binary blob (an Electron app with a bundled Node.js binary) from a CDN rather than a reproducible build from source, which constitutes a genuine supply-chain concern: if the CDN were compromised or the URL redirected, arbitrary code would execute on the user's system. The sha256sums provide integrity verification against the downloaded artifact, which mitigates substitution attacks somewhat, but does not address the trust question of the binary's provenance. The package installs executables directly into /opt and /usr/bin. This is a standard pattern for binary AUR packages (-bin suffix), and cdn.sipeed.com is the vendor's own distribution infrastructure, making this a legitimate but inherently risky pattern rather than a clear attack. Medium severity is appropriate.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: llyy@sipeed.com
    
      2pkgname=maixvision-bin
    
      3pkgver=1.2.2
    
      4pkgrel=2
    
      5pkgdesc="MaixVision development environment for Sipeed Maix series AIoT boards"
    
      6arch=('x86_64')
    
      7url="https://www.sipeed.com/maixvision"
    
      8license=('custom')
    
      9depends=('gtk3' 'libnotify' 'nss' 'libxss' 'libxtst' 'xdg-utils' 'at-spi2-core' 'libutil-linux' 'libsecret')
    
      10source=("https://cdn.sipeed.com/maixvision/${pkgver}/maixvision_${pkgver}_amd64.deb"
    
      11        "maixvision.desktop"
    
      12        "maixvision.png")
    
      13sha256sums=('a807e1d946862bb3972562ed25ba46dd236b7f04dd78e23bf419f3425626465d'
    
      14            '2b36fd1a1c3640900ad6fd47e6125c800fce8f00652be773dcd53f7c530535ce'
    
      15            'c2f483122d4c799b877e1e24426e592fdd90b5c545fe1be4e43aac32120568b7')
    
      16
    
      17prepare() {
    
      18  bsdtar -xvf data.tar.xz -C "$srcdir"
    
      19}
    
      20
    
      21package() {
    
      22  cp -r "$srcdir/opt" "$pkgdir/"
    
      23
    
      24  install -d "$pkgdir/usr/bin"
    
      25  ln -s "/opt/MaixVersion/maixversion" "$pkgdir/usr/bin/maixvision"
    
      26
    
      27  install -Dm644 "$srcdir/maixvision.desktop" "$pkgdir/usr/share/applications/maixvision.desktop"
    
      28
    
      29  install -Dm644 "$srcdir/maixvision.png" "$pkgdir/usr/share/icons/hicolor/256x256/apps/maixvision.png"
    
      30
    
      31  find "$pkgdir" -type d -exec chmod 755 {} \;
    
      32  find "$pkgdir" -type f -exec chmod 644 {} \;
    
      33
    
      34  chmod 755 "$pkgdir/opt/MaixVision/maixvision"
    
      35  chmod 755 "$pkgdir/opt/MaixVision/resources/app.asar.unpacked/node_modules/node/bin/node"
    
      36}
    
      37

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2