ndi-sdk-embedded

maintainer icedream · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The source is a prebuilt binary SDK (shared library libndi.so + executables) downloaded from a Rackspace CDN URL that is not the canonical NewTek/NDI download page. The URL pattern (a long hex-prefixed CDN bucket) is consistent with NewTek's historical distribution method for their NDI SDK — the companion AUR package 'ndi-sdk' by Daniel Bermond uses the same CDN pattern — so this is not obviously a personal/rogue host. However, it is still an unofficial CDN endpoint rather than a verifiable vendor domain, and the package installs executed binaries and a shared library without source. The sha256sum provides integrity checking against tampering in transit, but does not protect against the CDN host itself serving a malicious payload. The overall pattern (prebuilt closed-source binary SDK from a CDN with a hash) is a genuine medium supply-chain concern: if the CDN bucket were compromised or the URL silently redirected, arbitrary code would be installed system-wide. This is not clearly malicious, but the risk is real and non-trivial.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source=("$_srcfile"::"http://514f211588de67e4fdcf-437b8dd50f60b69cf0974b538e50585b.r63.cf1.rackcdn.com/Utilities/SDK/Embedded_SDK/InstallNDISDK_v${_majver}_Linux_Embedded.tar.gz")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The source is a prebuilt binary SDK (shared library libndi.so + executables) downloaded from a Rackspace CDN URL that is not the canonical NewTek/NDI download page. The URL pattern (a long hex-prefixed CDN bucket) is consistent with NewTek's historical distribution method for their NDI SDK — the companion AUR package 'ndi-sdk' by Daniel Bermond uses the same CDN pattern — so this is not obviously a personal/rogue host. However, it is still an unofficial CDN endpoint rather than a verifiable vendor domain, and the package installs executed binaries and a shared library without source. The sha256sum provides integrity checking against tampering in transit, but does not protect against the CDN host itself serving a malicious payload. The overall pattern (prebuilt closed-source binary SDK from a CDN with a hash) is a genuine medium supply-chain concern: if the CDN bucket were compromised or the URL silently redirected, arbitrary code would be installed system-wide. This is not clearly malicious, but the risk is real and non-trivial.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Carl Kittelberger <icedream@icedream.pw>
    
      2# Based on the PKGBUILD for AUR package `ndi-sdk` by Daniel Bermond <dbermond@archlinux.org>
    
      3
    
      4pkgname=ndi-sdk-embedded
    
      5pkgver=4.5.3.20200630.r116025
    
      6pkgrel=1
    
      7_majver="${pkgver%%.*}"
    
      8pkgdesc='NewTek NDI Embedded SDK'
    
      9arch=('aarch64' 'armv6h' 'armv7h' 'x86_64' 'i686')
    
      10url='https://www.newtek.com/ndi/sdk/'
    
      11license=('custom')
    
      12depends=('avahi')
    
      13provides=('libndi' 'libndi-bin' 'ndi-sdk')
    
      14conflicts=('libndi' 'libndi-bin' 'libndi-git' 'ndi-sdk')
    
      15options=('!strip')
    
      16_srcfile="InstallNDISDK_v${pkgver}_Linux_Embedded.tar.gz"
    
      17source=("$_srcfile"::"http://514f211588de67e4fdcf-437b8dd50f60b69cf0974b538e50585b.r63.cf1.rackcdn.com/Utilities/SDK/Embedded_SDK/InstallNDISDK_v${_majver}_Linux_Embedded.tar.gz")
    
      18noextract=("$_srcfile")
    
      19sha256sums=('e930cf814e536b927e3e44dd1288a9963fc65aa332c51f13ef8e2f8d829f1abf')
    
      20
    
      21case "${CARCH}" in
    
      22armv6*)
    
      23    newtek_triplet="arm-rpi1-linux-gnueabihf"
    
      24    ;;
    
      25armv7*)
    
      26    newtek_triplet="arm-rpi2-linux-gnueabihf"
    
      27    ;;
    
      28arm*)
    
      29    newtek_triplet="arm-newtek-linux-gnueabihf"
    
      30    ;;
    
      31aarch*)
    
      32    newtek_triplet="aarch64-rpi4-linux-gnueabi"
    
      33    ;;
    
      34*)
    
      35    newtek_triplet="${CARCH}-linux-gnu"
    
      36    ;;
    
      37esac
    
      38
    
      39prepare() {
    
      40    mkdir -p "${pkgname}-${pkgver}"
    
      41    bsdtar -x -f "$_srcfile" -C "${pkgname}-${pkgver}"
    
      42
    
      43    local _target_line
    
      44    cd "${pkgname}-${pkgver}"
    
      45    _target_line="$(sed -n '/^__NDI_ARCHIVE_BEGIN__$/=' "InstallNDISDK_v${_majver}_Linux_Embedded.sh")"
    
      46    _target_line="$((_target_line + 1))"
    
      47
    
      48    tail -n +"$_target_line" "InstallNDISDK_v${_majver}_Linux_Embedded.sh" |
    
      49        tar -zxv \
    
      50            "NDI SDK for Linux/bin/${newtek_triplet}/" \
    
      51            "NDI SDK for Linux/lib/${newtek_triplet}/" \
    
      52            "NDI SDK for Linux/documentation" \
    
      53            "NDI SDK for Linux/include" \
    
      54            "NDI SDK for Linux/licenses/libndi_licenses.txt" \
    
      55            "NDI SDK for Linux/NDI Embedded License Agreement.txt" \
    
      56            "NDI SDK for Linux/Version.txt"
    
      57}
    
      58
    
      59pkgver() {
    
      60    local _sdkdir="${srcdir}/${pkgname}-${pkgver}/NDI SDK for Linux"
    
      61
    
      62    read _ date rel ver < "${_sdkdir}/Version.txt"
    
      63    date="${date//-/}"
    
      64    ver="${ver#v}"
    
      65    printf '%s.%s.%s' "$ver" "$date" "$rel"
    
      66}
    
      67
    
      68package() {
    
      69    local _sdkdir="${srcdir}/${pkgname}-${pkgver}/NDI SDK for Linux"
    
      70
    
      71    # binary executables
    
      72    install -D -m755 "${_sdkdir}/bin/${newtek_triplet}/"* -t "${pkgdir}/usr/bin"
    
      73
    
      74    # headers
    
      75    install -D -m644 "${_sdkdir}/include/"* -t "${pkgdir}/usr/include"
    
      76
    
      77    # library
    
      78    install -D -m755 "${_sdkdir}/lib/${newtek_triplet}/libndi.so.${_majver}".*.* -t "${pkgdir}/usr/lib"
    
      79    cd "${pkgdir}/usr/lib"
    
      80    ln -s "libndi.so.${_majver}".*.* "libndi.so.${_majver}"
    
      81    ln -s "libndi.so.${_majver}".*.* libndi.so
    
      82
    
      83    # docs
    
      84    install -D -m644 "${_sdkdir}/documentation/"* -t "${pkgdir}/usr/share/doc/${pkgname}"
    
      85
    
      86    # license
    
      87    install -D -m644 "${_sdkdir}/NDI Embedded License Agreement.txt" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      88    install -D -m644 "${_sdkdir}/licenses/libndi_licenses.txt" -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      89}
    
      90

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2