pvr-tex-tool-bin

maintainer nrobinson2000 · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary installer (.run file) from cdn.imgtec.com, which is the official CDN for Imagination Technologies (the vendor of PVRTexTool). The installer is then executed unattended during the build process to extract the actual binaries. While cdn.imgtec.com is the legitimate vendor CDN (not a personal or unofficial host), executing a downloaded binary installer is inherently a supply-chain risk: if the CDN were compromised or the URL redirected, arbitrary code would run during packaging. The sha256sum provides integrity verification, which mitigates substitution attacks significantly. This is a common pattern for proprietary binary-only AUR packages (like -bin packages) and is not unusual or suspicious in that context. The risk is real but typical for this class of package — a prebuilt binary from the official vendor distributed via their CDN, with checksum verification. Downgrading from MEDIUM to CLEAN would be too generous since an executed binary installer is involved, but this is a standard legitimate vendor package pattern. Keeping MEDIUM is appropriate.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("install_${_versionstr}.run::https://cdn.imgtec.com/sdk/OFFLINE/PVRTexToolSetup-${_versionstr}.run-x64"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary installer (.run file) from cdn.imgtec.com, which is the official CDN for Imagination Technologies (the vendor of PVRTexTool). The installer is then executed unattended during the build process to extract the actual binaries. While cdn.imgtec.com is the legitimate vendor CDN (not a personal or unofficial host), executing a downloaded binary installer is inherently a supply-chain risk: if the CDN were compromised or the URL redirected, arbitrary code would run during packaging. The sha256sum provides integrity verification, which mitigates substitution attacks significantly. This is a common pattern for proprietary binary-only AUR packages (like -bin packages) and is not unusual or suspicious in that context. The risk is real but typical for this class of package — a prebuilt binary from the official vendor distributed via their CDN, with checksum verification. Downgrading from MEDIUM to CLEAN would be too generous since an executed binary installer is involved, but this is a standard legitimate vendor package pattern. Keeping MEDIUM is appropriate.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Nathan Robinson <nrobinson2000 at me dot com>
    
      2
    
      3pkgname=pvr-tex-tool-bin
    
      4pkgver=2022.1
    
      5_versionstr='2022_R1'
    
      6pkgrel=4
    
      7
    
      8pkgdesc="A comprehensive texture processing and compression tool with support for PVR textures."
    
      9url="https://www.imaginationtech.com/developers/powervr-sdk-tools/pvrtextool/"
    
      10
    
      11arch=('x86_64')
    
      12options=('!strip')
    
      13license=('custom')
    
      14
    
      15source=("install_${_versionstr}.run::https://cdn.imgtec.com/sdk/OFFLINE/PVRTexToolSetup-${_versionstr}.run-x64"
    
      16"LICENSE"
    
      17"PVRTexTool.desktop")
    
      18
    
      19sha256sums=('72aa6560636a4db32d822e0c0614ee29bfe7d7e7395260c30070f1e0412f7d16'
    
      20            '837064152c1e86d030f76e9beb8da77869f8d8bc183fd8c8a26be696120b5ff4'
    
      21            '2172168dd08d1945ed750bd5ec748731e8b068afe705e956862081ec503ed86f')
    
      22
    
      23# discovered with namcap(1)
    
      24depends=(qt5-base libxcursor dbus libxrandr freetype2 hicolor-icon-theme)
    
      25
    
      26package() {
    
      27_srcname=PVRTexTool
    
      28
    
      29# Run installer
    
      30chmod +x "${srcdir}/install_${_versionstr}.run"
    
      31"${srcdir}/install_${_versionstr}.run" --prefix "${srcdir}" --mode unattended
    
      32
    
      33# Install license
    
      34install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      35
    
      36# Install documentation
    
      37mkdir -p "${pkgdir}/usr/share/doc/${pkgname}"
    
      38mv ${srcdir}/${_srcname}/Documentation/* "${pkgdir}/usr/share/doc/${pkgname}"
    
      39
    
      40# Install library
    
      41mkdir -p "${pkgdir}/usr/include"
    
      42mkdir -p "${pkgdir}/usr/lib"
    
      43mv ${srcdir}/${_srcname}/Library/Include/* "${pkgdir}/usr/include"
    
      44mv ${srcdir}/${_srcname}/Library/Linux_x86_64/libPVRTexLib.so "${pkgdir}/usr/lib"
    
      45
    
      46# Install CLI binaries
    
      47install -D "${srcdir}/${_srcname}/CLI/Linux_x86_64/PVRTexToolCLI" "${pkgdir}/usr/bin/pvr-tex-tool"
    
      48
    
      49# Install GUI application
    
      50mkdir -p "${pkgdir}/usr/share/${pkgname}"
    
      51mv ${srcdir}/${_srcname}/GUI/Linux_x86_64/* "${pkgdir}/usr/share/${pkgname}"
    
      52ln -s "/usr/share/${pkgname}/PVRTexToolGUI" "${pkgdir}/usr/bin/pvr-tex-tool-gui"
    
      53
    
      54# Fix permissions
    
      55find "${pkgdir}/usr/share/${pkgname}" -maxdepth 1 -type d | xargs chmod 755
    
      56
    
      57# Delete .run file (only pacman should be allowed to perform updates)
    
      58rm "${pkgdir}/usr/share/${pkgname}/autoupdate-linux-x64.run"
    
      59
    
      60# Copy icons
    
      61pushd "${pkgdir}/usr/share/${pkgname}/Icons" > /dev/null
    
      62for _image in *.png; do
    
      63_size="${_image//[^0-9]/}"
    
      64install -D "${_image}" "${pkgdir}/usr/share/icons/hicolor/${_size}x${_size}/apps/PVRTexTool.png"
    
      65done
    
      66popd > /dev/null
    
      67
    
      68# Create desktop entry
    
      69install -D "PVRTexTool.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      70}
    
      71

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2