tang-dynasty-bin

maintainer yhshzh0 · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD installs a prebuilt proprietary EDA toolchain binary (Tang Dynasty by Anlogic) downloaded from an Aliyun OSS bucket (anlogic.oss-cn-shanghai.aliyuncs.com). While Anlogic does distribute their tools via Aliyun OSS (it is a common CDN/storage choice for Chinese software vendors), the URL contains an obfuscated path segment ('ggshdjsgkdjh') that looks like a semi-private/unlisted distribution link rather than a canonical public release URL. The package installs and executes a closed-source binary blob directly on the user's system. A sha256 checksum is present, which mitigates silent substitution risk but does not address the trustworthiness of the binary itself. The combination of: (1) a prebuilt proprietary binary, (2) hosted on a cloud storage bucket rather than an official versioned release page, and (3) an obfuscated path component suggesting an unofficial or semi-private link, constitutes a genuine medium supply-chain concern — the binary could contain anything and there is no reproducibility or source audit possible.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:30 "TD_Release_2026.1_NL.zip::https://anlogic.oss-cn-shanghai.aliyuncs.com/web_doc/%E5%B7%A5%E5%85%B7%E4%B8%8E%E8%B5%84%E6%96%99%E4%B8%8B%E8%BD%BD/%E8%BD%AF%E4%BB%B6%E5%B7%A5%E5%85%B7/TD_Linux/TD_6.2/ggshdjsgkdjh/TD_Release_2026.1_NL.zip"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD installs a prebuilt proprietary EDA toolchain binary (Tang Dynasty by Anlogic) downloaded from an Aliyun OSS bucket (anlogic.oss-cn-shanghai.aliyuncs.com). While Anlogic does distribute their tools via Aliyun OSS (it is a common CDN/storage choice for Chinese software vendors), the URL contains an obfuscated path segment ('ggshdjsgkdjh') that looks like a semi-private/unlisted distribution link rather than a canonical public release URL. The package installs and executes a closed-source binary blob directly on the user's system. A sha256 checksum is present, which mitigates silent substitution risk but does not address the trustworthiness of the binary itself. The combination of: (1) a prebuilt proprietary binary, (2) hosted on a cloud storage bucket rather than an official versioned release page, and (3) an obfuscated path component suggesting an unofficial or semi-private link, constitutes a genuine medium supply-chain concern — the binary could contain anything and there is no reproducibility or source audit possible.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: yhshzh0 <yhshzh0@gmail.com>
    
      2
    
      3pkgname=tang-dynasty-bin
    
      4pkgver=6.2.2
    
      5pkgrel=1
    
      6pkgdesc="Tang Dynasty FPGA/EDA toolchain (official binary release)"
    
      7arch=('x86_64')
    
      8url="https://www.anlogic.com/"
    
      9license=('custom')
    
      10conflicts=('tang-dynasty')
    
      11options=(!strip)
    
      12
    
      13depends=(
    
      14  'glibc'
    
      15  'libx11'
    
      16  'gtk2'
    
      17  'libxext'
    
      18  'libxrender'
    
      19  'libxrandr'
    
      20  'libxinerama'
    
      21  'libxcb'
    
      22  'libxkbcommon'
    
      23  'fontconfig'
    
      24  'freetype2'
    
      25  'dbus'
    
      26  'udev'
    
      27)
    
      28
    
      29source=(
    
      30  "TD_Release_2026.1_NL.zip::https://anlogic.oss-cn-shanghai.aliyuncs.com/web_doc/%E5%B7%A5%E5%85%B7%E4%B8%8E%E8%B5%84%E6%96%99%E4%B8%8B%E8%BD%BD/%E8%BD%AF%E4%BB%B6%E5%B7%A5%E5%85%B7/TD_Linux/TD_6.2/ggshdjsgkdjh/TD_Release_2026.1_NL.zip"
    
      31  "tang-dynasty.desktop"
    
      32  "tang-dynasty.png"
    
      33  "99-anlogic-jtag.rules"
    
      34)
    
      35
    
      36sha256sums=(
    
      37  'a8be7c035846487723d7c48f09a9aeac49c7b0b7cc4d0491b94daec74e7201db'
    
      38  '40c810053bf8044eb20238ace006ff973622e6793e4ec339fdc571ae1399c203'
    
      39  'c7518eb2fe0ebafbeadba36a80616892403e89338eb8392aedaeb24ecfbb6040'
    
      40  'a4fe58538e15635dc3ed8688d312c006ba959b2d456c57fd0e445975632ef7e0'
    
      41)
    
      42
    
      43package() {
    
      44  install -dm755 "$pkgdir/opt"
    
      45  cp -a "TD_Release_2026.1_NL" "$pkgdir/opt/$pkgname"
    
      46
    
      47  chmod 755 "$pkgdir/opt/$pkgname/bin/td"
    
      48  chmod 755 "$pkgdir/opt/$pkgname/bin/td.sh"
    
      49
    
      50  install -Dm755 /dev/stdin "$pkgdir/usr/bin/tang-dynasty" << 'EOF'
    
      51#!/bin/bash
    
      52exec /opt/tang-dynasty-bin/bin/td.sh "$@"
    
      53EOF
    
      54
    
      55  install -Dm644 tang-dynasty.desktop \
    
      56    "$pkgdir/usr/share/applications/tang-dynasty.desktop"
    
      57  install -Dm644 tang-dynasty.png \
    
      58    "$pkgdir/usr/share/pixmaps/tang-dynasty.png"
    
      59
    
      60  # udev rules
    
      61  install -Dm644 99-anlogic-jtag.rules \
    
      62    "$pkgdir/usr/lib/udev/rules.d/99-anlogic-jtag.rules"
    
      63}
    
      64
    
      65

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2