theos-ios-toolchain

maintainer jaywalker · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary toolchain (compiler/linker executables) from a personal domain (kabiroberai.com) via a PHP download script rather than from an official upstream release host (e.g., GitHub releases, a distro mirror, or a well-known CDN). The toolchain is then installed into /opt/theos/toolchain and will be executed during iOS development builds. There is a sha256sum check, which mitigates substitution attacks somewhat, but the source is still a personal server with no public build reproducibility or audit trail. If kabiroberai.com is compromised or the maintainer rotates the file without updating the checksum (the PHP script could serve different content), users could receive malicious compiler binaries. This is a genuine supply-chain concern: executed binary code from a non-official personal host. The cheaper model's MEDIUM rating is correct.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("toolchain.tar.gz::https://kabiroberai.com/toolchain/download.php?toolchain=ios-linux")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 78%): The PKGBUILD downloads a prebuilt binary toolchain (compiler/linker executables) from a personal domain (kabiroberai.com) via a PHP download script rather than from an official upstream release host (e.g., GitHub releases, a distro mirror, or a well-known CDN). The toolchain is then installed into /opt/theos/toolchain and will be executed during iOS development builds. There is a sha256sum check, which mitigates substitution attacks somewhat, but the source is still a personal server with no public build reproducibility or audit trail. If kabiroberai.com is compromised or the maintainer rotates the file without updating the checksum (the PHP script could serve different content), users could receive malicious compiler binaries. This is a genuine supply-chain concern: executed binary code from a non-official personal host. The cheaper model's MEDIUM rating is correct.

PKGBUILD

1 offending line(s) highlighted

      1# Former Maintainer: Asger Hautop Drewsen <asgerdrewsen@gmail.com>
    
      2# Maintainer: Justin Williams <justin@justinandyadi.com>
    
      3
    
      4pkgname=theos-ios-toolchain
    
      5pkgver=2019.10.15
    
      6_pkgver="${pkgver//./-}"
    
      7pkgrel=1
    
      8pkgdesc="Kabir's theos toolchain for iOS"
    
      9arch=('any')
    
      10url="https://github.com/theos/theos/wiki/Installation"
    
      11license=('custom')
    
      12depends=('theos')
    
      13makedepends=()
    
      14optdepends=()
    
      15source=("toolchain.tar.gz::https://kabiroberai.com/toolchain/download.php?toolchain=ios-linux")
    
      16sha256sums=('d21ea9bef671af204932f4f99095f4906a7c7639dedc04eec72ed317fcd96284')
    
      17
    
      18package() {
    
      19	mkdir -p "${pkgdir}/opt/theos/toolchain"
    
      20	cp -dpr --no-preserve=ownership "${srcdir}/linux" "${pkgdir}/opt/theos/toolchain"
    
      21}
    
      22

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2