ti-cgt-arm

maintainer alexei · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary installer (.bin) from dr-download.ti.com, which is Texas Instruments' official software distribution CDN (the same domain used for all TI tool downloads). The URL structure matches TI's standard download path pattern. However, the package executes this binary directly during the build process (chmod +x then runs it with --mode unattended), which is a genuine supply-chain concern: if the binary were ever substituted or the host compromised, arbitrary code would execute. The MD5 checksum is present (matching what TI publishes on their site), which provides some integrity assurance, though MD5 is weak. This is a legitimate vendor tool distributed via the vendor's own infrastructure, but the pattern of executing a downloaded binary installer is inherently medium-risk by AUR standards — it cannot be audited as source code. This is a common pattern for proprietary TI tools in the AUR and is not malicious, but the risk classification of medium is appropriate given the executed binary from an external host, even if that host is the official vendor.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("https://dr-download.ti.com/software-development/ide-configuration-compiler-or-debugger/MD-sDOoXkUcde/${pkgver}/${_installer}")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary installer (.bin) from dr-download.ti.com, which is Texas Instruments' official software distribution CDN (the same domain used for all TI tool downloads). The URL structure matches TI's standard download path pattern. However, the package executes this binary directly during the build process (chmod +x then runs it with --mode unattended), which is a genuine supply-chain concern: if the binary were ever substituted or the host compromised, arbitrary code would execute. The MD5 checksum is present (matching what TI publishes on their site), which provides some integrity assurance, though MD5 is weak. This is a legitimate vendor tool distributed via the vendor's own infrastructure, but the pattern of executing a downloaded binary installer is inherently medium-risk by AUR standards — it cannot be audited as source code. This is a common pattern for proprietary TI tools in the AUR and is not malicious, but the risk classification of medium is appropriate given the executed binary from an external host, even if that host is the official vendor.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  Alexei Colin <ac at alexeicolin dot com>
    
      2
    
      3pkgname=ti-cgt-arm
    
      4pkgver=20.2.7.LTS
    
      5pkgrel=3
    
      6pkgdesc="Texas Instruments Code Generation Tools (compiler) for ARM"
    
      7arch=('x86_64')
    
      8url="http://www.ti.com/tool/ARM-CGT"
    
      9license=('custom')
    
      10
    
      11#optdepends=('ccstudio')
    
      12conflicts=('ccstudio') # current package ships with the toolchains
    
      13
    
      14_installer="ti_cgt_tms470_${pkgver}_linux-x64_installer.bin"
    
      15source=("https://dr-download.ti.com/software-development/ide-configuration-compiler-or-debugger/MD-sDOoXkUcde/${pkgver}/${_installer}")
    
      16md5sums=('b629994a0d2577f8ac65855cc1a80631') # TI website provides the MD5 sum specifically
    
      17
    
      18options=(!strip libtool staticlibs emptydirs !purge !zipman)
    
      19
    
      20_ccsdir=opt/ccstudio
    
      21_installdir=ccs/tools/compiler
    
      22
    
      23prepare() {
    
      24    cd $srcdir
    
      25    chmod +x ./${_installer}
    
      26}
    
      27
    
      28package() {
    
      29    echo ">>> Running installer..."
    
      30
    
      31    ./${_installer} --mode unattended --prefix $pkgdir/${_ccsdir}/${_installdir}
    
      32
    
      33    # Match permissions to ccstudio package (see notes in ccstudio.install)
    
      34    find $pkgdir/${_ccsdir} -type d -exec chmod 0775 {} \;
    
      35
    
      36    install -D -m0644 $pkgdir/${_ccsdir}/${_installdir}/${pkgname}_${pkgver}/ARM_RTS_${pkgver}_manifest.html $pkgdir/usr/share/licenses/$pkgname/LICENSE.html
    
      37}
    
      38

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2