ti-cgt-arm-clang

MEDIUM

maintainer pintert3 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The PKGBUILD downloads a prebuilt binary installer (.bin) from dr-download.ti.com, which is Texas Instruments' official software distribution domain (used for CCS, compilers, and other TI tools). The domain is legitimate TI infrastructure, not a personal or unofficial host. However, the package executes this binary installer directly (chmod +x then runs it with --mode unattended), which is a genuine supply-chain concern: if TI's download server were compromised or the URL were redirected, an arbitrary binary would execute with package build privileges. A sha256sum is provided, which mitigates substitution attacks at the network level. The pattern of wrapping a vendor installer binary in a PKGBUILD is common in the AUR for proprietary tools (e.g., various TI, Xilinx, Intel packages) and is not inherently malicious. The medium rating is appropriate: it's an executed binary from a vendor host with a checksum, which is the standard AUR pattern for proprietary toolchain packages, but the execution of an opaque binary installer remains a real (if accepted) supply-chain risk class.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source=("https://dr-download.ti.com/software-development/ide-configuration-compiler-or-debugger/MD-ayxs93eZNN/${pkgver}/${_installer}")

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary installer (.bin) from dr-download.ti.com, which is Texas Instruments' official software distribution domain (used for CCS, compilers, and other TI tools). The domain is legitimate TI infrastructure, not a personal or unofficial host. However, the package executes this binary installer directly (chmod +x then runs it with --mode unattended), which is a genuine supply-chain concern: if TI's download server were compromised or the URL were redirected, an arbitrary binary would execute with package build privileges. A sha256sum is provided, which mitigates substitution attacks at the network level. The pattern of wrapping a vendor installer binary in a PKGBUILD is common in the AUR for proprietary tools (e.g., various TI, Xilinx, Intel packages) and is not inherently malicious. The medium rating is appropriate: it's an executed binary from a vendor host with a checksum, which is the standard AUR pattern for proprietary toolchain packages, but the execution of an opaque binary installer remains a real (if accepted) supply-chain risk class.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  Phillip S. Kajubi <pintert3 at kalabentate dot com>
    
      2# Contributor:  Alexei Colin <ac at alexeicolin dot com>
    
      3
    
      4pkgname=ti-cgt-arm-clang
    
      5_partpkgver=4.0.3
    
      6pkgver=${_partpkgver}.LTS
    
      7pkgrel=2
    
      8pkgdesc="Texas Instruments Code Generation Tools (compiler) for ARM (CLANG) LTS"
    
      9arch=('x86_64')
    
      10url="http://www.ti.com/tool/ARM-CGT"
    
      11license=('LicenseRef-multiple-licenses')
    
      12
    
      13depends=('gcc-libs' 'nodejs')
    
      14conflicts=('ccstudio') # current package ships with the toolchains
    
      15
    
      16_installer="ti_cgt_armllvm_${pkgver}_linux-x64_installer.bin"
    
      17source=("https://dr-download.ti.com/software-development/ide-configuration-compiler-or-debugger/MD-ayxs93eZNN/${pkgver}/${_installer}")
    
      18sha256sums=('617b0379a0f0aaac364d6b16f0ea899687ebf7f773a840d1c7d6f0691205919c')
    
      19
    
      20options=(!strip libtool staticlibs emptydirs !purge !zipman)
    
      21
    
      22# I intend to separate it from ccstudio
    
      23# _ccsdir=opt/ccstudio
    
      24# _installdir=ccs/tools/compiler
    
      25_tidir=opt/ti
    
      26_installdir=tools/compiler
    
      27
    
      28prepare() {
    
      29    cd $srcdir
    
      30    chmod +x ./${_installer}
    
      31}
    
      32
    
      33package() {
    
      34    echo ">>> Running installer..."
    
      35
    
      36    ./${_installer} --mode unattended --prefix $pkgdir/${_tidir}/${_installdir}
    
      37
    
      38    # Match permissions to ccstudio package (see notes in ccstudio.install)
    
      39    find $pkgdir/${_tidir} -type d -exec chmod 0775 {} \;
    
      40
    
      41    install -D -m0644 $pkgdir/${_tidir}/${_installdir}/ti-cgt-armllvm_${pkgver}/TI_Arm_Clang_Compiler_${_partpkgver}_manifest.html $pkgdir/usr/share/licenses/$pkgname/LICENSE.html
    
      42}
    
      43

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2