ti-cgt-arm-clang

MEDIUM

maintainer pintert3 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The PKGBUILD downloads a prebuilt binary installer (.bin) from dr-download.ti.com, which is Texas Instruments' official software distribution domain (used for CCS, compilers, and other TI tools). The domain is legitimate TI infrastructure, not a personal or unofficial host. However, the package executes this binary installer directly (chmod +x then runs it with --mode unattended), which is a genuine supply-chain concern: if TI's download server were compromised or the URL were redirected, an arbitrary binary would execute with package build privileges. A sha256sum is provided, which mitigates substitution attacks at the network level. The pattern of wrapping a vendor installer binary in a PKGBUILD is common in the AUR for proprietary tools (e.g., various TI, Xilinx, Intel packages) and is not inherently malicious. The medium rating is appropriate: it's an executed binary from a vendor host with a checksum, which is the standard AUR pattern for proprietary toolchain packages, but the execution of an opaque binary installer remains a real (if accepted) supply-chain risk class.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source=("https://dr-download.ti.com/software-development/ide-configuration-compiler-or-debugger/MD-ayxs93eZNN/${pkgver}/${_installer}")

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary installer (.bin) from dr-download.ti.com, which is Texas Instruments' official software distribution domain (used for CCS, compilers, and other TI tools). The domain is legitimate TI infrastructure, not a personal or unofficial host. However, the package executes this binary installer directly (chmod +x then runs it with --mode unattended), which is a genuine supply-chain concern: if TI's download server were compromised or the URL were redirected, an arbitrary binary would execute with package build privileges. A sha256sum is provided, which mitigates substitution attacks at the network level. The pattern of wrapping a vendor installer binary in a PKGBUILD is common in the AUR for proprietary tools (e.g., various TI, Xilinx, Intel packages) and is not inherently malicious. The medium rating is appropriate: it's an executed binary from a vendor host with a checksum, which is the standard AUR pattern for proprietary toolchain packages, but the execution of an opaque binary installer remains a real (if accepted) supply-chain risk class.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  Phillip S. Kajubi <pintert3 at kalabentate dot com>
    
      2# Contributor:  Alexei Colin <ac at alexeicolin dot com>
    
      3
    
      4pkgname=ti-cgt-arm-clang
    
      5_partpkgver=4.0.3
    
      6pkgver=${_partpkgver}.LTS
    
      7pkgrel=2
    
      8pkgdesc="Texas Instruments Code Generation Tools (compiler) for ARM (CLANG) LTS"
    
      9arch=('x86_64')
    
      10url="http://www.ti.com/tool/ARM-CGT"
    
      11license=('LicenseRef-multiple-licenses')
    
      12
    
      13depends=('gcc-libs' 'nodejs')
    
      14conflicts=('ccstudio') # current package ships with the toolchains
    
      15
    
      16_installer="ti_cgt_armllvm_${pkgver}_linux-x64_installer.bin"
    
      17source=("https://dr-download.ti.com/software-development/ide-configuration-compiler-or-debugger/MD-ayxs93eZNN/${pkgver}/${_installer}")
    
      18sha256sums=('617b0379a0f0aaac364d6b16f0ea899687ebf7f773a840d1c7d6f0691205919c')
    
      19
    
      20options=(!strip libtool staticlibs emptydirs !purge !zipman)
    
      21
    
      22# I intend to separate it from ccstudio
    
      23# _ccsdir=opt/ccstudio
    
      24# _installdir=ccs/tools/compiler
    
      25_tidir=opt/ti
    
      26_installdir=tools/compiler
    
      27
    
      28prepare() {
    
      29    cd $srcdir
    
      30    chmod +x ./${_installer}
    
      31}
    
      32
    
      33package() {
    
      34    echo ">>> Running installer..."
    
      35
    
      36    ./${_installer} --mode unattended --prefix $pkgdir/${_tidir}/${_installdir}
    
      37
    
      38    # Match permissions to ccstudio package (see notes in ccstudio.install)
    
      39    find $pkgdir/${_tidir} -type d -exec chmod 0775 {} \;
    
      40
    
      41    install -D -m0644 $pkgdir/${_tidir}/${_installdir}/ti-cgt-armllvm_${pkgver}/TI_Arm_Clang_Compiler_${_partpkgver}_manifest.html $pkgdir/usr/share/licenses/$pkgname/LICENSE.html
    
      42}
    
      43

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2
2026-10-13 00:23:45	Medium	2