ti-cgt-arm-clang

maintainer pintert3 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary installer (.bin) from dr-download.ti.com, which is Texas Instruments' official software distribution domain (used for CCS, compilers, and other TI tools). The domain is legitimate TI infrastructure, not a personal or unofficial host. However, the package executes this binary installer directly (chmod +x then runs it with --mode unattended), which is a genuine supply-chain concern: if TI's download server were compromised or the URL were redirected, an arbitrary binary would execute with package build privileges. A sha256sum is provided, which mitigates substitution attacks at the network level. The pattern of wrapping a vendor installer binary in a PKGBUILD is common in the AUR for proprietary tools (e.g., various TI, Xilinx, Intel packages) and is not inherently malicious. The medium rating is appropriate: it's an executed binary from a vendor host with a checksum, which is the standard AUR pattern for proprietary toolchain packages, but the execution of an opaque binary installer remains a real (if accepted) supply-chain risk class.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source=("https://dr-download.ti.com/software-development/ide-configuration-compiler-or-debugger/MD-ayxs93eZNN/${pkgver}/${_installer}")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary installer (.bin) from dr-download.ti.com, which is Texas Instruments' official software distribution domain (used for CCS, compilers, and other TI tools). The domain is legitimate TI infrastructure, not a personal or unofficial host. However, the package executes this binary installer directly (chmod +x then runs it with --mode unattended), which is a genuine supply-chain concern: if TI's download server were compromised or the URL were redirected, an arbitrary binary would execute with package build privileges. A sha256sum is provided, which mitigates substitution attacks at the network level. The pattern of wrapping a vendor installer binary in a PKGBUILD is common in the AUR for proprietary tools (e.g., various TI, Xilinx, Intel packages) and is not inherently malicious. The medium rating is appropriate: it's an executed binary from a vendor host with a checksum, which is the standard AUR pattern for proprietary toolchain packages, but the execution of an opaque binary installer remains a real (if accepted) supply-chain risk class.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  Phillip S. Kajubi <pintert3 at kalabentate dot com>
    
      2# Contributor:  Alexei Colin <ac at alexeicolin dot com>
    
      3
    
      4pkgname=ti-cgt-arm-clang
    
      5_partpkgver=4.0.3
    
      6pkgver=${_partpkgver}.LTS
    
      7pkgrel=2
    
      8pkgdesc="Texas Instruments Code Generation Tools (compiler) for ARM (CLANG) LTS"
    
      9arch=('x86_64')
    
      10url="http://www.ti.com/tool/ARM-CGT"
    
      11license=('LicenseRef-multiple-licenses')
    
      12
    
      13depends=('gcc-libs' 'nodejs')
    
      14conflicts=('ccstudio') # current package ships with the toolchains
    
      15
    
      16_installer="ti_cgt_armllvm_${pkgver}_linux-x64_installer.bin"
    
      17source=("https://dr-download.ti.com/software-development/ide-configuration-compiler-or-debugger/MD-ayxs93eZNN/${pkgver}/${_installer}")
    
      18sha256sums=('617b0379a0f0aaac364d6b16f0ea899687ebf7f773a840d1c7d6f0691205919c')
    
      19
    
      20options=(!strip libtool staticlibs emptydirs !purge !zipman)
    
      21
    
      22# I intend to separate it from ccstudio
    
      23# _ccsdir=opt/ccstudio
    
      24# _installdir=ccs/tools/compiler
    
      25_tidir=opt/ti
    
      26_installdir=tools/compiler
    
      27
    
      28prepare() {
    
      29    cd $srcdir
    
      30    chmod +x ./${_installer}
    
      31}
    
      32
    
      33package() {
    
      34    echo ">>> Running installer..."
    
      35
    
      36    ./${_installer} --mode unattended --prefix $pkgdir/${_tidir}/${_installdir}
    
      37
    
      38    # Match permissions to ccstudio package (see notes in ccstudio.install)
    
      39    find $pkgdir/${_tidir} -type d -exec chmod 0775 {} \;
    
      40
    
      41    install -D -m0644 $pkgdir/${_tidir}/${_installdir}/ti-cgt-armllvm_${pkgver}/TI_Arm_Clang_Compiler_${_partpkgver}_manifest.html $pkgdir/usr/share/licenses/$pkgname/LICENSE.html
    
      42}
    
      43

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2