ti-cgt-msp430

maintainer alexei · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary installer from dr-download.ti.com, which is Texas Instruments' official software distribution domain (used for all TI tool downloads). The installer is executed during packaging with --mode unattended to extract the compiler toolchain. While the host is legitimate TI infrastructure (not a personal or unofficial host), executing a prebuilt binary installer during packaging is a genuine supply-chain concern: if TI's download server were compromised or the binary replaced, arbitrary code would run on the packager's system. The md5sum provides weak integrity verification (MD5 is cryptographically broken). This pattern is common for proprietary vendor tools in the AUR (similar to matlab, cuda, etc.) and is not malicious, but the execution of a downloaded binary installer does represent a real medium-severity supply-chain risk by AUR standards. No piracy or broken flags apply — this is a legitimate TI tool with a custom license.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("https://dr-download.ti.com/software-development/ide-configuration-compiler-or-debugger/MD-p4jWEYpR8n/${pkgver}/${_installer}")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The package downloads a prebuilt binary installer from dr-download.ti.com, which is Texas Instruments' official software distribution domain (used for all TI tool downloads). The installer is executed during packaging with --mode unattended to extract the compiler toolchain. While the host is legitimate TI infrastructure (not a personal or unofficial host), executing a prebuilt binary installer during packaging is a genuine supply-chain concern: if TI's download server were compromised or the binary replaced, arbitrary code would run on the packager's system. The md5sum provides weak integrity verification (MD5 is cryptographically broken). This pattern is common for proprietary vendor tools in the AUR (similar to matlab, cuda, etc.) and is not malicious, but the execution of a downloaded binary installer does represent a real medium-severity supply-chain risk by AUR standards. No piracy or broken flags apply — this is a legitimate TI tool with a custom license.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  Alexei Colin <ac at alexeicolin dot com>
    
      2
    
      3pkgname=ti-cgt-msp430
    
      4pkgver=21.6.1.LTS
    
      5pkgrel=1
    
      6pkgdesc="Texas Instruments Code Generation Tools (compiler) for MSP430"
    
      7arch=('x86_64')
    
      8url="https://www.ti.com/tool/MSP-CGT"
    
      9license=('custom')
    
      10
    
      11#optdepends=('ccstudio')
    
      12conflicts=('ccstudio') # current package ships with toolchains
    
      13
    
      14_installer="ti_cgt_msp430_${pkgver}_linux-x64_installer.bin"
    
      15source=("https://dr-download.ti.com/software-development/ide-configuration-compiler-or-debugger/MD-p4jWEYpR8n/${pkgver}/${_installer}")
    
      16md5sums=("b960da86bfe4d022c1b1c29968223904")
    
      17
    
      18options=(!strip libtool staticlibs emptydirs !purge !zipman)
    
      19
    
      20_ccsdir=opt/ccstudio
    
      21_installdir=ccs/tools/compiler
    
      22
    
      23prepare() {
    
      24    cd $srcdir
    
      25    chmod +x ./${_installer}
    
      26}
    
      27
    
      28package() {
    
      29    echo ">>> Running installer..."
    
      30
    
      31    ./${_installer} --mode unattended --prefix $pkgdir/${_ccsdir}/${_installdir}
    
      32
    
      33    # Match permissions to ccstudio package (see notes in ccstudio.install)
    
      34    find $pkgdir/${_ccsdir} -type d -exec chmod 0775 {} \;
    
      35
    
      36    install -D -m0644 $pkgdir/${_ccsdir}/${_installdir}/${pkgname}_${pkgver}/MSP430_RTS_${pkgver}_manifest.html $pkgdir/usr/share/licenses/$pkgname/LICENSE.html
    
      37}
    
      38

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2