vim-tabnine-git
maintainer wjhandley
· 0 votes
· scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged
The PKGBUILD downloads a prebuilt binary (TabNine.zip) from update.tabnine.com at build time with SKIP'd checksum. While update.tabnine.com is the official Tabnine distribution server, the version URL is dynamically constructed at parse time via a live curl call (`curl -sS https://update.tabnine.com/bundles/version`), meaning the exact binary fetched is determined at runtime with no integrity verification. The binary is then installed as an executable. This is a genuine supply-chain concern: no checksum pinning means any MITM or server-side substitution would go undetected. The git sources (tabnine/YouCompleteMe, tabnine/ycmd) are also SKIP'd but are official repos. The dynamic version resolution at global scope (outside any function) is also architecturally problematic for reproducibility. This matches the medium severity profile: executed binary from a host that, while official, has no integrity guarantee in this PKGBUILD.
Triggered rules
MEDIUM
External download from an untrusted host, not in source=()
external_download_not_in_source
curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.
-
PKGBUILD:62
tabnine_version="$(curl -sS https://update.tabnine.com/bundles/version)/x86_64-unknown-linux-musl"
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:66
https://update.tabnine.com/bundles/$tabnine_version/TabNine.zip
MEDIUM
AI review
llm_review
An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 80%): The PKGBUILD downloads a prebuilt binary (TabNine.zip) from update.tabnine.com at build time with SKIP'd checksum. While update.tabnine.com is the official Tabnine distribution server, the version URL is dynamically constructed at parse time via a live curl call (`curl -sS https://update.tabnine.com/bundles/version`), meaning the exact binary fetched is determined at runtime with no integrity verification. The binary is then installed as an executable. This is a genuine supply-chain concern: no checksum pinning means any MITM or server-side substitution would go undetected. The git sources (tabnine/YouCompleteMe, tabnine/ycmd) are also SKIP'd but are official repos. The dynamic version resolution at global scope (outside any function) is also architecturally problematic for reproducibility. This matches the medium severity profile: executed binary from a host that, while official, has no integrity guarantee in this PKGBUILD.
PKGBUILD
2 offending line(s) highlighted
1
# Contributor: Will Handley <wh260@cam.ac.uk>
2
# Contributor: Leonidas Spyropoulos <artafinde at gmail dot com>
3
# Contributor: staletic
4
# Contributor: James Brink <brink.james@gmail.com>
5
# Contributor: Wilson E. Alvarez <wilson.e.alvarez1@gmail.com>
6
# Contributor: p <parimal@beyond8labs.com>
7
# Contributor: Victor <victor@xirion.net>
8
# Contributor: Jan-Tarek Butt <tarek AT ring0 DOT de>
9
# Contributor: Erik Beran <eberan AT gmail DOT com>
10
# Contributor: Thor K. H. <thor at roht dot no>
11
# Contributor: Babken Vardanyan <483ken 4tgma1l
12
# Contributor: mikezackles
13
# Contributor: z33ky
14
# Contributor: stykr
15
# Contributor: Svenstaro
16
# Contributor: KaiSforza
17
# Contributor: Simon Gomizelj <simongmzlj@gmail.com>
18
# Contributor: Daniel Micay <danielmicay@gmail.com>
19
# Contributor: shmilee
20
# Contributor: foobster
21
# Contributor: archdria
22
# Contributor: Andy Weidenbaum <archbaum@gmail.com>
23
# Contributor: edacval
24
# Contributor: MarcelPa
25
# Contributor: Trent
26
# Contributor: urxvtcd-256
27
28
_gocode="y"
29
_typescript="y" # If you enable both typescript and tern it will defaul to typescript.
30
_tern="n" # Tern seems abandoned - consider moving to TSserver above (see project page)
31
_java="y"
32
33
_use_system_clang="ON"
34
_use_system_abseil="OFF"
35
_neovim="$NEOVIM_YOUCOMPLETEME"
36
37
### IMPORTANT: Do no edit below this line unless you know what you're doing
38
39
pkgname=vim-tabnine-git
40
pkgver=r2911.4a042af0
41
pkgrel=1
42
pkgdesc='A code-completion engine for Vim with tabnine'
43
arch=('x86_64')
44
url='https://www.tabnine.com/'
45
license=('GPL3')
46
groups=('vim-plugins')
47
depends=('vim' 'python>=3.6' 'python-watchdog' 'python-bottle' 'clang>=11.0')
48
makedepends=('git' 'cmake' 'pybind11')
49
optdepends=(
50
'gopls: Go semantic completion'
51
'nodejs-tern: JavaScript semantic completion'
52
'rust-analyzer: Rust semantic completion'
53
'typescript: Typescript semantic completion'
54
'python-jedi: Python semantic completion'
55
'python-numpydoc: Python semantic completion'
56
'python-regex: Better Unicode support'
57
'omnisharp-roslyn: C# semantic completion'
58
'java-environment>=11: Java semantic completion'
59
'jdtls: Java semantic completion'
60
'abseil-cpp: if setting _use_system_abseil ON')
61
replaces=('vim-youcompleteme-git')
62
tabnine_version="$(curl -sS https://update.tabnine.com/bundles/version)/x86_64-unknown-linux-musl"
63
if [[ ${_use_system_clang} == "ON" ]]; then
64
source=(git+https://github.com/tabnine/YouCompleteMe.git
65
git+https://github.com/tabnine/ycmd.git
66
https://update.tabnine.com/bundles/$tabnine_version/TabNine.zip
67
)
68
sha256sums=('SKIP'
69
'SKIP'
70
'SKIP')
71
noextract=(TabNine.zip)
72
else
73
source=(git+https://github.com/tabnine/YouCompleteMe.git
74
git+https://github.com/tabnine/ycmd.git
75
https://update.tabnine.com/bundles/$tabnine_version/TabNine.zip
76
clangd-13.0.0.tar.bz2::https://github.com/tabnine/llvm/releases/download/13.0.0/clangd-13.0.0-x86_64-unknown-linux-gnu.tar.bz2
77
libclang-13.0.0.tar.bz2::https://github.com/tabnine/llvm/releases/download/13.0.0/libclang-13.0.0-x86_64-unknown-linux-gnu.tar.bz2)
78
sha256sums=('SKIP'
79
'SKIP'
80
'SKIP'
81
'10a64c468d1dd2a384e0e5fd4eb2582fd9f1dfa706b6d2d2bb88fb0fbfc2718d'
82
'9a5bee818a4995bc52e91588059bef42728d046808206bfb93977f4e3109e50c')
83
noextract=TabNine.zip
84
fi
85
86
pkgver() {
87
cd "${srcdir}"/YouCompleteMe || exit
88
printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
89
}
90
91
prepare() {
92
cd "${srcdir}"/YouCompleteMe || exit
93
git submodule init third_party/ycmd
94
git config submodule.ycmd.url "$srcdir"/ycmd
95
git submodule update third_party/ycmd
96
97
rm -rf "${srcdir}"/YouCompleteMe/third_party/ycmd/cpp/pybind11 || exit
98
if [[ ${_use_system_clang} == "ON" ]]; then
99
rm -rf "${srcdir}"/YouCompleteMe/third_party/ycmd/cpp/llvm || exit
100
fi
101
102
if [[ "$_gocode" == "y" ]]; then
103
sed -e 's|\(gopls_binary_path":\).*$|\1 "/usr/bin/gopls",|' \
104
-i "${srcdir}"/YouCompleteMe/third_party/ycmd/ycmd/default_settings.json
105
fi
106
107
if [[ "$_typescript" == "y" ]]; then
108
rm -rf "${srcdir}/YouCompleteMe/third_party/ycmd/third_party/tern_runtime" || exit
109
sed -e 's|\(tsserver_binary_path":\).*$|\1 "/usr/bin/tsserver",|' \
110
-i "${srcdir}"/YouCompleteMe/third_party/ycmd/ycmd/default_settings.json
111
fi
112
if [[ "$_java" == "y" ]]; then
113
sed -e 's|\(java_jdtls_workspace_root_path":\).*$|\1 "/tmp",|' \
114
-e 's|\(java_binary_path":\).*$|\1 "/usr/bin/java"|' \
115
-i "${srcdir}"/YouCompleteMe/third_party/ycmd/ycmd/default_settings.json
116
# The 'java_jdtls_workspace_root_path' option is overriden from the vim plugin
117
# so just make sure this is also done there.
118
sed -e "s|\(ycm_java_jdtls_workspace_root_path',\).*\$|\1 '/tmp' )|" \
119
-i "${srcdir}"/YouCompleteMe/plugin/youcompleteme.vim
120
fi
121
122
if [[ ${_use_system_clang} == "ON" ]]; then
123
sed -e 's|\(clangd_binary_path":\).*$|\1 "/usr/bin/clangd",|' \
124
-i "${srcdir}"/YouCompleteMe/third_party/ycmd/ycmd/default_settings.json
125
# The 'ycm_clangd_binary_path' option is overriden from the vim plugin
126
# so just make sure this is also done there.
127
sed -e "s|\(ycm_clangd_binary_path',\).*\$|\1 '/usr/bin/clangd' )|" \
128
-i "${srcdir}"/YouCompleteMe/plugin/youcompleteme.vim
129
fi
130
131
sed -e 's|\(rust_toolchain_root":\).*$|\1 "/usr",|' \
132
-e 's|\(roslyn_binary_path":\).*$|\1 "/opt/omnisharp-roslyn/OmniSharp.exe",|' \
133
-e 's|\(mono_binary_path":\).*$|\1 "/usr/bin/mono",|' \
134
-i "${srcdir}"/YouCompleteMe/third_party/ycmd/ycmd/default_settings.json
135
136
unzip ${srcdir}/TabNine.zip -d ${srcdir}/TabNine
137
}
138
139
build() {
140
mkdir -p "${srcdir}"/ycmd_build
141
cd "${srcdir}"/ycmd_build || exit
142
143
cmake \
144
-DUSE_CLANG_COMPLETER=${_use_system_clang} \
145
-DUSE_SYSTEM_LIBCLANG=${_use_system_clang} \
146
-DUSE_SYSTEM_ABSEIL=${_use_system_abseil} \
147
../YouCompleteMe/third_party/ycmd/cpp
148
149
make ycm_core
150
}
151
152
package() {
153
pkg_ycmd_dir="${pkgdir}/usr/share/vim/vimfiles/third_party/ycmd"
154
155
cd "${srcdir}"/YouCompleteMe || exit
156
install -Ddm755 "${pkg_ycmd_dir}"
157
158
cp -dr --no-preserve=ownership autoload doc plugin python "${pkgdir}/usr/share/vim/vimfiles"
159
cp -dr --no-preserve=ownership third_party/ycmd/{ycmd,ycm_core.*.so,CORE_VERSION} "${pkg_ycmd_dir}"
160
161
if [[ ${_use_system_clang} == "ON" ]]; then
162
install -Ddm755 "${pkg_ycmd_dir}/third_party/clang/lib/"
163
ln -s /usr/lib/libclang.so "${pkg_ycmd_dir}/third_party/clang/lib/libclang.so"
164
ln -s /usr/lib/clang "${pkg_ycmd_dir}/third_party/clang/lib/clang"
165
else
166
install -Ddm755 "${pkg_ycmd_dir}/third_party/clangd/output/bin/"
167
cp -dr --no-preserve=ownership "${srcdir}"/LICENSE.TXT "${pkg_ycmd_dir}/third_party/clangd/output"
168
cp -dr --no-preserve=ownership "${srcdir}"/bin "${pkg_ycmd_dir}/third_party/clangd/output/"
169
cp -dr --no-preserve=ownership "${srcdir}"/lib "${pkg_ycmd_dir}/third_party/clangd/output/"
170
install -Ddm755 "${pkg_ycmd_dir}/third_party/clang/lib/"
171
cp -dr --no-preserve=ownership "${srcdir}"/YouCompleteMe/third_party/ycmd/third_party/clang/lib/clang "${pkg_ycmd_dir}/third_party/clang/lib/clang"
172
ln -sr "${pkg_ycmd_dir}"/third_party/clangd/output/lib/libclang.so "${pkg_ycmd_dir}/third_party/clang/lib/libclang.so"
173
fi
174
175
if [[ "$_java" == "y" ]]; then
176
install -Ddm755 "${pkg_ycmd_dir}/third_party/eclipse.jdt.ls/target/repository/"
177
ln -sf /usr/share/java/jdtls/{config_linux,features,plugins} "${pkg_ycmd_dir}/third_party/eclipse.jdt.ls/target/repository/"
178
fi
179
180
if [[ ${_tern} == "ON" ]]; then
181
install -Ddm755 "${pkg_ycmd_dir}/third_party/tern_runtime/node_modules/"
182
ln -s /usr/lib/node_modules/tern "${pkg_ycmd_dir}/third_party/tern_runtime/node_modules/"
183
fi
184
185
install -Ddm755 "${pkg_ycmd_dir}/third_party/tabnine/binaries/${tabnine_version}"
186
cp -dr --no-preserve=ownership "${srcdir}/ycmd/third_party/tabnine/__init__.py" "${pkg_ycmd_dir}/third_party/tabnine/"
187
install -Dm755 ${srcdir}/TabNine/* "${pkg_ycmd_dir}/third_party/tabnine/binaries/${tabnine_version}/"
188
189
find "${pkgdir}" \( -name .git -or -name 'test*' -or -name 'run_tests.py' \) -exec rm -fr {} +
190
191
python -m compileall -d /usr/share/vim/vimfiles "${pkgdir}/usr/share/vim/vimfiles"
192
python -O -m compileall -d /usr/share/vim/vimfiles "${pkgdir}/usr/share/vim/vimfiles"
193
}
194
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | MEDIUM | 3 |
| 2026-08-02 00:16:08 | MEDIUM | 3 |
| 2026-08-01 00:11:18 | MEDIUM | 3 |
| 2026-07-31 00:14:10 | MEDIUM | 3 |
| 2026-07-30 00:17:23 | MEDIUM | 3 |
| 2026-07-29 00:25:53 | MEDIUM | 3 |
| 2026-07-28 00:07:28 | MEDIUM | 3 |
| 2026-07-27 00:24:32 | MEDIUM | 3 |
| 2026-07-26 00:07:32 | MEDIUM | 3 |
| 2026-07-25 00:13:44 | MEDIUM | 3 |
| 2026-07-24 00:02:28 | MEDIUM | 3 |
| 2026-07-23 00:14:47 | MEDIUM | 3 |
| 2026-07-22 00:29:32 | MEDIUM | 3 |
| 2026-07-21 00:24:15 | MEDIUM | 3 |
| 2026-07-20 00:19:49 | MEDIUM | 3 |
| 2026-07-19 00:17:08 | MEDIUM | 3 |
| 2026-07-18 00:14:48 | MEDIUM | 3 |
| 2026-07-17 00:06:16 | MEDIUM | 3 |
| 2026-07-16 00:05:41 | MEDIUM | 3 |
| 2026-07-15 00:09:25 | MEDIUM | 3 |