android-sdk-build-tools-35

maintainer farwayer · 1 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The package downloads prebuilt Android SDK build tools from Google's official domain (dl.google.com), which is a trusted source; despite the orphaned/re-adopted status flag, the source is authentic and checksummed, posing minimal risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt Android SDK build tools from Google's official domain (dl.google.com), which is a trusted source; despite the orphaned/re-adopted status flag, the source is authentic and checksummed, posing minimal risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: farwayer <farwayer@gmail.com>
    
      2
    
      3_ver=35
    
      4_fullver=35.0.0
    
      5_android=android-15
    
      6pkgname=android-sdk-build-tools-$_ver
    
      7pkgver=r$_ver
    
      8pkgrel=2
    
      9pkgdesc='Build-Tools for Google Android SDK (aapt, aidl, dexdump, dx, llvm-rs-cc)'
    
      10arch=('x86_64')
    
      11url='https://developer.android.com/studio/releases/build-tools'
    
      12license=('custom')
    
      13depends=('gcc-libs' 'zlib')
    
      14optdepends=('lib32-gcc-libs' 'lib32-zlib')
    
      15source=("https://dl.google.com/android/repository/build-tools_${pkgver}_linux.zip")
    
      16sha256sums=('bd3a4966912eb8b30ed0d00b0cda6b6543b949d5ffe00bea54c04c81e1561d88')
    
      17options=('!strip')
    
      18
    
      19package() {
    
      20  cd "$pkgdir"
    
      21  install -Dm644 "${srcdir}/$_android/NOTICE.txt" usr/share/licenses/$pkgname/NOTICE.txt
    
      22  mkdir -p opt/android-sdk/build-tools/$_fullver
    
      23  cp -r "$srcdir/$_android/"* "$pkgdir/opt/android-sdk/build-tools/$_fullver"
    
      24  chmod +Xr -R "$pkgdir/opt/android-sdk/build-tools/$_fullver"
    
      25}
    
      26

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-18 00:03
@@ -1,52 +1,26 @@
-# Maintainer: FantomTchi7 <vladislav.kudriashev@gmail.com>
-# Based on android-sdk-build-tools by xgdgsc and mynacol
+# Maintainer: farwayer <farwayer@gmail.com>
 
-pkgname=android-sdk-build-tools-35
-#_ver=$(cat "${srcdir}/$_android/source.properties" |grep ^Pkg.Revision=|sed 's/Pkg.Revision=\([0-9.]*\).*/\1/')
-_major=35
-_minor=0
-_micro=0
-_ver=35.0.0
-_displayversion=35
-pkgver=r35
+_ver=35
+_fullver=35.0.0
+_android=android-15
+pkgname=android-sdk-build-tools-$_ver
+pkgver=r$_ver
 pkgrel=2
-_sdk=android-sdk
-_android=android-15
-
-pkgdesc='.NET MAUI compatible build-Tools for Google Android SDK (aapt, aidl, dexdump, dx, llvm-rs-cc)'
+pkgdesc='Build-Tools for Google Android SDK (aapt, aidl, dexdump, dx, llvm-rs-cc)'
 arch=('x86_64')
-url="https://developer.android.com/studio/releases/build-tools"
+url='https://developer.android.com/studio/releases/build-tools'
 license=('custom')
-depends=('gcc-libs' 'zlib' 'bash')
-optdepends=('lib32-gcc-libs' 'lib32-zlib' 'java-runtime')
-
-source=("https://dl.google.com/android/repository/build-tools_r${_major}_linux.zip"
-        "package.xml")
-sha512sums=('b45dc6b7298567f3b45428def0b85584b99b125a3719dfb74a82732bf2b86a0c66161682f3c3d7a50cefaf6e1a2d993975665272e16f00b231a15a9a4512cc1e'
-            '501211771b02940010420a4003b8396d3d6599fb339c2f64959335ab1c3cf615811cc62acaa093c9f4e14bbc019a9e493835573a5136383617d8b5184509d3f8')
+depends=('gcc-libs' 'zlib')
+optdepends=('lib32-gcc-libs' 'lib32-zlib')
+source=("https://dl.google.com/android/repository/build-tools_${pkgver}_linux.zip")
+sha256sums=('bd3a4966912eb8b30ed0d00b0cda6b6543b949d5ffe00bea54c04c81e1561d88')
 options=('!strip')
 
 package() {
   cd "$pkgdir"
-
-  install -d usr/share/licenses/$pkgname/
-  ln -s /opt/$_sdk/build-tools/$_ver/NOTICE.txt usr/share/licenses/$pkgname/NOTICE.txt
-  sed -i "s/@major@/$_major/g;s/@minor@/$_minor/g;s/@micro@/$_micro/g;s/@displayv@/$_displayversion/g;s/@pathv@/$_ver/g" "$srcdir/package.xml"
-  install -Dm644 "${srcdir}/package.xml" opt/$_sdk/build-tools/$_ver/package.xml
-  ln -s /opt/$_sdk/build-tools/$_ver/package.xml usr/share/licenses/$pkgname/package.xml
-
-  target="opt/$_sdk/build-tools/$_ver"
-  mkdir -p "$target"
-  cp -r "$srcdir/$_android/"* "$target"
-  chmod +Xr -R "$target"
-
-  # Add symlinks to binaries to usr/bin/
-  mkdir -p usr/bin/
-  # lld is also provided by extra/lld, not creating symlink
-  binaries=$(find "${target}" -maxdepth 1 -type f -executable -not -iname lld -printf "%f\n")
-  for f in ${binaries[@]}
-  do
-    ln -s "/$target/$f" "usr/bin/$f"
-  done
+  install -Dm644 "${srcdir}/$_android/NOTICE.txt" usr/share/licenses/$pkgname/NOTICE.txt
+  mkdir -p opt/android-sdk/build-tools/$_fullver
+  cp -r "$srcdir/$_android/"* "$pkgdir/opt/android-sdk/build-tools/$_fullver"
+  chmod +Xr -R "$pkgdir/opt/android-sdk/build-tools/$_fullver"
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 15:36:47	MEDIUM	1
2026-07-30 13:14:23	CLEAN	0
2026-06-18 16:11:54	CLEAN	0