brother-mfcl2685dw-cups-bin

LOW

maintainer PapistPenguin 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The source is downloaded from download.brother.com, which is Brother's official download infrastructure (same domain used by all Brother Linux driver packages in the AUR). The file is a prebuilt i386 .deb containing a CUPS wrapper driver, which is a binary, but it comes from the vendor's own servers rather than a personal or unofficial host. The PKGBUILD is sloppy (uses md5sums instead of sha256sums, no integrity check beyond a weak hash, installs a 32-bit binary on potentially 64-bit systems without lib32 deps, missing extract step before tar -xf data.tar.gz), but these are quality issues rather than supply-chain threats. The cheaper model's MEDIUM rating is a false positive — official vendor binary drivers from the vendor's own domain are a standard AUR pattern and not a supply-chain concern beyond the inherent trust placed in the vendor.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 85%): The source is downloaded from download.brother.com, which is Brother's official download infrastructure (same domain used by all Brother Linux driver packages in the AUR). The file is a prebuilt i386 .deb containing a CUPS wrapper driver, which is a binary, but it comes from the vendor's own servers rather than a personal or unofficial host. The PKGBUILD is sloppy (uses md5sums instead of sha256sums, no integrity check beyond a weak hash, installs a 32-bit binary on potentially 64-bit systems without lib32 deps, missing extract step before tar -xf data.tar.gz), but these are quality issues rather than supply-chain threats. The cheaper model's MEDIUM rating is a false positive — official vendor binary drivers from the vendor's own domain are a standard AUR pattern and not a supply-chain concern beyond the inherent trust placed in the vendor.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:10 source=("https://download.brother.com/welcome/dlf103316/mfcl2685dwcupswrapper-3.2.1-1.i386.deb")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jacob P. Watson <jacob@encavo.net>
    
      2pkgname=brother-mfcl2685dw-cups-bin
    
      3pkgver=3.2.1
    
      4pkgrel=1
    
      5pkgdesc="CUPS wrapper for Brother MFC-L2685DW printer"
    
      6arch=("i686" "x86_64")
    
      7url="https://support.brother.com/g/b/producttop.aspx?c=us&lang=en&prod=mfcl2685dw_us"
    
      8license=("EULA")
    
      9groups=("base-devel")
    
      10source=("https://download.brother.com/welcome/dlf103316/mfcl2685dwcupswrapper-3.2.1-1.i386.deb")
    
      11md5sums=("b8f16d0c84404891d2b8c58fdce35dd3")
    
      12package() {
    
      13       tar -xf data.tar.gz -C "${pkgdir}"
    
      14}
    
      15
    
      16

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2