dell-powermanager-git

maintainer alexytomi · 1 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The Flutter SDK tarball is downloaded from Google's official storage.googleapis.com infrastructure (flutter_infra_release), which is the canonical Flutter release host; both sources have SKIP'd checksums which is sloppy but not malicious, and the rest of the build compiles the project's own source code without any obfuscated payloads or exfiltration.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 85%): The Flutter SDK tarball is downloaded from Google's official storage.googleapis.com infrastructure (flutter_infra_release), which is the canonical Flutter release host; both sources have SKIP'd checksums which is sloppy but not malicious, and the rest of the build compiles the project's own source code without any obfuscated payloads or exfiltration.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:43 "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_3.47.0-stable.tar.xz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: alexytomi <alexytomi101@gmail.com>
    
      2
    
      3pkgname=dell-powermanager-git
    
      4pkgver=0.13.0.r0.g2803dc0
    
      5pkgrel=1
    
      6pkgdesc='Cross-platform Dell Power Manager re-implementation'
    
      7arch=('x86_64')
    
      8url='https://github.com/alexVinarskis/dell-powermanager'
    
      9license=('GPL-3.0-only')
    
      10provides=('dell-powermanager')
    
      11conflicts=('dell-powermanager')
    
      12
    
      13makedepends=(
    
      14  # Package deps
    
      15  'ninja'
    
      16  'gtk3'
    
      17  'sqlite'
    
      18  'libsecret'
    
      19  # Flutter SDK deps
    
      20  'curl'
    
      21  'git'
    
      22  'unzip'
    
      23  'xz'
    
      24  'zip'
    
      25  'glu'
    
      26)
    
      27
    
      28depends=(
    
      29  'dell-command-configure' # AUR
    
      30)
    
      31
    
      32# We manually clone the flutter SDK because there is literally no
    
      33# working flutter package as of writing, using fvm seems to be
    
      34# dependent on github clone speed which as of writing, is very
    
      35# spotty/slow and fvm adds unneeded complexity.
    
      36
    
      37# Sadly this means that this PKGBUILD may need flutter sdk updates
    
      38# if the program starts needing newer ones, so check that first
    
      39# if this breaks.
    
      40
    
      41source=(
    
      42  "git+https://github.com/alexVinarskis/dell-powermanager.git"
    
      43  "https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_3.47.0-stable.tar.xz"
    
      44)
    
      45sha256sums=('SKIP' 'SKIP')
    
      46
    
      47pkgver() {
    
      48  cd "$srcdir/dell-powermanager"
    
      49  git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g'
    
      50}
    
      51
    
      52build() {
    
      53  cd "$srcdir/dell-powermanager"
    
      54  # Following package.sh in the repo, which is for debian
    
      55  PACKAGE="dell-powermanager"
    
      56  NAME="Dell Power Manager by VA"
    
      57  VERSION=$(git describe --tags)
    
      58  sed -i "s|applicationName".*"|applicationName = '${NAME}';|g" ./lib/configs/constants.dart
    
      59  sed -i "s|applicationPackageName".*"|applicationPackageName = '${PACKAGE}';|g" ./lib/configs/constants.dart
    
      60  # Make sure this is semver. The version update checker doesn't
    
      61  # seem to be built for anything else.
    
      62
    
      63  # Also the OTA checker can't be disabled without
    
      64  # a lot of changes.
    
      65  sed -i "s|applicationVersion".*"|applicationVersion = '${VERSION}';|g" ./lib/configs/constants.dart
    
      66
    
      67  $srcdir/flutter/bin/flutter config --enable-linux-desktop
    
      68  $srcdir/flutter/bin/flutter build linux --release
    
      69}
    
      70
    
      71package() {
    
      72  cd "$srcdir/dell-powermanager"
    
      73  local appdir="$pkgdir/opt/dell-powermanager"
    
      74  install -dm755 "$appdir"
    
      75
    
      76  cp -a build/linux/x64/release/bundle/. "$appdir/"
    
      77  install -dm755 "$pkgdir/usr/bin"
    
      78
    
      79  ln -s /opt/dell-powermanager/dell_powermanager \
    
      80    "$pkgdir/usr/bin/dell-powermanager"
    
      81
    
      82  install -Dm644 \
    
      83    resources/dell-powermanager.desktop \
    
      84    "$pkgdir/usr/share/applications/dell-powermanager.desktop"
    
      85
    
      86  # Following package.sh in the repo, which is for debian
    
      87  sed -i \
    
      88    -e 's|{VERSION}|'"$pkgver"'|g' \
    
      89    -e 's|{PACKAGE}|dell-powermanager|g' \
    
      90    -e 's|{PATH_ICON}|/opt/dell-powermanager/icon.png|g' \
    
      91    -e 's|{NAME}|Dell Power Manager by VA|g' \
    
      92    "$pkgdir/usr/share/applications/dell-powermanager.desktop"
    
      93
    
      94  install -Dm644 \
    
      95    resources/icon.png \
    
      96    "$pkgdir/opt/dell-powermanager/icon.png"
    
      97
    
      98  install -Dm644 \
    
      99    LICENSE \
    
      100    "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      101}
    
      102

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	3
2026-08-17 00:18:29	LOW	3
2026-08-16 19:35:37	LOW	3
2026-08-16 19:33:38	MEDIUM	3