dingoo-sdk

maintainer ivanovp · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads source files from Google Code Archive, which is a non-standard host but hosts legitimate historical project releases; the files are verified by checksums and consist of SDK tools and scripts, not executable payloads, and the build process installs only these verified files without executing untrusted code.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source files from Google Code Archive, which is a non-standard host but hosts legitimate historical project releases; the files are verified by checksums and consist of SDK tools and scripts, not executable payloads, and the build process installs only these verified files without executing untrusted code.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/dingoo-sdk/dingoo_sdk_r324.zip"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Peter Ivanov <ivanovp@gmail.com>
    
      2
    
      3pkgname=dingoo-sdk
    
      4pkgver=20130707
    
      5pkgrel=3
    
      6pkgdesc="Dingoo A320 Native SDK"
    
      7arch=('i686' 'x86_64')
    
      8url="http://code.google.com/p/dingoo-sdk/"
    
      9license=('GPL')
    
      10depends=('bash' 'sed' 'python')
    
      11makedepends=('make')
    
      12options=(!strip)
    
      13install=dingoo-sdk.install
    
      14source=("https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/dingoo-sdk/dingoo_sdk_r324.zip"
    
      15        "https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/dingoo-sdk/linux_x86_elf2app.tar.bz2"
    
      16        "https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/dingoo-sdk/mipsel-4.1.2-nopic.tar.bz2"
    
      17        "dingoo-sdk.sh")
    
      18
    
      19#_gitroot="http://dingoo-sdk.googlecode.com/svn/trunk/ dingoo-sdk-read-only"
    
      20#_gitname=dingoo-sdk
    
      21
    
      22build() {
    
      23	cd "$srcdir"
    
      24#    if [ -d "$_gitname" ]; then
    
      25#        msg "GIT tree found."
    
      26#        cd "$_gitname"
    
      27#        git pull
    
      28#    else
    
      29#        git clone $_gitroot
    
      30#        cd "$_gitname"
    
      31#    fi
    
      32#	qmake
    
      33#	make
    
      34    cd dingoo_sdk
    
      35    export DINGOO_SDK=$srcdir/dingoo_sdk
    
      36    export MIPSTOOLS=$srcdir/mipsel-4.1.2-nopic
    
      37    export PATH=$PATH:$MIPSTOOLS/bin
    
      38    sh ./install
    
      39    # Removing unnecessary object files
    
      40    find $DINGOO_SDK -iname '*.o' -and -not -name 'dingoo.o'|xargs rm -f
    
      41}
    
      42
    
      43package() {
    
      44	cd $srcdir
    
      45   
    
      46    install -d -m755 $pkgdir/usr/bin
    
      47    install -m755 dingoo-sdk.sh $pkgdir/usr/bin/dingoo-sdk.sh
    
      48
    
      49    install -d -m755 $pkgdir/usr/share/$pkgname
    
      50    cp -a dingoo_sdk $pkgdir/usr/share/$pkgname 
    
      51    cp -a mipsel-4.1.2-nopic $pkgdir/usr/share/$pkgname 
    
      52    cp -a tools $pkgdir/usr/share/$pkgname 
    
      53}
    
      54
    
      55md5sums=('0ed152a9d947897b4e346e554b90fe39'
    
      56         '6d617c4b6fbee77eeb84284f451d58ca'
    
      57         'd980b89d5604a422f4a80d3c86b9a5fd'
    
      58         'e84d16d30743c6b0b6ff76c060b681f6')
    
      59
    
      60

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2