ensenso-sdk-doc
maintainer de-vries
· 0 votes
· base
ensenso-sdk
· scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged
The PKGBUILD downloads a prebuilt binary .deb from share.optonic.com, which is a Nextcloud/ownCloud-style public file share (note the /public.php/dav/files/ path pattern), not the canonical vendor download endpoint (ensenso.com). Optonic GmbH is the company behind the Ensenso SDK, so this is likely a legitimate vendor-controlled host, but it is a file-sharing service rather than a proper release server, meaning the artifact could be replaced without any versioned URL change. The package installs native shared libraries and executables from this prebuilt binary, which is a real supply-chain concern if the host or the shared file were compromised. The sha512sums are present and pin the artifact, which mitigates but does not eliminate the risk (the hash only helps if the file hasn't already been swapped before the PKGBUILD was written). The wrapper scripts (ensenso-cli, ensenso-engage, etc.) are also sourced locally with hashes. Overall this is a genuine medium-risk pattern: executed native code from a non-canonical, mutable file-share URL, even if the vendor likely controls it.
Triggered rules
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:12
"$pkgname-$pkgver.deb::https://share.optonic.com/public.php/dav/files/ensensosdk/ensenso-sdk-$pkgver-x64.deb"
MEDIUM
AI review
llm_review
An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from share.optonic.com, which is a Nextcloud/ownCloud-style public file share (note the /public.php/dav/files/ path pattern), not the canonical vendor download endpoint (ensenso.com). Optonic GmbH is the company behind the Ensenso SDK, so this is likely a legitimate vendor-controlled host, but it is a file-sharing service rather than a proper release server, meaning the artifact could be replaced without any versioned URL change. The package installs native shared libraries and executables from this prebuilt binary, which is a real supply-chain concern if the host or the shared file were compromised. The sha512sums are present and pin the artifact, which mitigates but does not eliminate the risk (the hash only helps if the file hasn't already been swapped before the PKGBUILD was written). The wrapper scripts (ensenso-cli, ensenso-engage, etc.) are also sourced locally with hashes. Overall this is a genuine medium-risk pattern: executed native code from a non-canonical, mutable file-share URL, even if the vendor likely controls it.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Maarten de Vries <maarten@de-vri.es>
2
pkgbase=ensenso-sdk
3
pkgname=(ensenso-sdk ensenso-sdk-runtime ensenso-sdk-gui ensenso-sdk-doc ensenso-sdk-examples ensenso-sdk-halcon)
4
pkgdesc="Ensenso SDK and tools"
5
pkgver=4.3.991
6
pkgrel=2
7
arch=(x86_64)
8
license=(custom)
9
url='http://ensenso.com'
10
11
source=(
12
"$pkgname-$pkgver.deb::https://share.optonic.com/public.php/dav/files/ensensosdk/ensenso-sdk-$pkgver-x64.deb"
13
90-ensenso-install.conf
14
ensenso-cli
15
ensenso-engage
16
nxCalTab
17
nxProfiler
18
nxTreeEdit
19
nxView
20
)
21
22
sha512sums=('412938f493c0326e60b89c3ef1a65e3fe4704ca9b27d015de4f6df5bfd2d76eee4d6749c68377779c95c4422bb3ded4923216a8b05d968da511ecc6de2efe8bd'
23
'8ba4af7b9af3a5bc997e515532aebd2c206fcda17eb2f941ca930d3c358badc354c137e2bbd5ff93446c250137dd5d829163cec01bc25a726ad8448cbc7bc9d7'
24
'5964849edd1bcd4c9aec3b5ec6d434d1be83f0205c848792c0b13284b8b2fe2a90d0468fd5927ca9ff857438b34597e146d8fccef56943bcc4c47637bd390388'
25
'cdab79891ef802f77b5b9824355326fbd8153db7253a353e10e7bb374fea84f28e1212eb202a1939e5db8bf8f28290ea204c5308adfe0d1704f8bc3fabdbef7e'
26
'4897d24c2f6caf9bf451677b890aeb5f5406c1f12b21e524cbbc5bfed1e261f69bf3546fc97f3c99b9151828e0194d8ff3b33d9b3f131cb60b955f1393a4d621'
27
'83cfaab80ee78e0766028745c3802c805efc0379b8bc5492d890c8c71d4099462237ce7cf658ab9cf6a7b02bbbd91e2ddc0a0d88a3e0a9bc00960e0628c53a82'
28
'baf9b8845f34c3035440331bfbe5d42dac1539f6d120949fe68e2d0c68ca6820768ff66a4b9b4848b44123564b4beb976c60c07bd245c27226c48c5e7c825618'
29
'7b257632e044f75cbbf44adabeea42be225fbdc1a98bf7f4127c9780b8e9fa2fbbe245044921d02c7d2d38cf9ea927bf141ffabd0bd2ffaf9ce8d0cb7c27d9a9')
30
31
prepare() {
32
bsdtar -xf data.tar.xz
33
}
34
35
package_ensenso-sdk() {
36
depends=('ensenso-sdk-runtime' 'ensenso-sdk-gui')
37
optdepends=(
38
'ensenso-sdk-examples: for coding examples'
39
'ensenso-sdk-doc: for documentation'
40
'ensenso-sdk-halcon: for halcon support'
41
)
42
}
43
44
package_ensenso-sdk-runtime() {
45
depends=('glibc' 'glu' 'libsm')
46
optdepends=(
47
'ueyed: for capturing from live cameras'
48
)
49
50
local dir="$srcdir"
51
52
install -Dd "$pkgdir/usr"
53
install -Dd "$pkgdir/usr/lib/pkgconfig"
54
install -Dd "$pkgdir/usr/include"
55
install -Dd "$pkgdir/usr/share/licenses/$pkgname"
56
57
cp -a "$dir/usr/lib" "$pkgdir/usr/"
58
cp -a "$dir/opt" "$pkgdir/"
59
rm -r "$pkgdir/opt/ensenso/development/examples"
60
rm -r "$pkgdir/opt/ensenso/development/halcon"
61
rm -r "$pkgdir/opt/ensenso/bin"
62
63
# Re-add the CLI
64
install -m 755 -Dt "$pkgdir/opt/ensenso/bin/" "$dir/opt/ensenso/bin/ensenso-cli"
65
install -m 755 -Dt "$pkgdir/usr/bin" "$srcdir/ensenso-cli"
66
67
rm -r "$pkgdir/opt/ensenso/lib/qt5"
68
rm -r "$pkgdir/opt/ensenso/manual"
69
70
ln -s "../../opt/ensenso/development/c/include" "$pkgdir/usr/include/ensenso"
71
(
72
cd "$pkgdir/usr/lib/pkgconfig/"
73
ln -s "../../../opt/ensenso/pkgconfig/"* ./
74
)
75
76
install -Dt "$pkgdir/usr/lib/environment.d/" "$srcdir/90-ensenso-install.conf"
77
install -Dt "$pkgdir/usr/share/licenses/$pkgname/" "$dir/opt/ensenso/eula.txt"
78
}
79
80
package_ensenso-sdk-gui() {
81
depends=('ensenso-sdk-runtime' 'qt5-base')
82
83
local dir="$srcdir"
84
85
install -Dd "$pkgdir/usr"
86
install -Dd "$pkgdir/usr/bin"
87
install -Dd "$pkgdir/opt/ensenso"
88
89
cp -a "$dir/opt/ensenso/bin" "$pkgdir/opt/ensenso/"
90
rm "$pkgdir/opt/ensenso/bin/ensenso-cli"
91
92
cp -a "$dir/usr/share" "$pkgdir/usr/"
93
94
install -Dt "$pkgdir/usr/bin" -m 755 \
95
"$srcdir/ensenso-engage" \
96
"$srcdir/nxCalTab" \
97
"$srcdir/nxProfiler" \
98
"$srcdir/nxTreeEdit" \
99
"$srcdir/nxView"
100
}
101
102
package_ensenso-sdk-examples() {
103
arch=(any)
104
depends=(ensenso-sdk-runtime)
105
106
local dir="$srcdir"
107
install -Dd "$pkgdir/opt/ensenso/development"
108
cp -a "$dir/opt/ensenso/development/examples" "$pkgdir/opt/ensenso/development/"
109
}
110
111
package_ensenso-sdk-doc() {
112
arch=(any)
113
114
local dir="$srcdir"
115
install -Dd "$pkgdir/usr/share/doc"
116
install -Dd "$pkgdir/opt/ensenso"
117
118
cp -a "$dir/opt/ensenso/manual" "$pkgdir/opt/ensenso/manual"
119
ln -s "/opt/ensenso/manual/html" "$pkgdir/usr/share/doc/$pkgname"
120
}
121
122
package_ensenso-sdk-halcon() {
123
depends=(ensenso-sdk-runtime)
124
125
local dir="$srcdir"
126
install -Dd "$pkgdir/opt/ensenso/development"
127
cp -a "$dir/opt/ensenso/development/halcon" "$pkgdir/opt/ensenso/development/"
128
}
129
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | MEDIUM | 2 |
| 2026-08-02 00:16:08 | MEDIUM | 2 |
| 2026-08-01 00:11:18 | MEDIUM | 2 |
| 2026-07-31 00:14:10 | MEDIUM | 2 |
| 2026-07-30 00:17:23 | MEDIUM | 2 |
| 2026-07-29 00:25:53 | MEDIUM | 2 |
| 2026-07-28 00:07:28 | MEDIUM | 2 |
| 2026-07-27 00:24:32 | MEDIUM | 2 |
| 2026-07-26 00:07:32 | MEDIUM | 2 |
| 2026-07-25 00:13:44 | MEDIUM | 2 |
| 2026-07-24 00:02:28 | MEDIUM | 2 |
| 2026-07-23 00:14:47 | MEDIUM | 2 |
| 2026-07-22 00:29:32 | MEDIUM | 2 |
| 2026-07-21 00:24:15 | MEDIUM | 2 |
| 2026-07-20 00:19:49 | MEDIUM | 2 |
| 2026-07-19 00:17:08 | MEDIUM | 2 |
| 2026-07-18 00:14:48 | MEDIUM | 2 |
| 2026-07-17 00:06:16 | MEDIUM | 2 |
| 2026-07-16 00:05:41 | MEDIUM | 2 |
| 2026-07-15 00:09:25 | MEDIUM | 2 |