epson-inkjet-printer-filter
LOW
maintainer vitaliikuzhdin
2 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a source RPM from a plausible Epson domain to extract filter sources and watermark files; it builds from source and installs only the compiled filter binary and static data files, posing no remote code execution or supply-chain risk despite the non-whitelisted host.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a source RPM from a plausible Epson domain to extract filter sources and watermark files; it builds from source and installs only the compiled filter binary and static data files, posing no remote code execution or supply-chain risk despite the non-whitelisted host.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:41
"https://download-center.epson.com/f/module/23886533-318c-48cb-a837-e6685f653a98/${_bundlesrc}-1.src.rpm"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Vitalii Kuzhdin <vitaliikuzhdin@gmail.com>
2
# Contributor: PhrozenByte
3
4
# if you have problems, read more about the voodoo magic in these comments:
5
# https://aur.archlinux.org/packages/epson-inkjet-printer-workforce-635-nx625-series
6
7
pkgname="epson-inkjet-printer-filter"
8
pkgver=1.0.2
9
pkgrel=7
10
pkgdesc="Epson inkjet printer filter used with CUPS"
11
arch=(
12
'i686'
13
'x86_64'
14
)
15
url="https://download-center.epson.com/search"
16
license=(
17
'LGPL-2.1-or-later' # filter itself
18
'custom:Epson End User Software License Agreement' # watermark .EIDs (?)
19
)
20
depends=(
21
'cups'
22
'glibc'
23
'libcups'
24
# 'libgcc' # see below (?)
25
'libjpeg' # see below
26
'libstdc++' # see below
27
)
28
makedepends=(
29
'curl'
30
)
31
options=(
32
'emptydirs'
33
)
34
# there are no standalone filter or driver sources, both are shipped together
35
# so we download some driver bundle and extract the filter sources from there
36
# source bundle chosen arbitrarily; all of them ship identical filter sources
37
_pkgsrc="${pkgname}-${pkgver}"
38
_bundlesrc="epson-inkjet-printer-201207w-1.0.1"
39
source=(
40
# "https://download3.ebz.epson.net/dsc/f/03/00/15/64/87/25d34a13841e5e95d80266e6fd8dfcdf67c95634/${_bundlesrc}-1.src.rpm"
41
"https://download-center.epson.com/f/module/23886533-318c-48cb-a837-e6685f653a98/${_bundlesrc}-1.src.rpm"
42
"${pkgname}_release_build_flags.patch"
43
"${pkgname}_lib_res_path.patch"
44
)
45
sha256sums=('ac757bb6d392b6662779228e518bb3e9b4de02d275235c4afd41465447d38b45'
46
'94a18c4839ebb3bbd8224c02075fe3489dd7dfe873b683adf3149250c6a8ad16'
47
'496ec60ac0d324bf9ebc652b0b1cbe73a98651d408f8903d41aa049bbc53807b')
48
# download.ebz.epson.net blocks some user-agents and returns 403
49
# download3.ebz.epson.net works fine (for now)
50
# download-center.epson.com blocks some user-agents and returns 403
51
DLAGENTS=(
52
"https::/usr/bin/curl -A 'Mozilla' -fLC - --retry 3 --retry-delay 3 -o %o %u"
53
)
54
55
prepare() {
56
cd "${srcdir}"
57
bsdtar -xzf "${_pkgsrc}.tar.gz"
58
bsdtar -xzf "${_bundlesrc}.tar.gz" "${_bundlesrc}/watermark"
59
60
cd "${_pkgsrc}"
61
# release builds disrespect user build flags and replace them with '-O2'
62
patch -Np1 -i "${srcdir}/${pkgname}_release_build_flags.patch"
63
# we will install with the prefix '/usr' instead of "/opt/epson-inkjet-printer-${_model}"
64
patch -Np1 -i "${srcdir}/${pkgname}_lib_res_path.patch"
65
}
66
67
# pkgver() {
68
# cd "${srcdir}/${_pkgsrc}"
69
# # AC_INIT(epson-inkjet-printer-filter, ${pkgver}, epson@localdomain)
70
# sed -n -E 's/AC_INIT\([^,]+,\s*([^,]+).*/\1/p' 'configure.ac'
71
# }
72
73
build() {
74
# this will cause overlinking to 'libstdc++' and 'libjpeg'
75
# the filter itself doesn't depend on them,
76
# but the .so libraries shipped with every driver do (at least on 'libstdc++')
77
# for some reason, older .so libraries aren't linked to them,
78
# which causes missing symbol errors:
79
# undefined symbol: _ZTVN10__cxxabiv117__class_type_infoE
80
# it is not known whether 'libjpeg' is actually needed
81
# knowing that the filter is called ahead of the libraries,
82
# we overlink the required dependencies here to load them into memory
83
# this trick is reportedly not needed for the newer models with newer libraries
84
# but is required for older 'LSB-dependent' drivers with the 'lsb3.2' suffix
85
export LDFLAGS="${LDFLAGS//-Wl,--as-needed/} -Wl,--no-as-needed"
86
local configure_options=(
87
--prefix='/usr'
88
# --prefix="/opt/epson-inkjet-printer-${_model}"
89
# --prefix="/opt/epson-${_model}"
90
91
# if you have runtime problems, add this line
92
# and look into /tmp/epson-inkjet-printer-filter.txt
93
# --enable-debug
94
)
95
96
cd "${srcdir}/${_pkgsrc}"
97
libtoolize
98
autoreconf -vfi
99
./configure "${configure_options[@]}"
100
make
101
}
102
103
package() {
104
cd "${srcdir}/${_pkgsrc}"
105
# make DESTDIR="${pkgdir}" install
106
107
install -vDm644 "AUTHORS" "${pkgdir}/usr/share/doc/${pkgname}/AUTHORS"
108
# install -vDm644 "ChangeLog" "${pkgdir}/usr/share/doc/${pkgname}/CHANGELOG"
109
# install -vDm644 "NEWS" "${pkgdir}/usr/share/doc/${pkgname}/NEWS"
110
install -vDm644 "README" "${pkgdir}/usr/share/doc/${pkgname}/README"
111
install -vDm644 "COPYING.EPSON" "${pkgdir}/usr/share/licenses/${pkgname}/COPYING.EPSON"
112
install -vDm644 "COPYING.LIB" "${pkgdir}/usr/share/licenses/${pkgname}/COPYING.LIB"
113
114
cd "src"
115
install -vDm755 "${pkgname//-/_}" "${pkgdir}/usr/lib/cups/filter/${pkgname//-/_}"
116
117
cd "${srcdir}/${_bundlesrc}"
118
# all drivers ship the same watermark .EID files,
119
# so we install them once to a common location
120
find "watermark" -type f -exec \
121
install -vDm644 "{}" "${pkgdir}/usr/share/${pkgname}/{}" \;
122
123
# model-specific *.data files will reside here
124
install -vd "${pkgdir}/usr/share/${pkgname}/resource"
125
}
126
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |