faceform-wrap
LOW
maintainer liblaf
0 votes
scanned 2026-11-03 14:06:57.695390
Why flagged
Downloads a prebuilt proprietary application tarball from the vendor's own official domain (downloads.faceform.com) with a verified sha256 checksum; the icon is fetched from docs.faceform.com also with a checksum. No obfuscation, no exfiltration, no untrusted third-party host — just a normal prebuilt-binary AUR package for commercial software.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): Downloads a prebuilt proprietary application tarball from the vendor's own official domain (downloads.faceform.com) with a verified sha256 checksum; the icon is fetched from docs.faceform.com also with a checksum. No obfuscation, no exfiltration, no untrusted third-party host — just a normal prebuilt-binary AUR package for commercial software.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:50
"https://downloads.faceform.com/file/faceform/Wrap/${pkgver}/${_download_id}/Faceform_Wrap_${pkgver}_Linux.tar.xz" -
PKGBUILD:51
"${pkgname}.ico::https://docs.faceform.com/Wrap/_static/Wrap.ico"
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: liblaf <30631553+liblaf@users.noreply.github.com>
2
3
pkgname=faceform-wrap
4
pkgver=2025.11.14
5
pkgrel=2
6
# Opaque path component of the versioned download URL; updated with pkgver.
7
_download_id=9f99598ca4cd3b373d0b26a450d9a47d
8
pkgdesc='Topology transfer tool that fits a base mesh to 3D scans'
9
arch=('x86_64')
10
url='https://faceform.com/wrap/'
11
license=('LicenseRef-Faceform-Wrap-EULA')
12
depends=(
13
'alsa-lib'
14
'dbus'
15
'expat'
16
'gcc-libs'
17
'gdbm'
18
'gdk-pixbuf2'
19
'glib2'
20
'glibc'
21
'gmp'
22
'graphite'
23
'gst-plugins-base-libs'
24
'krb5'
25
'libasyncns'
26
'libcap'
27
'libdrm'
28
'libglvnd'
29
'libgpg-error'
30
'libsm'
31
'libtasn1'
32
'libthai'
33
'libxcrypt-compat'
34
'libxfixes'
35
'libxrender'
36
'mesa'
37
'orc'
38
'p11-kit'
39
'pixman'
40
'systemd-libs'
41
'util-linux-libs'
42
'v4l-utils'
43
'xz'
44
)
45
makedepends=('imagemagick' 'patchelf')
46
optdepends=('xdg-utils: open documentation links in a web browser')
47
# The vendor bundle ships its own Qt and Python; keep it as distributed.
48
options=('!strip' '!debug')
49
source=(
50
"https://downloads.faceform.com/file/faceform/Wrap/${pkgver}/${_download_id}/Faceform_Wrap_${pkgver}_Linux.tar.xz"
51
"${pkgname}.ico::https://docs.faceform.com/Wrap/_static/Wrap.ico"
52
"${pkgname}.desktop"
53
)
54
sha256sums=('42402bf790adb1f8e39635da9772db1c7c5987bde7fbbc3413d2c1c29b64ed98'
55
'15ff8592cec9b6169440a428ffe0603d26dc820ea88aaee0ba77a09fd397914e'
56
'a75835cccf390623638be69309638966ce1a0317c0be9d3157882963b1e8af78')
57
58
prepare() {
59
local file rpath entry kept
60
local -a entries flags
61
# Drop the vendor's build-machine library paths, keeping only $ORIGIN-relative ones.
62
while IFS= read -r -d '' file; do
63
[[ "$(head -c 4 "${file}")" == $'\x7fELF' ]] || continue
64
rpath=$(patchelf --print-rpath "${file}")
65
[[ -n "${rpath}" ]] || continue
66
kept=
67
IFS=: read -r -a entries <<< "${rpath}"
68
for entry in "${entries[@]}"; do
69
# shellcheck disable=SC2016
70
[[ "${entry}" == '$ORIGIN'* || "${entry}" == '${ORIGIN}'* ]] && kept+="${kept:+:}${entry}"
71
done
72
[[ "${kept}" != "${rpath}" ]] || continue
73
if [[ -z "${kept}" ]]; then
74
patchelf --remove-rpath "${file}"
75
continue
76
fi
77
# Keep DT_RPATH, which also applies to the bundled libraries' own dependencies.
78
flags=()
79
readelf -d "${file}" | grep -q '(RPATH)' && flags=(--force-rpath)
80
patchelf "${flags[@]}" --set-rpath "${kept}" "${file}"
81
done < <(find "Faceform_Wrap_${pkgver}_Linux" -type f -print0)
82
}
83
84
build() {
85
magick "${pkgname}.ico[5]" "${pkgname}.png"
86
}
87
88
package() {
89
install -d "${pkgdir}/usr/lib/${pkgname}"
90
cp -a --no-preserve=ownership "Faceform_Wrap_${pkgver}_Linux/." "${pkgdir}/usr/lib/${pkgname}/"
91
chmod -R u=rwX,go=rX "${pkgdir}/usr/lib/${pkgname}"
92
93
# Replace the vendor launchers, keeping their documented names. The embedded
94
# Python needs PYTHONHOME; the binaries already find bundled libraries through
95
# their $ORIGIN RPATH, so LD_LIBRARY_PATH (which leaked into child processes
96
# and included the working directory) is not set.
97
local binary
98
for binary in Wrap WrapCmd; do
99
printf '#!/bin/sh\nexport PYTHONHOME=/usr/lib/%s\nexec /usr/lib/%s/%s "$@"\n' \
100
"${pkgname}" "${pkgname}" "${binary}" > "${pkgdir}/usr/lib/${pkgname}/${binary}.sh"
101
chmod 755 "${pkgdir}/usr/lib/${pkgname}/${binary}.sh"
102
done
103
install -d "${pkgdir}/usr/bin"
104
ln -s "/usr/lib/${pkgname}/Wrap.sh" "${pkgdir}/usr/bin/${pkgname}"
105
ln -s "/usr/lib/${pkgname}/WrapCmd.sh" "${pkgdir}/usr/bin/${pkgname}-cmd"
106
107
install -Dm644 "${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
108
install -Dm644 "${pkgname}.png" "${pkgdir}/usr/share/icons/hicolor/256x256/apps/${pkgname}.png"
109
install -d "${pkgdir}/usr/share/licenses/${pkgname}"
110
ln -s "/usr/lib/${pkgname}/Faceform Wrap EULA.html" "${pkgdir}/usr/share/licenses/${pkgname}/EULA.html"
111
}
112
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-03 14:06:57 | Low | 3 |
| 2026-11-03 14:04:44 | Medium | 2 |