fire-tool

maintainer taotieren · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary .deb from cloud.embedfire.com (the vendor's own cloud storage, not a standard package repository) and installs a compiled Qt application binary directly into /opt. While embedfire.com appears to be a legitimate Chinese embedded-systems vendor (野火/Embedfire), the source URL points to a mutable artifact with no versioning in the filename (fireTools.deb rather than fireTools-1.0.1.5.deb), meaning the file could be silently replaced without changing the URL. The sha512sum provides some protection against substitution at build time, but the lack of a versioned URL means the checksum will break on any upstream update rather than catching a malicious swap. The core concern is a prebuilt, unstripped binary executable from a non-standard cloud host being installed and run with user privileges — this is a genuine medium-severity supply-chain concern, not a false positive, though there is no evidence of active malice.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:33 source_x86_64=("https://cloud.embedfire.com/software/FireTools/fireTools.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from cloud.embedfire.com (the vendor's own cloud storage, not a standard package repository) and installs a compiled Qt application binary directly into /opt. While embedfire.com appears to be a legitimate Chinese embedded-systems vendor (野火/Embedfire), the source URL points to a mutable artifact with no versioning in the filename (fireTools.deb rather than fireTools-1.0.1.5.deb), meaning the file could be silently replaced without changing the URL. The sha512sum provides some protection against substitution at build time, but the lack of a versioned URL means the checksum will break on any upstream update rather than catching a malicious swap. The core concern is a prebuilt, unstripped binary executable from a non-standard cloud host being installed and run with user privileges — this is a genuine medium-severity supply-chain concern, not a false positive, though there is no evidence of active malice.

PKGBUILD

1 offending line(s) highlighted

      1# Generated by debtap
    
      2# Maintainer: taotieren <admin@taotieren.com>
    
      3
    
      4pkgname=fire-tool
    
      5pkgver=1.0.1.5
    
      6pkgrel=6
    
      7pkgdesc="Embedfire Tool support Serial communication, TCP/UDP communication, camera and PID debuggingVisit https://www.embedfire.com for more information."
    
      8arch=('x86_64')
    
      9url="https://www.embedfire.com"
    
      10license=('unknown')
    
      11depends=(
    
      12    gcc-libs
    
      13    glib2
    
      14    glibc
    
      15    freetype2
    
      16    fontconfig
    
      17    libglvnd
    
      18    libx11
    
      19    libxext
    
      20    libxcb
    
      21    libxkbcommon
    
      22    libxkbcommon-x11
    
      23    qt5-base
    
      24    qt5-networkauth
    
      25    qt5-serialport
    
      26    qt5-svg
    
      27    qt5-xcb-private-headers
    
      28    zlib
    
      29)
    
      30makedepends=()
    
      31# groups=()
    
      32options=('!strip' '!emptydirs')
    
      33source_x86_64=("https://cloud.embedfire.com/software/FireTools/fireTools.deb")
    
      34sha512sums_x86_64=('b6ea80999c5f440aa7b080b4fb535d446a1150f7fd538658921a2112e1d3e4a5ccb363dc4e20ca58ceb6784db337add10312f217b177ada93a383948e6b232a6')
    
      35
    
      36package() {
    
      37
    
      38    # Extract package data
    
      39    tar xf data.tar.xz -C "${pkgdir}"
    
      40    install -dm755 "${pkgdir}/usr/share/applications/" \
    
      41        "${pkgdir}/usr/bin/"
    
      42    install -Dm644 "${pkgdir}/opt/fireTools/icon/icon.png" "${pkgdir}/usr/share/pixmaps/firetools.png"
    
      43    ln -sf "/opt/fireTools/bin/fireTools" "${pkgdir}/usr/bin/firetools"
    
      44    cat >"${pkgdir}/usr/share/applications/firetools.desktop" <<EOF
    
      45[Desktop Entry]
    
      46Type=Application
    
      47Exec=/usr/bin/firetools
    
      48Name=Multi-function debugging assistant
    
      49Name[zh_CN]=多功能调试助手
    
      50Icon=firetools.png
    
      51Terminal=false
    
      52Path=/opt/fireTools/bin
    
      53StartupNotify=true
    
      54EOF
    
      55    rm -rf "${pkgdir}/opt/fireTools/lib"
    
      56    rm -rf "${pkgdir}/opt/fireTools/icon"
    
      57    rm -rf "${pkgdir}/opt/fireTools/fireTools.desktop"
    
      58    rm -rf "${pkgdir}/opt/fireTools/run.sh"
    
      59
    
      60}
    
      61

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2