fire-tool

MEDIUM

maintainer taotieren 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The PKGBUILD downloads a prebuilt binary .deb from cloud.embedfire.com (the vendor's own cloud storage, not a standard package repository) and installs a compiled Qt application binary directly into /opt. While embedfire.com appears to be a legitimate Chinese embedded-systems vendor (野火/Embedfire), the source URL points to a mutable artifact with no versioning in the filename (fireTools.deb rather than fireTools-1.0.1.5.deb), meaning the file could be silently replaced without changing the URL. The sha512sum provides some protection against substitution at build time, but the lack of a versioned URL means the checksum will break on any upstream update rather than catching a malicious swap. The core concern is a prebuilt, unstripped binary executable from a non-standard cloud host being installed and run with user privileges — this is a genuine medium-severity supply-chain concern, not a false positive, though there is no evidence of active malice.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:33 source_x86_64=("https://cloud.embedfire.com/software/FireTools/fireTools.deb")

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb from cloud.embedfire.com (the vendor's own cloud storage, not a standard package repository) and installs a compiled Qt application binary directly into /opt. While embedfire.com appears to be a legitimate Chinese embedded-systems vendor (野火/Embedfire), the source URL points to a mutable artifact with no versioning in the filename (fireTools.deb rather than fireTools-1.0.1.5.deb), meaning the file could be silently replaced without changing the URL. The sha512sum provides some protection against substitution at build time, but the lack of a versioned URL means the checksum will break on any upstream update rather than catching a malicious swap. The core concern is a prebuilt, unstripped binary executable from a non-standard cloud host being installed and run with user privileges — this is a genuine medium-severity supply-chain concern, not a false positive, though there is no evidence of active malice.

PKGBUILD

1 offending line(s) highlighted

      1# Generated by debtap
    
      2# Maintainer: taotieren <admin@taotieren.com>
    
      3
    
      4pkgname=fire-tool
    
      5pkgver=1.0.1.5
    
      6pkgrel=6
    
      7pkgdesc="Embedfire Tool support Serial communication, TCP/UDP communication, camera and PID debuggingVisit https://www.embedfire.com for more information."
    
      8arch=('x86_64')
    
      9url="https://www.embedfire.com"
    
      10license=('unknown')
    
      11depends=(
    
      12    gcc-libs
    
      13    glib2
    
      14    glibc
    
      15    freetype2
    
      16    fontconfig
    
      17    libglvnd
    
      18    libx11
    
      19    libxext
    
      20    libxcb
    
      21    libxkbcommon
    
      22    libxkbcommon-x11
    
      23    qt5-base
    
      24    qt5-networkauth
    
      25    qt5-serialport
    
      26    qt5-svg
    
      27    qt5-xcb-private-headers
    
      28    zlib
    
      29)
    
      30makedepends=()
    
      31# groups=()
    
      32options=('!strip' '!emptydirs')
    
      33source_x86_64=("https://cloud.embedfire.com/software/FireTools/fireTools.deb")
    
      34sha512sums_x86_64=('b6ea80999c5f440aa7b080b4fb535d446a1150f7fd538658921a2112e1d3e4a5ccb363dc4e20ca58ceb6784db337add10312f217b177ada93a383948e6b232a6')
    
      35
    
      36package() {
    
      37
    
      38    # Extract package data
    
      39    tar xf data.tar.xz -C "${pkgdir}"
    
      40    install -dm755 "${pkgdir}/usr/share/applications/" \
    
      41        "${pkgdir}/usr/bin/"
    
      42    install -Dm644 "${pkgdir}/opt/fireTools/icon/icon.png" "${pkgdir}/usr/share/pixmaps/firetools.png"
    
      43    ln -sf "/opt/fireTools/bin/fireTools" "${pkgdir}/usr/bin/firetools"
    
      44    cat >"${pkgdir}/usr/share/applications/firetools.desktop" <<EOF
    
      45[Desktop Entry]
    
      46Type=Application
    
      47Exec=/usr/bin/firetools
    
      48Name=Multi-function debugging assistant
    
      49Name[zh_CN]=多功能调试助手
    
      50Icon=firetools.png
    
      51Terminal=false
    
      52Path=/opt/fireTools/bin
    
      53StartupNotify=true
    
      54EOF
    
      55    rm -rf "${pkgdir}/opt/fireTools/lib"
    
      56    rm -rf "${pkgdir}/opt/fireTools/icon"
    
      57    rm -rf "${pkgdir}/opt/fireTools/fireTools.desktop"
    
      58    rm -rf "${pkgdir}/opt/fireTools/run.sh"
    
      59
    
      60}
    
      61

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2