go-configure-sw-hub

maintainer Annoyedmilk · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt Debian package from a Renesas-owned S3 bucket, which is plausibly the official source; the software is legitimate industrial design tooling, and the build process involves standard repackaging and patching for compatibility, with no evidence of malicious behavior.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt Debian package from a Renesas-owned S3 bucket, which is plausibly the official source; the software is legitimate industrial design tooling, and the build process involves standard repackaging and patching for compatibility, with no evidence of malicious behavior.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:62 source=("https://renesasweb-greenpak.s3.us-west-2.amazonaws.com/v${_pkgver_major}/go-configure-sw-hub-v${pkgver}-debian-13-amd64.deb")

PKGBUILD

1 offending line(s) highlighted

      1# Thanks: Forest Crossman <cyrozap at gmail dot com>
    
      2# Maintainer: Annoyedmilk <hello@annoyedmilk.ch>
    
      3# Contributor: ResRipper <resripper@connective.link>
    
      4# Contributor: Stephanie Wilde-Hobbs <gpg@stephanie.is>
    
      5
    
      6# shellcheck disable=SC2034,SC2154,SC2148
    
      7
    
      8pkgname=go-configure-sw-hub
    
      9_pkgver_major=6.54
    
      10_pkgver_minor=002
    
      11pkgver=$_pkgver_major.$_pkgver_minor
    
      12
    
      13pkgrel=1
    
      14pkgdesc="Renesas/Dialog/Silego Go Configure software hub (greenpak designer)"
    
      15arch=('x86_64')
    
      16url="https://www.renesas.com/us/en/software-tool/go-configure-software-hub"
    
      17license=('custom:Go_Configure_Software_Hub_Software_Licensing_Agreement')
    
      18depends=(
    
      19    alsa-lib
    
      20    dbus
    
      21    desktop-file-utils
    
      22    expat
    
      23    fontconfig
    
      24    freetype2
    
      25    gcc-libs
    
      26    glib2
    
      27    graphviz
    
      28    krb5
    
      29    libcups
    
      30    libdrm
    
      31    libglvnd
    
      32    libxshmfence
    
      33    libx11
    
      34    libxcb
    
      35    libxcomposite
    
      36    libxdamage
    
      37    libxext
    
      38    libxfixes
    
      39    libxi
    
      40    libxkbcommon
    
      41    libxkbcommon-x11
    
      42    libxkbfile
    
      43    libxrandr
    
      44    libxrender
    
      45    libxtst
    
      46    nspr
    
      47    nss
    
      48    shared-mime-info
    
      49    systemd-libs
    
      50    xcb-util-cursor
    
      51    xcb-util-image
    
      52    xcb-util-keysyms
    
      53    xcb-util-renderutil
    
      54    xcb-util-wm
    
      55    zlib
    
      56)
    
      57makedepends=(patchelf)
    
      58conflicts=('greenpak-designer-dev' 'greenpak-designer')
    
      59replaces=('greenpak-designer-dev' 'greenpak-designer')
    
      60options=('!strip' '!debug')
    
      61
    
      62source=("https://renesasweb-greenpak.s3.us-west-2.amazonaws.com/v${_pkgver_major}/go-configure-sw-hub-v${pkgver}-debian-13-amd64.deb")
    
      63b2sums=('1e17c8842bc93af575393cde8fac8966637551045056867df94ce6fb5d58d9e7dd03712dde1feb5b28eea2cd40b890b926bec8089ad5d464bbfaef29bf3556fb')
    
      64
    
      65package() {
    
      66    # Extract the package data
    
      67    tar -xf data.tar.xz -C "${pkgdir}"/
    
      68
    
      69    # Install udev rules
    
      70    install -dm 755 "${pkgdir}/usr/lib/udev/rules.d"
    
      71    mv "${pkgdir}"/lib/udev/rules.d/* "${pkgdir}"/usr/lib/udev/rules.d
    
      72    rm -r "${pkgdir}"/lib
    
      73
    
      74    # Move package to /opt
    
      75    install -dm 755 "${pkgdir}"/opt
    
      76    mv "${pkgdir}"/usr/local/"${pkgname}" "${pkgdir}"/opt/"${pkgname}"
    
      77    rm -r "${pkgdir}"/usr/local
    
      78
    
      79    # Link launcher to /usr/bin
    
      80    rm "${pkgdir}"/usr/bin/*
    
      81    ln -s /opt/${pkgname}/bin/GPLauncher "${pkgdir}"/usr/bin/GPLauncher
    
      82
    
      83    # Fix desktop launchers
    
      84    for _launcher in "${pkgdir}/usr/share/applications"/*.desktop; do
    
      85        sed -i -e "s!local/${pkgname}/!!g" "$_launcher"
    
      86    done
    
      87
    
      88    # Install license file
    
      89    install -dm 755 "${pkgdir}/usr/share/licenses/${pkgname}"
    
      90    ln -s "/usr/share/doc/${pkgname}/copyright" "${pkgdir}/usr/share/licenses/${pkgname}/copyright"
    
      91
    
      92    # Patch graphviz sonames — app was built against an older graphviz (soname 6),
    
      93    # Arch ships soname 7/8. Only GP5 and GP6 link against graphviz.
    
      94    for _bin in GP5 GP6; do
    
      95        patchelf --replace-needed libgvc.so.6 libgvc.so.7 "${pkgdir}/opt/${pkgname}/bin/${_bin}"
    
      96        patchelf --replace-needed libcgraph.so.6 libcgraph.so.8 "${pkgdir}/opt/${pkgname}/bin/${_bin}"
    
      97    done
    
      98}
    
      99

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2