go-configure-sw-hub

MEDIUM

maintainer Annoyedmilk 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt Debian package from a non-standard S3 host, which is an unverifiable executable artifact that could be silently swapped, posing a supply-chain risk.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:63 source=("https://renesasweb-greenpak.s3.us-west-2.amazonaws.com/v${_pkgver_major}/go-configure-sw-hub-v${pkgver}-debian-13-amd64.deb")

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt Debian package from a non-standard S3 host, which is an unverifiable executable artifact that could be silently swapped, posing a supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Thanks: Forest Crossman <cyrozap at gmail dot com>
    
      2# Maintainer: Annoyedmilk <hello@annoyedmilk.ch>
    
      3# Contributor: ResRipper <resripper@connective.link>
    
      4# Contributor: Stephanie Wilde-Hobbs <gpg@stephanie.is>
    
      5
    
      6# shellcheck disable=SC2034,SC2154,SC2148
    
      7
    
      8pkgname=go-configure-sw-hub
    
      9_pkgver_major=6.55
    
      10_pkgver_minor=001
    
      11pkgver=$_pkgver_major.$_pkgver_minor
    
      12
    
      13pkgrel=1
    
      14pkgdesc="Renesas/Dialog/Silego Go Configure software hub (greenpak designer)"
    
      15arch=('x86_64')
    
      16url="https://www.renesas.com/us/en/software-tool/go-configure-software-hub"
    
      17license=('custom:Go_Configure_Software_Hub_Software_Licensing_Agreement')
    
      18depends=(
    
      19    alsa-lib
    
      20    dbus
    
      21    desktop-file-utils
    
      22    expat
    
      23    fontconfig
    
      24    freetype2
    
      25    gcc-libs
    
      26    glib2
    
      27    graphviz
    
      28    hicolor-icon-theme
    
      29    krb5
    
      30    libcups
    
      31    libdrm
    
      32    libglvnd
    
      33    libxshmfence
    
      34    libx11
    
      35    libxcb
    
      36    libxcomposite
    
      37    libxdamage
    
      38    libxext
    
      39    libxfixes
    
      40    libxi
    
      41    libxkbcommon
    
      42    libxkbcommon-x11
    
      43    libxkbfile
    
      44    libxrandr
    
      45    libxrender
    
      46    libxtst
    
      47    nspr
    
      48    nss
    
      49    shared-mime-info
    
      50    systemd-libs
    
      51    xcb-util-cursor
    
      52    xcb-util-image
    
      53    xcb-util-keysyms
    
      54    xcb-util-renderutil
    
      55    xcb-util-wm
    
      56    zlib
    
      57)
    
      58makedepends=(patchelf)
    
      59conflicts=('greenpak-designer-dev' 'greenpak-designer')
    
      60replaces=('greenpak-designer-dev' 'greenpak-designer')
    
      61options=('!strip' '!debug')
    
      62
    
      63source=("https://renesasweb-greenpak.s3.us-west-2.amazonaws.com/v${_pkgver_major}/go-configure-sw-hub-v${pkgver}-debian-13-amd64.deb")
    
      64b2sums=('3f0d2c6473922d4923bbb3619db65869e8ecd141130bd5b7a3e3775e3eb6e32e6b387dac0c93e3d86ea3aa6ad6fc816f0ef56f2ca1c815f9aef4e22acf9e142e')
    
      65
    
      66package() {
    
      67    # Extract the package data
    
      68    tar -xf data.tar.xz -C "${pkgdir}"/
    
      69
    
      70    # Install udev rules
    
      71    install -dm 755 "${pkgdir}/usr/lib/udev/rules.d"
    
      72    mv "${pkgdir}"/lib/udev/rules.d/* "${pkgdir}"/usr/lib/udev/rules.d
    
      73    rm -r "${pkgdir}"/lib
    
      74
    
      75    # Move package to /opt
    
      76    install -dm 755 "${pkgdir}"/opt
    
      77    mv "${pkgdir}"/usr/local/"${pkgname}" "${pkgdir}"/opt/"${pkgname}"
    
      78    rm -r "${pkgdir}"/usr/local
    
      79
    
      80    # Link launcher to /usr/bin
    
      81    rm "${pkgdir}"/usr/bin/*
    
      82    ln -s /opt/${pkgname}/bin/GPLauncher "${pkgdir}"/usr/bin/GPLauncher
    
      83
    
      84    # Fix desktop launchers
    
      85    for _launcher in "${pkgdir}/usr/share/applications"/*.desktop; do
    
      86        sed -i -e "s!local/${pkgname}/!!g" "$_launcher"
    
      87    done
    
      88
    
      89    # Install license file
    
      90    install -dm 755 "${pkgdir}/usr/share/licenses/${pkgname}"
    
      91    ln -s "/usr/share/doc/${pkgname}/copyright" "${pkgdir}/usr/share/licenses/${pkgname}/copyright"
    
      92
    
      93    # Patch graphviz sonames — app was built against an older graphviz (soname 6),
    
      94    # Arch ships soname 7/10. Only GP5 and GP6 link against graphviz.
    
      95    for _bin in GP5 GP6; do
    
      96        patchelf --replace-needed libgvc.so.6 libgvc.so.7 "${pkgdir}/opt/${pkgname}/bin/${_bin}"
    
      97        patchelf --replace-needed libcgraph.so.6 libcgraph.so.10 "${pkgdir}/opt/${pkgname}/bin/${_bin}"
    
      98    done
    
      99}
    
      100

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2