greenpak-designer

maintainer cyrozap · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads prebuilt x86/x86_64 .deb binaries from support.dialog-semiconductor.com, which is the official Dialog Semiconductor (now Renesas) support portal for their GreenPAK designer software. This is the legitimate vendor's own download host, not a personal or unofficial mirror. The SHA256 checksums are pinned, providing integrity verification. However, the concern is real in the sense that: (1) these are closed-source prebuilt binaries being executed on the user's system, (2) the host is a vendor support portal rather than a canonical open-source release channel, and (3) there is no GPG signature verification. The PKGBUILD itself is well-structured — it properly extracts the .deb, relocates files to FHS-compliant paths, patches ELF RPATHs, and removes bundled Qt/qwt/libusb libraries in favor of system ones. The risk is the standard supply-chain concern for any proprietary prebuilt binary package: if the vendor's download server were compromised, users would execute malicious code. This is the inherent nature of packaging proprietary software from vendor binaries, which is common in the AUR (e.g., google-chrome, spotify). The medium rating is marginally justified but this is essentially the same risk profile as any other proprietary vendor binary AUR package.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 source_i686=("https://support.dialog-semiconductor.com/downloads/GP_Designer_v${pkgver}_Debian-testing_i386_Setup.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads prebuilt x86/x86_64 .deb binaries from support.dialog-semiconductor.com, which is the official Dialog Semiconductor (now Renesas) support portal for their GreenPAK designer software. This is the legitimate vendor's own download host, not a personal or unofficial mirror. The SHA256 checksums are pinned, providing integrity verification. However, the concern is real in the sense that: (1) these are closed-source prebuilt binaries being executed on the user's system, (2) the host is a vendor support portal rather than a canonical open-source release channel, and (3) there is no GPG signature verification. The PKGBUILD itself is well-structured — it properly extracts the .deb, relocates files to FHS-compliant paths, patches ELF RPATHs, and removes bundled Qt/qwt/libusb libraries in favor of system ones. The risk is the standard supply-chain concern for any proprietary prebuilt binary package: if the vendor's download server were compromised, users would execute malicious code. This is the inherent nature of packaging proprietary software from vendor binaries, which is common in the AUR (e.g., google-chrome, spotify). The medium rating is marginally justified but this is essentially the same risk profile as any other proprietary vendor binary AUR package.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Forest Crossman <cyrozap at gmail dot com>
    
      2
    
      3pkgname=greenpak-designer
    
      4_pkgver=6.25
    
      5_pkgrel=3
    
      6pkgver=$_pkgver.$(printf "%03d" $_pkgrel)
    
      7pkgrel=1
    
      8pkgdesc="GreenPAK3-6 Designer"
    
      9arch=('i686' 'x86_64')
    
      10url="https://www.dialog-semiconductor.com/greenpak-designer-software"
    
      11license=('custom')
    
      12makedepends=('patchelf')
    
      13depends=('desktop-file-utils' 'graphviz' 'gtk-update-icon-cache' 'libusb' 'qt5-svg' 'qt5-webview' 'qwt' 'shared-mime-info')
    
      14conflicts=('greenpak-designer-dev')
    
      15replaces=('greenpak-designer-dev')
    
      16options=('!strip')
    
      17install=${pkgname}.install
    
      18
    
      19source_i686=("https://support.dialog-semiconductor.com/downloads/GP_Designer_v${pkgver}_Debian-testing_i386_Setup.deb")
    
      20sha256sums_i686=('34bea41fdd706d4a7ed34ee18769ff0fa299c0950f2d477a11fa06109671f349')
    
      21source_x86_64=("https://support.dialog-semiconductor.com/downloads/GP_Designer_v${pkgver}_Debian-testing_amd64_Setup.deb")
    
      22sha256sums_x86_64=('93f6ba4899bf9efe7e3316eb497763a52db1cfa93ef2806c6d83536db9a39095')
    
      23
    
      24package() {
    
      25  # Extract the package data
    
      26  tar -xJf data.tar.xz --exclude="usr/share/lintian" -C "${pkgdir}"/
    
      27
    
      28  # Move /lib files to /usr/lib
    
      29  install -dm 755 "${pkgdir}/usr/lib"
    
      30  mv "${pkgdir}"/lib/* "${pkgdir}"/usr/lib/
    
      31  rm -r "${pkgdir}"/lib
    
      32
    
      33  # Remove unneeded binaries and files
    
      34  rm -r "${pkgdir}"/usr/bin
    
      35  rm -r "${pkgdir}/usr/local/${pkgname}/bin"/{platforms,QtWebEngineProcess,slgspicebackend,qt.conf}
    
      36
    
      37  # Move binaries to /usr/bin
    
      38  mv "${pkgdir}/usr/local/${pkgname}/bin" "${pkgdir}"/usr/bin
    
      39  ln -s "../lib/${pkgname}/slgspicebackend" "${pkgdir}"/usr/bin/slgspicebackend
    
      40
    
      41  # Remove unneeded libraries
    
      42  rm -r "${pkgdir}/usr/local/${pkgname}/lib"/{libQt5*,libqwt*,libusb-1.0.so*}
    
      43
    
      44  # Move libraries to subdirectory in /usr/lib
    
      45  install -dm 755 "${pkgdir}/usr/lib/${pkgname}"
    
      46  mv "${pkgdir}/usr/local/${pkgname}/lib"{,exec}/* "${pkgdir}/usr/lib/${pkgname}"
    
      47  rm -r "${pkgdir}/usr/local/${pkgname}/lib"{,exec}
    
      48
    
      49  # Remove unneeded support files
    
      50  rm -r "${pkgdir}/usr/local/${pkgname}"/{plugins,qml,resources,translations}
    
      51
    
      52  # Move supporting files to /usr/share
    
      53  mv "${pkgdir}/usr/local/${pkgname}" "${pkgdir}/usr/share/${pkgname}"
    
      54  rm -r "${pkgdir}"/usr/local
    
      55
    
      56  # Redefine library search paths
    
      57  for _exec in "${pkgdir}/usr/bin"/*; do
    
      58    patchelf --set-rpath "\$ORIGIN/../lib/${pkgname}:\$ORIGIN/../lib" $_exec
    
      59  done
    
      60  for _lib in "${pkgdir}/usr/lib/${pkgname}"/{lib*,slgspicebackend}; do
    
      61    patchelf --set-rpath "\$ORIGIN:\$ORIGIN/.." $_lib
    
      62  done
    
      63
    
      64  # Fix desktop launchers
    
      65  for _launcher in "${pkgdir}/usr/share/applications"/*.desktop; do
    
      66    sed -i "s!local/greenpak-designer/!!g" $_launcher
    
      67  done
    
      68
    
      69  # Install license file
    
      70  install -dm 755 "${pkgdir}/usr/share/licenses/${pkgname}"
    
      71  ln -s "/usr/share/doc/${pkgname}/copyright" "${pkgdir}/usr/share/licenses/${pkgname}/copyright"
    
      72}
    
      73

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2