hauppauge-usb-git
LOW
maintainer t.baag
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a prebuilt firmware tarball from a non-whitelisted but project-plausible S3 host; however, it is used as static data (installed to /usr/lib/firmware) and not executed, limiting worst-case impact to data tampering.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt firmware tarball from a non-whitelisted but project-plausible S3 host; however, it is used as static data (installed to /usr/lib/firmware) and not executed, limiting worst-case impact to data tampering.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:21
'https://s3.amazonaws.com/hauppauge/linux/hauppauge_hdpvr2_157321_patched_2016-09-26.tar.gz'
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Thomas Baag <t.baag@keh-berlin.de>
2
# Contributor: dreieck (https://aur.archlinux.org/account/dreieck)
3
4
_gitname="HauppaugeUSB"
5
_pkgname="hauppauge-usb"
6
pkgname="${_pkgname}-git"
7
epoch=1
8
pkgver=0.6.r42.20230628.eda9313
9
pkgrel=1
10
pkgdesc="A wrapper around the Hauppauge HDPVR2/Colossus2 Linux driver"
11
url="https://github.com/jpoet/HauppaugeUSB"
12
license=("GPL-3.0-or-later")
13
arch=('x86_64')
14
makedepends=('boost' 'git' 'xxd')
15
depends=('boost-libs' 'gcc-libs' 'glibc' 'libusb')
16
provides=("${_pkgname}=${pkgver}")
17
conflicts=("${_pkgname}")
18
backup=('etc/haupauge-usb/sample.conf')
19
source=(
20
'git+https://github.com/jpoet/HauppaugeUSB.git'
21
'https://s3.amazonaws.com/hauppauge/linux/hauppauge_hdpvr2_157321_patched_2016-09-26.tar.gz'
22
)
23
sha256sums=(
24
'SKIP'
25
'feba404e549a5dfcabd5fa7311419e4ecf4e0bec90b48ac21977fea9a0e73f5b'
26
)
27
28
prepare() {
29
cd "${srcdir}/${_gitname}"
30
if [ -e Hauppauge ]; then
31
rm Hauppauge
32
fi
33
ln -s ../hauppauge_hdpvr2_157321_patched_2016-09-26 Hauppauge
34
cd Hauppauge
35
# Patch the Hauppauge source to get it working
36
for patchfilename in \
37
01-NewLine.patch \
38
02-string.patch \
39
03-EnableRegisteredParameters.patch \
40
04-SplitLoggingLevels.patch \
41
05-FirmwareLocation.patch \
42
06-AVOutputCallback.patch \
43
07-ThreadName.patch
44
do
45
patch -Np1 --follow-symlinks -i "${srcdir}/HauppaugeUSB/Patches/${patchfilename}"
46
done
47
# Rename Common/Rx/ADV7842/Wrapper.c to Wrapper.cpp so it can include c++ headers
48
mv Common/Rx/ADV7842/Wrapper.c Common/Rx/ADV7842/Wrapper.cpp
49
50
# Generate git log file to install it to the documentation
51
cd "${srcdir}/${_gitname}"
52
git log > "${srcdir}/git.log"
53
}
54
55
pkgver() {
56
cd "${srcdir}/${_gitname}"
57
58
_ver="$(grep -E 'VERSION[[:space:]]=' hauppauge2.cpp | awk -F= '{print $2}' | tr -d '[[:space:]]";')"
59
_rev="$(git rev-list --count HEAD)"
60
_date="$(git log -1 --date=format:"%Y%m%d" --format="%ad")"
61
_hash="$(git rev-parse --short HEAD)"
62
63
if [ -z "${_ver}" ]; then
64
error "Version could not be determined."
65
return 1
66
else
67
printf '%s' "${_ver}.r${_rev}.${_date}.${_hash}"
68
fi
69
}
70
71
build() {
72
cd "${srcdir}/${_gitname}"
73
74
# Add here stuff which may be needed to fix compilation errors because of warnings treated as error.
75
_FIXWERROR=""
76
# Silence compiler warnings
77
_SILENCEWARNINGS="-Wno-unused-but-set-variable -Wno-unused-variable -Wno-reorder -Wno-unused-function -Wno-comment -Wno-stringop-truncation -Wno-array-bounds -Wno-misleading-indentation -Wno-sign-compare -Wno-unused-value -Wno-switch"
78
_CFLAGSADDITIONS=" ${_FIXWERROR} ${_SILENCEWARNINGS}"
79
CFLAGS+="${_CFLAGSADDITIONS}"
80
CXXFLAGS+="${_CFLAGSADDITIONS}"
81
export CFLAGS
82
export CXXFLAGS
83
84
make
85
}
86
87
package() {
88
cd "${srcdir}/${_gitname}"
89
90
# Needs manual copying of files, since `make install` does not honour `DESTDIR` variable.
91
install -Dvm755 -t "${pkgdir}/usr/bin" hauppauge2
92
install -Dvm644 -t "${pkgdir}/usr/lib/firmware" Hauppauge/Common/EncoderDev/HAPIHost/bin/{llama_usb_vx_host_slave_t22_24.bin,mips_vx_host_slave.bin}
93
install -Dvm644 -t "${pkgdir}/etc/haupauge-usb" etc/sample.conf
94
install -dvm755 "${pkgdir}/etc/udev/rules.d"
95
96
printf '%s\n' 'SUBSYSTEMS=="usb",ATTRS{idVendor}=="2040",ATTR{idProduct}=="e585",MODE="0660",GROUP="video",SYMLINK+="colossus2-1",TAG+="systemd",RUN="/bin/sh -c '\''echo -1 > /sys$devpath/power/autosuspend'\''"' > "${pkgdir}/etc/udev/rules.d/99-Hauppauge.rules"
97
98
install -Dvm644 -t "${pkgdir}/usr/share/doc/${_pkgname}" README.md "${srcdir}/git.log"
99
install -Dvm644 -t "${pkgdir}/usr/share/licenses/${pkgname}" COPYING
100
ln -svr "${pkgdir}/usr/share/licenses/${pkgname}/COPYING" "${pkgdir}/usr/share/doc/${_pkgname}/COPYING"
101
}
102
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |