hauppauge-usb-git

maintainer t.baag · 0 votes · scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged The package downloads a prebuilt firmware tarball from a non-whitelisted but project-plausible S3 host; however, it is used as static data (installed to /usr/lib/firmware) and not executed, limiting worst-case impact to data tampering.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt firmware tarball from a non-whitelisted but project-plausible S3 host; however, it is used as static data (installed to /usr/lib/firmware) and not executed, limiting worst-case impact to data tampering.

1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:21 'https://s3.amazonaws.com/hauppauge/linux/hauppauge_hdpvr2_157321_patched_2016-09-26.tar.gz'

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Thomas Baag <t.baag@keh-berlin.de>
2# Contributor: dreieck (https://aur.archlinux.org/account/dreieck)
3
4_gitname="HauppaugeUSB"
5_pkgname="hauppauge-usb"
6pkgname="${_pkgname}-git"
7epoch=1
8pkgver=0.6.r42.20230628.eda9313
9pkgrel=1
10pkgdesc="A wrapper around the Hauppauge HDPVR2/Colossus2 Linux driver"
11url="https://github.com/jpoet/HauppaugeUSB"
12license=("GPL-3.0-or-later")
13arch=('x86_64')
14makedepends=('boost' 'git' 'xxd')
15depends=('boost-libs' 'gcc-libs' 'glibc' 'libusb')
16provides=("${_pkgname}=${pkgver}")
17conflicts=("${_pkgname}")
18backup=('etc/haupauge-usb/sample.conf')
19source=(
20 'git+https://github.com/jpoet/HauppaugeUSB.git'
21 'https://s3.amazonaws.com/hauppauge/linux/hauppauge_hdpvr2_157321_patched_2016-09-26.tar.gz'
22)
23sha256sums=(
24 'SKIP'
25 'feba404e549a5dfcabd5fa7311419e4ecf4e0bec90b48ac21977fea9a0e73f5b'
26)
27
28prepare() {
29 cd "${srcdir}/${_gitname}"
30 if [ -e Hauppauge ]; then
31 rm Hauppauge
32 fi
33 ln -s ../hauppauge_hdpvr2_157321_patched_2016-09-26 Hauppauge
34 cd Hauppauge
35 # Patch the Hauppauge source to get it working
36 for patchfilename in \
37 01-NewLine.patch \
38 02-string.patch \
39 03-EnableRegisteredParameters.patch \
40 04-SplitLoggingLevels.patch \
41 05-FirmwareLocation.patch \
42 06-AVOutputCallback.patch \
43 07-ThreadName.patch
44 do
45 patch -Np1 --follow-symlinks -i "${srcdir}/HauppaugeUSB/Patches/${patchfilename}"
46 done
47 # Rename Common/Rx/ADV7842/Wrapper.c to Wrapper.cpp so it can include c++ headers
48 mv Common/Rx/ADV7842/Wrapper.c Common/Rx/ADV7842/Wrapper.cpp
49
50 # Generate git log file to install it to the documentation
51 cd "${srcdir}/${_gitname}"
52 git log > "${srcdir}/git.log"
53}
54
55pkgver() {
56 cd "${srcdir}/${_gitname}"
57
58 _ver="$(grep -E 'VERSION[[:space:]]=' hauppauge2.cpp | awk -F= '{print $2}' | tr -d '[[:space:]]";')"
59 _rev="$(git rev-list --count HEAD)"
60 _date="$(git log -1 --date=format:"%Y%m%d" --format="%ad")"
61 _hash="$(git rev-parse --short HEAD)"
62
63 if [ -z "${_ver}" ]; then
64 error "Version could not be determined."
65 return 1
66 else
67 printf '%s' "${_ver}.r${_rev}.${_date}.${_hash}"
68 fi
69}
70
71build() {
72 cd "${srcdir}/${_gitname}"
73
74 # Add here stuff which may be needed to fix compilation errors because of warnings treated as error.
75 _FIXWERROR=""
76 # Silence compiler warnings
77 _SILENCEWARNINGS="-Wno-unused-but-set-variable -Wno-unused-variable -Wno-reorder -Wno-unused-function -Wno-comment -Wno-stringop-truncation -Wno-array-bounds -Wno-misleading-indentation -Wno-sign-compare -Wno-unused-value -Wno-switch"
78 _CFLAGSADDITIONS=" ${_FIXWERROR} ${_SILENCEWARNINGS}"
79 CFLAGS+="${_CFLAGSADDITIONS}"
80 CXXFLAGS+="${_CFLAGSADDITIONS}"
81 export CFLAGS
82 export CXXFLAGS
83
84 make
85}
86
87package() {
88 cd "${srcdir}/${_gitname}"
89
90 # Needs manual copying of files, since `make install` does not honour `DESTDIR` variable.
91 install -Dvm755 -t "${pkgdir}/usr/bin" hauppauge2
92 install -Dvm644 -t "${pkgdir}/usr/lib/firmware" Hauppauge/Common/EncoderDev/HAPIHost/bin/{llama_usb_vx_host_slave_t22_24.bin,mips_vx_host_slave.bin}
93 install -Dvm644 -t "${pkgdir}/etc/haupauge-usb" etc/sample.conf
94 install -dvm755 "${pkgdir}/etc/udev/rules.d"
95
96 printf '%s\n' 'SUBSYSTEMS=="usb",ATTRS{idVendor}=="2040",ATTR{idProduct}=="e585",MODE="0660",GROUP="video",SYMLINK+="colossus2-1",TAG+="systemd",RUN="/bin/sh -c '\''echo -1 > /sys$devpath/power/autosuspend'\''"' > "${pkgdir}/etc/udev/rules.d/99-Hauppauge.rules"
97
98 install -Dvm644 -t "${pkgdir}/usr/share/doc/${_pkgname}" README.md "${srcdir}/git.log"
99 install -Dvm644 -t "${pkgdir}/usr/share/licenses/${pkgname}" COPYING
100 ln -svr "${pkgdir}/usr/share/licenses/${pkgname}/COPYING" "${pkgdir}/usr/share/doc/${_pkgname}/COPYING"
101}
102

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 LOW 2
2026-08-02 00:16:08 LOW 2
2026-08-01 00:11:18 LOW 2
2026-07-31 00:14:10 LOW 2
2026-07-30 00:17:23 LOW 2
2026-07-29 00:25:53 LOW 2
2026-07-28 00:07:28 LOW 2
2026-07-27 00:24:32 LOW 2
2026-07-26 00:07:32 LOW 2
2026-07-25 00:13:44 LOW 2
2026-07-24 00:02:28 LOW 2
2026-07-23 00:14:47 LOW 2
2026-07-22 00:29:32 LOW 2
2026-07-21 00:24:15 LOW 2
2026-07-20 00:19:49 LOW 2
2026-07-19 00:17:08 LOW 2
2026-07-18 00:14:48 LOW 2
2026-07-17 00:06:16 LOW 2
2026-07-16 00:05:41 LOW 2
2026-07-15 00:09:25 LOW 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion