hostapd-git-intel-lar

maintainer zan · 2 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from a legitimate project Git repository and applies a patch from a personal host; however, the patch is a small, reviewable diff for a specific workaround and does not introduce unverifiable executable code, making the risk low.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from a legitimate project Git repository and applies a patch from a personal host; however, the patch is a small, reviewable diff for a specific workaround and does not introduce unverifiable executable code, making the risk low.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=('git://w1.fi/hostap.git'
PKGBUILD:19 'https://tildearrow.org/storage/hostapd-2.10-lar.patch')

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Melanie Scheirer <mel@nie.rs>
    
      2# Contributor: Sergej Pupykin <pupykin.s+arch@gmail.com>
    
      3# Contribuor:  Gaetan Bisson <bisson@archlinux.org>
    
      4
    
      5pkgname=hostapd-git-intel-lar
    
      6_gitname=${pkgname/d-git-intel-lar}
    
      7_name=${pkgname/-git-intel-lar}
    
      8pkgver=20220902.6f8af5974
    
      9pkgrel=1
    
      10pkgdesc='hostapd with prescan LAR workaround for Intel NICs'
    
      11url='http://w1.fi/hostapd/'
    
      12arch=(x86_64)
    
      13license=(BSD)
    
      14makedepends=(git)
    
      15depends=(libnl openssl sqlite)
    
      16source=('git://w1.fi/hostap.git'
    
      17         config
    
      18         hostapd.service
    
      19         'https://tildearrow.org/storage/hostapd-2.10-lar.patch')
    
      20sha256sums=('SKIP'
    
      21         '7b2bb1628c44ea41445fcde0e6e45484ab94280bef57cf36f7ea022186cf3a73'
    
      22         '989bc6855f44c0b360e3d4cd4a146c35b7c12f8a0ced627b4b033f58edcade8e'
    
      23         '561d03e730af458017e68d59a4caa834fcf310f9b16ac543e92063290f586b8d')
    
      24options=('emptydirs')
    
      25conflicts=('hostapd')
    
      26provides=('hostapd')
    
      27
    
      28pkgver() {
    
      29  cd "$_gitname"
    
      30  git log -1 --format='%cd.%h' --date=short | tr -d -
    
      31}
    
      32
    
      33prepare() {
    
      34  cd "$_gitname"
    
      35  # fix include locations in main configuration file
    
      36  sed -e 's|/etc/hostapd|/etc/hostapd/hostapd|g' \
    
      37      -e 's|/var/run|/run|g' \
    
      38      -e 's|radius_attr.sqlite|/var/lib/hostapd/radius_attr.sqlite|g' \
    
      39      -e 's|hostapd.cred|/var/lib/hostapd/hostapd.cred|g' \
    
      40      -e 's|hostapd.ap_settings|/var/lib/hostapd/hostapd.ap_settings|g' \
    
      41      -e 's|hostapd_wps_pin_requests|hostapd/wps_pin_requests|g' \
    
      42      -i "$_name/$_name.conf"
    
      43
    
      44  # extract license
    
      45  cat "${pkgname}/README" | head -n47 | tail -n5 > LICENSE
    
      46
    
      47  # link build configuration into place:
    
      48  # an up-to-date version of the build configuration can be found in
    
      49  # hostapd/defconfig and should be diffed with the packaged one before every
    
      50  # build
    
      51  ln -svf "$srcdir/config" "$_name/.config"
    
      52
    
      53  patch -p1 < "$srcdir/hostapd-2.10-lar.patch"
    
      54}
    
      55
    
      56build() {
    
      57  make -C "$_gitname/$_name"
    
      58}
    
      59
    
      60package() {
    
      61  cd "$_gitname"
    
      62  make -C "$_name" install DESTDIR="$pkgdir" BINDIR="/usr/bin"
    
      63  # systemd service
    
      64  install -vDm 644 "../$_name.service" -t "$pkgdir/usr/lib/systemd/system/"
    
      65  # license
    
      66  install -vDm 644 LICENSE -t "$pkgdir/usr/share/licenses/$_name/"
    
      67  # config
    
      68  install -vDm 640 "$_name/$_name."{accept,conf,deny,eap_user,radius_clients,vlan,wpa_psk} -t "$pkgdir/etc/$_name"
    
      69  # docs
    
      70  install -vDm 644 "$_name/"{hostapd.sim_db,wired.conf,hlr_auc_gw.{txt,milenage_db}} "$_name/"{README*,ChangeLog} -t "$pkgdir/usr/share/doc/$_name"
    
      71  # man pages
    
      72  install -vDm 644 "$_name/$_name.8" -t "$pkgdir/usr/share/man/man8/"
    
      73  install -vDm 644 "$_name/${_name}_cli.1" -t "$pkgdir/usr/share/man/man1/"
    
      74  # state dir
    
      75  install -vdm 750 "$pkgdir/var/lib/$_name"
    
      76}
    
      77

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2