hplip-minimal
MEDIUM
maintainer ayu2805
1 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The PKGBUILD downloads a prebuilt binary plugin (.run file) from an official but untrusted host without checksum verification, posing a supply-chain risk if the source were compromised.
Triggered rules
Medium
External download from an untrusted host, not in source=()
external_download_not_in_source
curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.
-
PKGBUILD:25
curl -A "Mozilla/0.0 (Linux x86_64) Chromium/0.0.0.0" -O https://developers.hp.com/sites/default/files/2026-05/hplip-$pkgver-plugin.run
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is MEDIUM (confidence 95%): The PKGBUILD downloads a prebuilt binary plugin (.run file) from an official but untrusted host without checksum verification, posing a supply-chain risk if the source were compromised.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Ayushmaan Padhi
2
3
pkgname='hplip-minimal'
4
pkgver=3.26.4
5
pkgrel=1
6
pkgdesc='Only printer drivers from HPLIP with proprietary binary plugin'
7
arch=('x86_64')
8
url='https://developers.hp.com/hp-linux-imaging-and-printing/'
9
license=('GPL-2.0-only' 'MIT' 'BSD-3-Clause' 'GPL-3.0-only' 'LicenseRef-HPLIP')
10
depends=(libcups)
11
makedepends=(python libusb cups)
12
conflicts=('hplip' 'hplip-lite' 'hplip-plugin')
13
provides=('hplip')
14
backup=('etc/hp/hplip.conf' 'var/lib/hp/hplip.state')
15
optdepends=('cups: for printing support')
16
source=(https://downloads.sourceforge.net/hplip/hplip-$pkgver.tar.gz
17
hplip-pserror-c99.patch
18
hplip-missing-drivers.patch)
19
sha256sums=('SKIP'
20
'SKIP'
21
'SKIP')
22
options=(!makeflags)
23
24
prepare() {
25
curl -A "Mozilla/0.0 (Linux x86_64) Chromium/0.0.0.0" -O https://developers.hp.com/sites/default/files/2026-05/hplip-$pkgver-plugin.run
26
sh "hplip-$pkgver-plugin.run" --target "$srcdir/hplip-$pkgver" --noexec
27
28
cd "hplip-$pkgver"
29
patch -Np1 -i ../hplip-pserror-c99.patch
30
patch -Np1 -i ../hplip-missing-drivers.patch
31
export AUTOMAKE='automake --foreign'
32
autoreconf --force --install
33
}
34
35
build() {
36
cd "$srcdir/hplip-$pkgver"
37
./configure -q --prefix=/usr \
38
--enable-lite-build \
39
--disable-network-build \
40
--disable-scan-build \
41
--disable-doc-build
42
make
43
}
44
45
package() {
46
cd "hplip-$pkgver"
47
make DESTDIR="$pkgdir/" install
48
install -Dt "$pkgdir/usr/share/licenses/$pkgname" -m644 COPYING
49
install -Dt "$pkgdir/usr/share/hplip" -m644 plugin.spec
50
install -Dt "$pkgdir/usr/share/hplip/data/firmware" -m644 hp_laserjet_*.fw.gz
51
install -Dt "$pkgdir/usr/share/hplip/prnt/plugins" -m644 hbpl1-x86_64.so
52
install -Dt "$pkgdir/usr/share/hplip/prnt/plugins" -m644 lj-x86_64.so
53
install -Dt "$pkgdir/usr/share/licenses/$pkgname" -m644 license.txt
54
55
echo -e "[plugin]\ninstalled = 1\neula = 1\nversion = $pkgver" | tee hplip.state
56
install -Dm644 -t "$pkgdir/var/lib/hp" hplip.state
57
58
find "$pkgdir/usr/share/hplip" -type f -name "*.so" | while read -r f; do
59
lib_dir="${f%/*}"
60
lib_name="${f##*/}"
61
ln -vsf "$lib_name" "$lib_dir/${lib_name%%-*}.so"
62
done
63
}
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Medium | 2 |
| 2026-09-16 00:03:17 | Medium | 2 |
| 2026-09-15 00:25:31 | Medium | 2 |
| 2026-09-14 00:27:57 | Medium | 2 |
| 2026-09-13 00:19:54 | Medium | 2 |
| 2026-09-12 00:25:17 | Medium | 2 |
| 2026-09-11 00:19:22 | Medium | 2 |
| 2026-09-10 00:22:44 | Medium | 2 |
| 2026-09-09 00:04:09 | Medium | 2 |
| 2026-09-08 00:18:08 | Medium | 2 |
| 2026-09-07 00:30:15 | Medium | 2 |
| 2026-09-06 00:17:06 | Medium | 2 |
| 2026-09-05 00:16:27 | Medium | 2 |
| 2026-09-04 00:03:13 | Medium | 2 |
| 2026-09-03 00:15:47 | Medium | 2 |
| 2026-09-02 00:02:31 | Medium | 2 |
| 2026-09-01 00:11:19 | Medium | 2 |
| 2026-08-31 00:19:57 | Medium | 2 |
| 2026-08-30 00:04:14 | Medium | 2 |
| 2026-08-29 00:29:17 | Medium | 2 |