hplip-minimal
MEDIUM
maintainer ayu2805
1 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The PKGBUILD downloads a prebuilt binary plugin (.run file) from an official but untrusted host without checksum verification, posing a supply-chain risk if the source were compromised.
Triggered rules
Medium
External download from an untrusted host, not in source=()
external_download_not_in_source
curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.
-
PKGBUILD:25
curl -A "Mozilla/0.0 (Linux x86_64) Chromium/0.0.0.0" -O https://developers.hp.com/sites/default/files/2026-05/hplip-$pkgver-plugin.run
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is MEDIUM (confidence 95%): The PKGBUILD downloads a prebuilt binary plugin (.run file) from an official but untrusted host without checksum verification, posing a supply-chain risk if the source were compromised.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Ayushmaan Padhi
2
3
pkgname='hplip-minimal'
4
pkgver=3.26.4
5
pkgrel=1
6
pkgdesc='Only printer drivers from HPLIP with proprietary binary plugin'
7
arch=('x86_64')
8
url='https://developers.hp.com/hp-linux-imaging-and-printing/'
9
license=('GPL-2.0-only' 'MIT' 'BSD-3-Clause' 'GPL-3.0-only' 'LicenseRef-HPLIP')
10
depends=(libcups)
11
makedepends=(python libusb cups)
12
conflicts=('hplip' 'hplip-lite' 'hplip-plugin')
13
provides=('hplip')
14
backup=('etc/hp/hplip.conf' 'var/lib/hp/hplip.state')
15
optdepends=('cups: for printing support')
16
source=(https://downloads.sourceforge.net/hplip/hplip-$pkgver.tar.gz
17
hplip-pserror-c99.patch
18
hplip-missing-drivers.patch)
19
sha256sums=('SKIP'
20
'SKIP'
21
'SKIP')
22
options=(!makeflags)
23
24
prepare() {
25
curl -A "Mozilla/0.0 (Linux x86_64) Chromium/0.0.0.0" -O https://developers.hp.com/sites/default/files/2026-05/hplip-$pkgver-plugin.run
26
sh "hplip-$pkgver-plugin.run" --target "$srcdir/hplip-$pkgver" --noexec
27
28
cd "hplip-$pkgver"
29
patch -Np1 -i ../hplip-pserror-c99.patch
30
patch -Np1 -i ../hplip-missing-drivers.patch
31
export AUTOMAKE='automake --foreign'
32
autoreconf --force --install
33
}
34
35
build() {
36
cd "$srcdir/hplip-$pkgver"
37
./configure -q --prefix=/usr \
38
--enable-lite-build \
39
--disable-network-build \
40
--disable-scan-build \
41
--disable-doc-build
42
make
43
}
44
45
package() {
46
cd "hplip-$pkgver"
47
make DESTDIR="$pkgdir/" install
48
install -Dt "$pkgdir/usr/share/licenses/$pkgname" -m644 COPYING
49
install -Dt "$pkgdir/usr/share/hplip" -m644 plugin.spec
50
install -Dt "$pkgdir/usr/share/hplip/data/firmware" -m644 hp_laserjet_*.fw.gz
51
install -Dt "$pkgdir/usr/share/hplip/prnt/plugins" -m644 hbpl1-x86_64.so
52
install -Dt "$pkgdir/usr/share/hplip/prnt/plugins" -m644 lj-x86_64.so
53
install -Dt "$pkgdir/usr/share/licenses/$pkgname" -m644 license.txt
54
55
echo -e "[plugin]\ninstalled = 1\neula = 1\nversion = $pkgver" | tee hplip.state
56
install -Dm644 -t "$pkgdir/var/lib/hp" hplip.state
57
58
find "$pkgdir/usr/share/hplip" -type f -name "*.so" | while read -r f; do
59
lib_dir="${f%/*}"
60
lib_name="${f##*/}"
61
ln -vsf "$lib_name" "$lib_dir/${lib_name%%-*}.so"
62
done
63
}
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Medium | 2 |
| 2026-10-31 00:07:41 | Medium | 2 |
| 2026-10-30 00:29:30 | Medium | 2 |
| 2026-10-29 00:13:55 | Medium | 2 |
| 2026-10-28 00:06:54 | Medium | 2 |
| 2026-10-27 00:23:28 | Medium | 2 |
| 2026-10-26 00:12:40 | Medium | 2 |
| 2026-10-25 00:20:48 | Medium | 2 |
| 2026-10-24 00:14:55 | Medium | 2 |
| 2026-10-23 00:02:19 | Medium | 2 |
| 2026-10-22 00:13:10 | Medium | 2 |
| 2026-10-21 00:12:50 | Medium | 2 |
| 2026-10-20 00:10:31 | Medium | 2 |
| 2026-10-19 00:03:55 | Medium | 2 |
| 2026-10-18 00:06:55 | Medium | 2 |
| 2026-10-17 00:21:55 | Medium | 2 |
| 2026-10-16 00:12:47 | Medium | 2 |
| 2026-10-15 00:28:05 | Medium | 2 |
| 2026-10-14 00:06:47 | Medium | 2 |
| 2026-10-13 00:23:45 | Medium | 2 |