libfprint-00a2

LOW

maintainer aurel1510 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The non-standard host is download.lenovo.com (Lenovo's official download server), which is a legitimate vendor domain; the .exe is extracted with innoextract to pull vendor firmware data and a license file, not executed directly, and its checksum is pinned. The git source has SKIP but is from the maintainer's own Codeberg repo matching the declared project URL. No obfuscation, exfiltration, or remote code execution is present.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 85%): The non-standard host is download.lenovo.com (Lenovo's official download server), which is a legitimate vendor domain; the .exe is extracted with innoextract to pull vendor firmware data and a license file, not executed directly, and its checksum is pinned. The git source has SKIP but is from the maintainer's own Codeberg repo matching the declared project URL. No obfuscation, exfiltration, or remote code execution is present.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:26 "https://download.lenovo.com/pccbbs/mobiles/r0yfp10w.exe")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Aurel Farkasovsky <aurel1510+aur at gmail dot com>
    
      2#
    
      3# libfprint with the "validity" driver for the Synaptics 06cb:00a2 fingerprint
    
      4# sensor (ThinkPad E480, E580, R480, E490, E590, R490, R590).
    
      5#
    
      6# The driver needs vendor data that cannot be redistributed. It is extracted
    
      7# at build time from Lenovo's driver package, which is downloaded from Lenovo.
    
      8# The vendor data is under the Synaptics license in SynaEula.rtf.
    
      9
    
      10pkgname=libfprint-00a2
    
      11_pkgver=1.94.100
    
      12_commit=5d48ca4059ba9a2925600123e81940e0f63e542e
    
      13pkgver=1.94.100.r12.g5d48ca4
    
      14pkgrel=1
    
      15pkgdesc="libfprint for fprintd with a driver for the Synaptics/Validity 06cb:00a2 fingerprint sensor (ThinkPad E480, E580, R480, E490, E590, R490, R590)"
    
      16url="https://codeberg.org/aurel1510/libfprint-00a2"
    
      17_repo="https://codeberg.org/aurel1510/libfprint-00a2.git"
    
      18arch=(x86_64)
    
      19license=(LGPL-2.1-or-later MIT LicenseRef-Synaptics-EULA)
    
      20depends=(glib2 glibc libgcc libgudev libgusb openssl pixman)
    
      21makedepends=(git gobject-introspection innoextract meson python)
    
      22checkdepends=(python-cairo python-gobject umockdev)
    
      23provides=("libfprint=$_pkgver" libfprint-2.so)
    
      24conflicts=(libfprint)
    
      25source=("libfprint::git+$_repo#commit=$_commit"
    
      26        "https://download.lenovo.com/pccbbs/mobiles/r0yfp10w.exe")
    
      27sha256sums=('SKIP'
    
      28            '760c405f4f173abdf196cf1a3011f7147dea88c2177855f768efdeea254866bf')
    
      29noextract=(r0yfp10w.exe)
    
      30
    
      31prepare() {
    
      32  python libfprint/scripts/validity-extract-vendor-data.py \
    
      33    --installer r0yfp10w.exe --destdir vendor-data
    
      34  innoextract --silent --include SynaEula.rtf --output-dir eula r0yfp10w.exe
    
      35}
    
      36
    
      37build() {
    
      38  arch-meson libfprint build -D doc=false -D gtk-examples=false -D installed-tests=false
    
      39  meson compile -C build
    
      40}
    
      41
    
      42check() {
    
      43  # Serially, because the upstream egis_etu905 replay test is timing
    
      44  # sensitive and fails intermittently under parallel load.
    
      45  FP_VALIDITY_DATA_DIR="$srcdir/vendor-data" \
    
      46    meson test -C build --print-errorlogs --num-processes 1
    
      47}
    
      48
    
      49package() {
    
      50  meson install -C build --destdir "$pkgdir"
    
      51
    
      52  install -d "$pkgdir/usr/share/libfprint-2/validity"
    
      53  cp -r --no-preserve=ownership vendor-data/06cb-00a2 "$pkgdir/usr/share/libfprint-2/validity/"
    
      54
    
      55  install -Dm644 libfprint/libfprint/drivers/validity/LICENSE.python-validity \
    
      56    "$pkgdir/usr/share/licenses/$pkgname/LICENSE.python-validity"
    
      57  install -Dm644 "$(find eula -name SynaEula.rtf)" \
    
      58    "$pkgdir/usr/share/licenses/$pkgname/SynaEula.rtf"
    
      59  install -Dm644 libfprint/libfprint/drivers/validity/README.md \
    
      60    "$pkgdir/usr/share/doc/$pkgname/README.validity.md"
    
      61}
    
      62

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	3
2026-10-16 00:12:47	Low	3
2026-10-15 00:28:05	Low	3
2026-10-14 09:33:59	Low	3
2026-10-14 09:19:50	Medium	2