libfprint-fpcmoh-git

maintainer xuwd1 · 5 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt proprietary binary (libfpcbep.so) from a Lenovo support server (download.lenovo.com) inside a ZIP archive (r1slm01w.zip). The binary is then installed into /usr/lib and linked into libfprint-2.so via patchelf. While download.lenovo.com is a legitimate Lenovo CDN/support host, the binary itself is a closed-source proprietary shared library with no source verification beyond a single SHA256 checksum (and notably the git source is SKIP). The library is executed in userspace as part of the fingerprint authentication stack, meaning a compromised or malicious version would have significant impact. The SHA256 for the zip is present but the git source checksum is skipped. The core concern is a prebuilt binary from a vendor CDN being installed as a system library — this is a real supply-chain concern (the file could be silently replaced on Lenovo's servers, or the specific zip could contain a different version than expected), though there is no evidence of active malice. This fits the medium category: an executed binary/library from a non-standard (non-distro, non-language-ecosystem) host.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 "fpcbep.zip::https://download.lenovo.com/pccbbs/mobiles/r1slm01w.zip"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): This PKGBUILD downloads a prebuilt proprietary binary (libfpcbep.so) from a Lenovo support server (download.lenovo.com) inside a ZIP archive (r1slm01w.zip). The binary is then installed into /usr/lib and linked into libfprint-2.so via patchelf. While download.lenovo.com is a legitimate Lenovo CDN/support host, the binary itself is a closed-source proprietary shared library with no source verification beyond a single SHA256 checksum (and notably the git source is SKIP). The library is executed in userspace as part of the fingerprint authentication stack, meaning a compromised or malicious version would have significant impact. The SHA256 for the zip is present but the git source checksum is skipped. The core concern is a prebuilt binary from a vendor CDN being installed as a system library — this is a real supply-chain concern (the file could be silently replaced on Lenovo's servers, or the specific zip could contain a different version than expected), though there is no evidence of active malice. This fits the medium category: an executed binary/library from a non-standard (non-distro, non-language-ecosystem) host.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=libfprint-fpcmoh-git
    
      2_pkgname=libfprint
    
      3pkgrel=1
    
      4pkgver=1.94.6
    
      5pkgdesc="libfprint with proprietary FPC match on host device 10a5:9800 driver"
    
      6url="https://fprint.freedesktop.org/"
    
      7arch=(x86_64)
    
      8license=(LGPL)
    
      9depends=(libgusb pixman nss systemd-libs)
    
      10makedepends=(git meson gtk-doc gobject-introspection systemd patchelf)
    
      11provides=("libfprint=$pkgver" libfprint-2.so libfpcbep.so)
    
      12conflicts=(libfprint)
    
      13groups=(fprint)
    
      14source=(
    
      15    "git+https://gitlab.freedesktop.org/libfprint/libfprint.git#tag=v1.94.6"
    
      16    "fpcbep.zip::https://download.lenovo.com/pccbbs/mobiles/r1slm01w.zip"
    
      17    "https://gitlab.freedesktop.org/libfprint/libfprint/-/merge_requests/396.patch")
    
      18sha256sums=(
    
      19    'SKIP'
    
      20    'c7290f2a70d48f7bdd09bee985534d3511ec00d091887b07f81cf1e08f74c145'
    
      21    'SKIP')
    
      22
    
      23#pkgver() {
    
      24#    cd $_pkgname
    
      25#    git describe --tags | sed 's/^V_\|^v//;s/_/./g;s/-/.r/;s/-/./'
    
      26#}
    
      27
    
      28prepare() {
    
      29    libfpcbep_path=$(find . -name 'libfpcbep.so')
    
      30    cp -f $libfpcbep_path $_pkgname
    
      31    cd $_pkgname
    
      32    git apply $srcdir/396.patch
    
      33    # patch meson.build
    
      34    # use '+' as sed delimiter 
    
      35    sed -ibak "s+find_library[(]'fpcbep', required: true[)]+find_library('fpcbep', required: true, dirs: \'$(pwd)\')+g" ./meson.build
    
      36}
    
      37
    
      38# We do not perform any checks here as the python scripts can be buggy
    
      39
    
      40build() {
    
      41    arch-meson $_pkgname build
    
      42    meson compile -C build
    
      43}
    
      44
    
      45
    
      46package() {
    
      47    DESTDIR="$pkgdir" meson install -C build
    
      48    install -D $srcdir/$_pkgname/libfpcbep.so $pkgdir/usr/lib/libfpcbep.so
    
      49    install -Dm644 $srcdir/FPC_driver_linux_libfprint/install_libfprint/lib/udev/rules.d/60-libfprint-2-device-fpc.rules \
    
      50        $pkgdir/usr/lib/udev/rules.d/60-libfprint-2-device-fpc.rules
    
      51    cd $pkgdir/usr/lib
    
      52    libfpcbep_needed=$(ldd libfprint-2.so | grep libfpcbep | sed 's/[(].*[)]//g')
    
      53    patchelf --replace-needed $libfpcbep_needed libfpcbep.so libfprint-2.so
    
      54}
    
      55

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2