nfcx

LOW

maintainer yangtsesu 0 votes scanned 2026-09-18 05:27:27.961366

View on AUR

Why flagged

The package builds from verified upstream sources and includes proper checksums; the flagged variable-named package install refers to internal toolchain use of Go modules, which is standard for the build and does not introduce untrusted external code.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from verified upstream sources and includes proper checksums; the flagged variable-named package install refers to internal toolchain use of Go modules, which is standard for the build and does not introduce untrusted external code.

PKGBUILD:84 GOFLAGS= go install "github.com/wailsapp/wails/v2/cmd/wails@v$_wails_version"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Yangtse Su <yangtsesu at gmail dot com>
    
      2# Upstream: https://github.com/BennyThink/NFCX
    
      3#
    
      4# NFCX does not use a system libnfc: it links and ships a private libnfc 1.8.0
    
      5# built with the pn532_uart driver only (the sole validated driver), plus
    
      6# mfoc/mfcuk/mfoc-hardnested and nfc-mfsetuid built against that same private
    
      7# libnfc. The application resolves its runtime relative to its own executable
    
      8# (runtime/linux-amd64, rpath $ORIGIN/runtime/linux-amd64), so the runtime is
    
      9# installed under /usr/lib/nfcx next to the binary (/usr/lib/nfcx/nfcx, with
    
      10# /usr/bin/nfcx symlinked to it) and the manifest of that directory is
    
      11# hash-verified by the built-in self-check.
    
      12#
    
      13# license covers the NFCX source only. The redistribution terms of the bundled
    
      14# LGPL/GPL/BSD engines are met by shipping their license texts, which land in
    
      15# /usr/share/licenses/nfcx/runtime/ and inside the runtime directory itself.
    
      16#
    
      17# The bundled third-party sources are pinned twice: by the sha256sums below and
    
      18# by third_party/*/*.lock, which the upstream toolchain scripts re-verify while
    
      19# building.
    
      20#
    
      21# build() needs network access for two dependency fetches that upstream does
    
      22# not vendor: `npm ci` for the Vite/TypeScript frontend and the Go module
    
      23# download for the Wails CLI and the application itself. Architecture support
    
      24# follows scripts/toolchain/platform.sh, which handles Linux x86_64 only.
    
      25
    
      26pkgname=nfcx
    
      27pkgver=1.0.1
    
      28pkgrel=2
    
      29pkgdesc='NFC workbench for PN532 readers: reader discovery, MIFARE Classic reads, dumps, and key recovery'
    
      30arch=('x86_64')
    
      31url='https://nfcx.tools'
    
      32license=('MIT')
    
      33# One entry per library the packaged ELF files need directly: gtk3 and
    
      34# webkit2gtk-4.1 for the GUI shell, their direct leaf providers, xz for
    
      35# mfoc-hardnested. libnfc.so.6 resolves inside the private runtime.
    
      36depends=('glibc' 'gtk3' 'webkit2gtk-4.1' 'at-spi2-core' 'cairo' 'gdk-pixbuf2' 'glib2' 'harfbuzz' 'libsoup3' 'pango' 'xz' 'zlib')
    
      37makedepends=('go' 'nodejs' 'npm' 'pkgconf' 'autoconf' 'automake' 'libtool' 'patchelf' 'xz' 'curl')
    
      38# Every bundled engine is already stripped with `strip --strip-unneeded` after
    
      39# being compiled with -g0, and runtime/linux-amd64/manifest.json pins the
    
      40# SHA-256 of each of those files. Re-stripping them in fakeroot would break the
    
      41# self-check, so the package ships the upstream-built binaries verbatim.
    
      42options=('!strip')
    
      43_nfcx_commit='b4dbbcd7bc0ef64b25ba280732cb479586264e44'
    
      44_wails_version='2.15.0'
    
      45_libnfc_version='1.8.0'
    
      46_mfoc_version='0.10.7'
    
      47_mfcuk_version='0.3.8'
    
      48_hardnested_commit='a6007437405a0f18642a4bbca2eeba67c623d736'
    
      49source=(
    
      50  "$pkgname-$pkgver.tar.gz::https://github.com/BennyThink/NFCX/archive/refs/tags/v$pkgver.tar.gz"
    
      51  "libnfc-$_libnfc_version.tar.bz2::https://github.com/nfc-tools/libnfc/releases/download/libnfc-$_libnfc_version/libnfc-$_libnfc_version.tar.bz2"
    
      52  "mfoc-$_mfoc_version.tar.gz::https://github.com/nfc-tools/mfoc/archive/refs/tags/mfoc-$_mfoc_version.tar.gz"
    
      53  "mfcuk-$_mfcuk_version.tar.gz::https://github.com/nfc-tools/mfcuk/archive/refs/tags/mfcuk-$_mfcuk_version.tar.gz"
    
      54  "mfoc-hardnested-$_hardnested_commit.tar.gz::https://github.com/nfc-tools/mfoc-hardnested/archive/$_hardnested_commit.tar.gz"
    
      55)
    
      56sha256sums=(
    
      57  '74570b61012d51757c57b0c65af7d60f1c7110fd92c3cf7ec042f65f0a551219'
    
      58  '6d9ad31c86408711f0a60f05b1933101c7497683c2e0d8917d1611a3feba3dd5'
    
      59  '2dfd8ffa4a8b357807680d190a91c8cf3db54b4211a781edc1108af401dbaad7'
    
      60  'c7091d1a16b132e1a4917ebc705065b60f3d1a0b449a776411ba39612a62ee89'
    
      61  'cc2f631828175c0c0e624572f83b74ee5e010ffbc9591d790433c8e5938969ea'
    
      62)
    
      63
    
      64build() {
    
      65  cd "NFCX-$pkgver"
    
      66
    
      67  local sdk="$PWD/build/toolchain/linux-amd64/sdk" runtime="$PWD/runtime/linux-amd64" ldflags
    
      68
    
      69  export GOBIN="$srcdir/wails-bin"
    
      70  export CGO_ENABLED=1
    
      71  export NFCX_LIBNFC_SDK_DIR="$sdk"
    
      72  export NFCX_RUNTIME_DIR="$runtime"
    
      73  export PKG_CONFIG_PATH="$sdk/lib/pkgconfig"
    
      74  export LD_LIBRARY_PATH="$runtime"
    
      75  export PATH="$runtime:$PATH"
    
      76  # The toolchain scripts accept the pinned archives from source=() instead of
    
      77  # downloading their own copies, and verify them against their lock files.
    
      78  export NFCX_LIBNFC_ARCHIVE="$srcdir/libnfc-$_libnfc_version.tar.bz2"
    
      79  export NFCX_MFOC_ARCHIVE="$srcdir/mfoc-$_mfoc_version.tar.gz"
    
      80  export NFCX_MFCUK_ARCHIVE="$srcdir/mfcuk-$_mfcuk_version.tar.gz"
    
      81  export NFCX_HARDNESTED_ARCHIVE="$srcdir/mfoc-hardnested-$_hardnested_commit.tar.gz"
    
      82
    
      83  # Wails CLI pinned to the version go.mod requires.
    
      84  GOFLAGS= go install "github.com/wailsapp/wails/v2/cmd/wails@v$_wails_version"
    
      85  npm ci --prefix frontend
    
      86  "$GOBIN/wails" generate module
    
      87  (cd frontend && npm run build)
    
      88
    
      89  # Private native runtime: libnfc SDK + pn532_uart driver, nfc-mfsetuid, and
    
      90  # the three recovery engines linked against that SDK. One goal per make
    
      91  # call: makepkg exports MAKEFLAGS=-j<n>, and make would otherwise verify and
    
      92  # smoke-test libnfc before it is built.
    
      93  make libnfc-build
    
      94  make libnfc-verify
    
      95  make libnfc-smoke
    
      96  make mfoc-build
    
      97  make mfcuk-build
    
      98  make hardnested-build
    
      99
    
      100  # Version metadata: wails.json feeds the About dialog, the linker flags feed
    
      101  # the build info reported by the self-check.
    
      102  go run ./cmd/nfcx-release set-version -file wails.json -version "$pkgver"
    
      103  ldflags="-X github.com/BennyThink/NFCX/internal/buildinfo.Version=$pkgver"
    
      104  ldflags+=" -X github.com/BennyThink/NFCX/internal/buildinfo.Commit=$_nfcx_commit"
    
      105  ldflags+=" -X github.com/BennyThink/NFCX/internal/buildinfo.BuildDate=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
    
      106  ldflags+=" -X github.com/BennyThink/NFCX/internal/buildinfo.Dirty=false"
    
      107
    
      108  # -s: the frontend and its bindings were built above, so the Wails CLI must
    
      109  # not run npm again. The Makefile's `build` target is this same invocation
    
      110  # without -s, followed by scripts/package-runtime.sh.
    
      111  "$GOBIN/wails" build -s -trimpath -tags 'libnfc,webkit2_41' -ldflags "$ldflags"
    
      112  ./scripts/package-runtime.sh
    
      113
    
      114  runtime="$PWD/build/bin/NFCX-linux-amd64/runtime/linux-amd64"
    
      115  ./scripts/release/collect-go-licenses.sh "$runtime/LICENSES/go"
    
      116  go run ./cmd/nfcx-release manifest -repository "$PWD" -root "$runtime" \
    
      117    -output "$runtime/manifest.json" -platform linux-amd64 -version "$pkgver" -commit "$_nfcx_commit"
    
      118  go run ./cmd/nfcx-release verify -root "$runtime"
    
      119  go run ./cmd/nfcx-release scan-paths -root "$PWD/build/bin/NFCX-linux-amd64" -needle "$PWD"
    
      120}
    
      121
    
      122check() {
    
      123  cd "NFCX-$pkgver"
    
      124
    
      125  export CGO_ENABLED=1
    
      126  export NFCX_LIBNFC_SDK_DIR="$PWD/build/toolchain/linux-amd64/sdk"
    
      127  export NFCX_RUNTIME_DIR="$PWD/runtime/linux-amd64"
    
      128  export PKG_CONFIG_PATH="$NFCX_LIBNFC_SDK_DIR/lib/pkgconfig"
    
      129  export LD_LIBRARY_PATH="$NFCX_RUNTIME_DIR"
    
      130  export PATH="$NFCX_RUNTIME_DIR:$PATH"
    
      131
    
      132  # Full Go suite against the freshly built private libnfc bindings.
    
      133  make libnfc-binding-test
    
      134}
    
      135
    
      136package() {
    
      137  cd "NFCX-$pkgver"
    
      138
    
      139  install -d "$pkgdir/usr/lib/nfcx" \
    
      140    "$pkgdir/usr/bin" \
    
      141    "$pkgdir/usr/share/applications" \
    
      142    "$pkgdir/usr/share/icons/hicolor/512x512/apps" \
    
      143    "$pkgdir/usr/share/licenses/nfcx"
    
      144
    
      145  # NFCX plus the runtime it resolves relative to itself. The manifest is
    
      146  # hashed over exactly this tree, symlinked libnfc.so* included. Upstream
    
      147  # names the executable NFCX (its product name, as in the AppImage); the
    
      148  # package installs it lowercase, which is what the Arch naming conventions
    
      149  # expect and what makes the GTK/Wayland application id line up with
    
      150  # nfcx.desktop.
    
      151  cp -a build/bin/NFCX-linux-amd64/. "$pkgdir/usr/lib/nfcx/"
    
      152  mv "$pkgdir/usr/lib/nfcx/NFCX" "$pkgdir/usr/lib/nfcx/nfcx"
    
      153  ln -s /usr/lib/nfcx/nfcx "$pkgdir/usr/bin/nfcx"
    
      154
    
      155  sed -e 's|^Exec=.*|Exec=nfcx|' -e 's|^Icon=.*|Icon=nfcx|' \
    
      156    build/linux/NFCX.desktop > "$pkgdir/usr/share/applications/nfcx.desktop"
    
      157  # Upstream ships a single 1024x1024 icon; hicolor has no native 1024 slot, so
    
      158  # it lands in 512x512 and toolkits scale it down.
    
      159  install -Dm644 build/appicon.png "$pkgdir/usr/share/icons/hicolor/512x512/apps/nfcx.png"
    
      160
    
      161  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/nfcx/LICENSE"
    
      162  install -Dm644 THIRD_PARTY_NOTICES.md "$pkgdir/usr/share/licenses/nfcx/THIRD_PARTY_NOTICES.md"
    
      163  cp -a runtime/linux-amd64/LICENSES "$pkgdir/usr/share/licenses/nfcx/runtime"
    
      164}
    
      165

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-18 05:27:27	Low	2