p4-fusion-git
LOW
maintainer fft
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a prebuilt p4api binary from a Perforce subdomain, which is plausibly official despite not being on a standard whitelist; the rest is source from GitHub and patches, with no code execution or exfiltration observed.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt p4api binary from a Perforce subdomain, which is plausibly official despite not being on a standard whitelist; the rest is source from GitHub and patches, with no code execution or exfiltration observed.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:16
"https://filehost.perforce.com/perforce/r25.1/bin.linux26x86_64/p4api-glibc2.12-openssl3.tgz"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: fft
2
3
pkgname=p4-fusion-git
4
pkgver=v1.13.r20.gb36b8b6
5
pkgrel=1
6
pkgdesc='Perforce to Git conversion tool'
7
arch=('x86_64')
8
url='https://github.com/salesforce/p4-fusion'
9
depends=('libgit2' 'openssl')
10
makedepends=('git')
11
license=('BSD-3-Clause')
12
conflicts=(p4-fusion) # for the future, if anybody else will package it.
13
provides=(p4-fusion)
14
source=(
15
"${pkgname}::git+https://github.com/salesforce/p4-fusion.git"
16
"https://filehost.perforce.com/perforce/r25.1/bin.linux26x86_64/p4api-glibc2.12-openssl3.tgz"
17
# seems https://www.perforce.com/downloads/perforce/r25.1/bin.linux26x86_64/p4api-glibc2.12-openssl3.tgz
18
# can download archive with old version of p4pai, while cdist2 instead of filehost is also allowed
19
'p1.patch::https://github.com/fftmp-forked/p4-fusion/commit/2e51b94c0baf55ef6b5bbe42cc13c39d61573dff.patch'
20
'p2.patch::https://github.com/fftmp-forked/p4-fusion/commit/4b0d8bb01afeafd06ee412fabc2f753107b8837a.patch'
21
'p3.patch::https://github.com/fftmp-forked/p4-fusion/commit/c95d73496b14c6d9938f3a80473f096942e757ed.patch'
22
'p4.patch::https://github.com/fftmp-forked/p4-fusion/commit/75fd3580202373de9645819a2d0460ab2a4625c6.patch'
23
)
24
25
b2sums=(
26
'SKIP'
27
'90b3ff1e516cf610b1a51d8b31c91bec9a8b41206a4fac3bc32f4fe5dd9c360ab5638645ad5ef2d258c9edee0021035017ef192d9fe0064b676272f4f6d410a6'
28
'46f04fd4ca25b16ec5b52392ffcfb7b41f97fa7f198fce001f708e6ea6c487ef8796b692050d95d8eb13fb5f03ba03fdd67574a5924d1916f5f4a98e10528338'
29
'59a77eca60cf2293cb728fa777d9d993672c37d0950f64b0d0d7b421aec9f53db47d1a04b9b70226c78b7fc3d63375692bb518d36a050e5847cdbb9cba2a686e'
30
'e5ba4e3a7367e2c7235161c838719e1022e4b2d44562f88a1432c2f6a3a4f31032cfdb60af3f5af4e1c53601832eb88d7dc2f369462ce6c6c7f807c798d01f3a'
31
'a891cdad19aa528e8db583f68eb39679959c1af9725357de386a3145a6f1b8849595e4536b75e20f4d9b989c3765f9da7781fed89edd27be95cc7d814c9b443d'
32
)
33
34
pkgver() {
35
cd "${pkgname}"
36
git describe --long --tags | sed 's/\([^-]*-g\)/r\1/;s/-/./g'
37
}
38
39
prepare() {
40
cd "${pkgname}"
41
git clean -fxd
42
git apply "${srcdir}/p1.patch"
43
git apply "${srcdir}/p2.patch"
44
git apply "${srcdir}/p3.patch"
45
git apply "${srcdir}/p4.patch"
46
mkdir -p 'vendor/helix-core-api/linux/'
47
cp -r '../p4api-2025.1.2761706/include/' '../p4api-2025.1.2761706/lib/' './vendor/helix-core-api/linux/'
48
}
49
50
build() {
51
cd "${pkgname}"
52
cmake ./
53
cmake --build ./
54
}
55
56
package() {
57
cd "${pkgname}"
58
install -Dm755 'p4-fusion/p4-fusion' "${pkgdir}/usr/bin/p4-fusion"
59
install -Dm644 "${srcdir}/${pkgname}/LICENSE.txt" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.txt"
60
}
61
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |