p4-fusion-git

maintainer fft · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt p4api binary from a Perforce subdomain, which is plausibly official despite not being on a standard whitelist; the rest is source from GitHub and patches, with no code execution or exfiltration observed.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt p4api binary from a Perforce subdomain, which is plausibly official despite not being on a standard whitelist; the rest is source from GitHub and patches, with no code execution or exfiltration observed.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 "https://filehost.perforce.com/perforce/r25.1/bin.linux26x86_64/p4api-glibc2.12-openssl3.tgz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: fft
    
      2
    
      3pkgname=p4-fusion-git
    
      4pkgver=v1.13.r20.gb36b8b6
    
      5pkgrel=1
    
      6pkgdesc='Perforce to Git conversion tool'
    
      7arch=('x86_64')
    
      8url='https://github.com/salesforce/p4-fusion'
    
      9depends=('libgit2' 'openssl')
    
      10makedepends=('git')
    
      11license=('BSD-3-Clause')
    
      12conflicts=(p4-fusion) # for the future, if anybody else will package it.
    
      13provides=(p4-fusion)
    
      14source=(
    
      15  "${pkgname}::git+https://github.com/salesforce/p4-fusion.git"
    
      16  "https://filehost.perforce.com/perforce/r25.1/bin.linux26x86_64/p4api-glibc2.12-openssl3.tgz"
    
      17   # seems https://www.perforce.com/downloads/perforce/r25.1/bin.linux26x86_64/p4api-glibc2.12-openssl3.tgz
    
      18   # can download archive with old version of p4pai, while cdist2 instead of filehost is also allowed
    
      19  'p1.patch::https://github.com/fftmp-forked/p4-fusion/commit/2e51b94c0baf55ef6b5bbe42cc13c39d61573dff.patch'
    
      20  'p2.patch::https://github.com/fftmp-forked/p4-fusion/commit/4b0d8bb01afeafd06ee412fabc2f753107b8837a.patch'
    
      21  'p3.patch::https://github.com/fftmp-forked/p4-fusion/commit/c95d73496b14c6d9938f3a80473f096942e757ed.patch'
    
      22  'p4.patch::https://github.com/fftmp-forked/p4-fusion/commit/75fd3580202373de9645819a2d0460ab2a4625c6.patch'
    
      23)
    
      24
    
      25b2sums=(
    
      26  'SKIP'
    
      27  '90b3ff1e516cf610b1a51d8b31c91bec9a8b41206a4fac3bc32f4fe5dd9c360ab5638645ad5ef2d258c9edee0021035017ef192d9fe0064b676272f4f6d410a6'
    
      28  '46f04fd4ca25b16ec5b52392ffcfb7b41f97fa7f198fce001f708e6ea6c487ef8796b692050d95d8eb13fb5f03ba03fdd67574a5924d1916f5f4a98e10528338'
    
      29  '59a77eca60cf2293cb728fa777d9d993672c37d0950f64b0d0d7b421aec9f53db47d1a04b9b70226c78b7fc3d63375692bb518d36a050e5847cdbb9cba2a686e'
    
      30  'e5ba4e3a7367e2c7235161c838719e1022e4b2d44562f88a1432c2f6a3a4f31032cfdb60af3f5af4e1c53601832eb88d7dc2f369462ce6c6c7f807c798d01f3a'
    
      31  'a891cdad19aa528e8db583f68eb39679959c1af9725357de386a3145a6f1b8849595e4536b75e20f4d9b989c3765f9da7781fed89edd27be95cc7d814c9b443d'
    
      32)
    
      33
    
      34pkgver() {
    
      35  cd "${pkgname}"
    
      36  git describe --long --tags | sed 's/\([^-]*-g\)/r\1/;s/-/./g'
    
      37}
    
      38
    
      39prepare() {
    
      40  cd "${pkgname}"
    
      41  git clean -fxd
    
      42  git apply "${srcdir}/p1.patch"
    
      43  git apply "${srcdir}/p2.patch"
    
      44  git apply "${srcdir}/p3.patch"
    
      45  git apply "${srcdir}/p4.patch"
    
      46  mkdir -p 'vendor/helix-core-api/linux/'
    
      47  cp -r '../p4api-2025.1.2761706/include/' '../p4api-2025.1.2761706/lib/' './vendor/helix-core-api/linux/'
    
      48}
    
      49
    
      50build() {
    
      51  cd "${pkgname}"
    
      52  cmake ./
    
      53  cmake --build ./
    
      54}
    
      55
    
      56package() {
    
      57  cd "${pkgname}"
    
      58  install -Dm755 'p4-fusion/p4-fusion' "${pkgdir}/usr/bin/p4-fusion"
    
      59  install -Dm644 "${srcdir}/${pkgname}/LICENSE.txt" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.txt"
    
      60}
    
      61

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2