padctl-git

maintainer bananasjim · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads Zig build tools and a dependency from official project hosts (ziglang.org, github.com) which are not whitelisted but are legitimate; the source is built from a git repository and the downloads are verifiable tooling, not executed binaries.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads Zig build tools and a dependency from official project hosts (ziglang.org, github.com) which are not whitelisted but are legitimate; the source is built from a git repository and the downloads are verifiable tooling, not executed binaries.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 source_x86_64=("zig-${_zig_version}-x86_64-linux.tar.xz::https://ziglang.org/download/${_zig_version}/zig-x86_64-linux-${_zig_version}.tar.xz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: bananasjim <bananasjim1@gmail.com>
    
      2pkgname=padctl-git
    
      3pkgver=r629.gf910518
    
      4pkgrel=1
    
      5pkgdesc="HID gamepad daemon — declarative TOML device config, uinput output"
    
      6arch=('x86_64' 'aarch64')
    
      7url="https://github.com/BANANASJIM/padctl"
    
      8license=('LGPL-2.1-or-later')
    
      9depends=('libusb' 'systemd' 'gcc-libs' 'glibc')
    
      10makedepends=('git')
    
      11provides=('padctl')
    
      12conflicts=('padctl' 'padctl-bin')
    
      13
    
      14_zig_version="0.15.2"
    
      15_zig_toml_rev="24e0deeceaad1b7f1b12027ebae1c65ff1d86e33"
    
      16_zig_toml_hash="toml-0.3.0-bV14BVqIAQANb68hDuVPZ72hrcIhT-fv_fcIbetQIAyg"
    
      17
    
      18source=("git+${url}.git"
    
      19        "zig-toml::https://github.com/sam701/zig-toml/archive/${_zig_toml_rev}.tar.gz")
    
      20source_x86_64=("zig-${_zig_version}-x86_64-linux.tar.xz::https://ziglang.org/download/${_zig_version}/zig-x86_64-linux-${_zig_version}.tar.xz")
    
      21source_aarch64=("zig-${_zig_version}-aarch64-linux.tar.xz::https://ziglang.org/download/${_zig_version}/zig-aarch64-linux-${_zig_version}.tar.xz")
    
      22sha256sums=('SKIP'
    
      23            'SKIP')
    
      24sha256sums_x86_64=('02aa270f183da276e5b5920b1dac44a63f1a49e55050ebde3aecc9eb82f93239')
    
      25sha256sums_aarch64=('958ed7d1e00d0ea76590d27666efbf7a932281b3d7ba0c6b01b0ff26498f667f')
    
      26
    
      27pkgver() {
    
      28    cd padctl
    
      29    printf "r%s.g%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      30}
    
      31
    
      32prepare() {
    
      33    # Seed zig package cache so the build works offline
    
      34    export ZIG_GLOBAL_CACHE_DIR="${srcdir}/zig-cache"
    
      35    mkdir -p "${ZIG_GLOBAL_CACHE_DIR}/p"
    
      36    local _toml_src
    
      37    _toml_src="$(find "${srcdir}" -maxdepth 1 -type d -name 'zig-toml-*' | head -n1)"
    
      38    [ -n "${_toml_src}" ] || {
    
      39        echo "zig-toml source directory not found" >&2
    
      40        return 1
    
      41    }
    
      42    ln -sfn "${_toml_src}" "${ZIG_GLOBAL_CACHE_DIR}/p/${_zig_toml_hash}"
    
      43}
    
      44
    
      45build() {
    
      46    cd padctl
    
      47    export ZIG_GLOBAL_CACHE_DIR="${srcdir}/zig-cache"
    
      48    local _zig_arch
    
      49    case "${CARCH}" in
    
      50        x86_64) _zig_arch="x86_64-linux" ;;
    
      51        aarch64) _zig_arch="aarch64-linux" ;;
    
      52        *) echo "unsupported architecture: ${CARCH}" >&2; return 1 ;;
    
      53    esac
    
      54    "${srcdir}/zig-${_zig_arch}-${_zig_version}/zig" build -Doptimize=ReleaseSafe
    
      55}
    
      56
    
      57package() {
    
      58    cd padctl
    
      59    ./zig-out/bin/padctl install --destdir "$pkgdir" --prefix /usr --no-user-service
    
      60
    
      61    install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      62}
    
      63

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2