padctl-git

LOW

maintainer bananasjim 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads Zig build tools and a dependency from official project hosts (ziglang.org, github.com) which are not whitelisted but are legitimate; the source is built from a git repository and the downloads are verifiable tooling, not executed binaries.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads Zig build tools and a dependency from official project hosts (ziglang.org, github.com) which are not whitelisted but are legitimate; the source is built from a git repository and the downloads are verifiable tooling, not executed binaries.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 source_x86_64=("zig-${_zig_version}-x86_64-linux.tar.xz::https://ziglang.org/download/${_zig_version}/zig-x86_64-linux-${_zig_version}.tar.xz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: bananasjim <bananasjim1@gmail.com>
    
      2pkgname=padctl-git
    
      3pkgver=r629.gf910518
    
      4pkgrel=1
    
      5pkgdesc="HID gamepad daemon — declarative TOML device config, uinput output"
    
      6arch=('x86_64' 'aarch64')
    
      7url="https://github.com/BANANASJIM/padctl"
    
      8license=('LGPL-2.1-or-later')
    
      9depends=('libusb' 'systemd' 'gcc-libs' 'glibc')
    
      10makedepends=('git')
    
      11provides=('padctl')
    
      12conflicts=('padctl' 'padctl-bin')
    
      13
    
      14_zig_version="0.15.2"
    
      15_zig_toml_rev="24e0deeceaad1b7f1b12027ebae1c65ff1d86e33"
    
      16_zig_toml_hash="toml-0.3.0-bV14BVqIAQANb68hDuVPZ72hrcIhT-fv_fcIbetQIAyg"
    
      17
    
      18source=("git+${url}.git"
    
      19        "zig-toml::https://github.com/sam701/zig-toml/archive/${_zig_toml_rev}.tar.gz")
    
      20source_x86_64=("zig-${_zig_version}-x86_64-linux.tar.xz::https://ziglang.org/download/${_zig_version}/zig-x86_64-linux-${_zig_version}.tar.xz")
    
      21source_aarch64=("zig-${_zig_version}-aarch64-linux.tar.xz::https://ziglang.org/download/${_zig_version}/zig-aarch64-linux-${_zig_version}.tar.xz")
    
      22sha256sums=('SKIP'
    
      23            'SKIP')
    
      24sha256sums_x86_64=('02aa270f183da276e5b5920b1dac44a63f1a49e55050ebde3aecc9eb82f93239')
    
      25sha256sums_aarch64=('958ed7d1e00d0ea76590d27666efbf7a932281b3d7ba0c6b01b0ff26498f667f')
    
      26
    
      27pkgver() {
    
      28    cd padctl
    
      29    printf "r%s.g%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      30}
    
      31
    
      32prepare() {
    
      33    # Seed zig package cache so the build works offline
    
      34    export ZIG_GLOBAL_CACHE_DIR="${srcdir}/zig-cache"
    
      35    mkdir -p "${ZIG_GLOBAL_CACHE_DIR}/p"
    
      36    local _toml_src
    
      37    _toml_src="$(find "${srcdir}" -maxdepth 1 -type d -name 'zig-toml-*' | head -n1)"
    
      38    [ -n "${_toml_src}" ] || {
    
      39        echo "zig-toml source directory not found" >&2
    
      40        return 1
    
      41    }
    
      42    ln -sfn "${_toml_src}" "${ZIG_GLOBAL_CACHE_DIR}/p/${_zig_toml_hash}"
    
      43}
    
      44
    
      45build() {
    
      46    cd padctl
    
      47    export ZIG_GLOBAL_CACHE_DIR="${srcdir}/zig-cache"
    
      48    local _zig_arch
    
      49    case "${CARCH}" in
    
      50        x86_64) _zig_arch="x86_64-linux" ;;
    
      51        aarch64) _zig_arch="aarch64-linux" ;;
    
      52        *) echo "unsupported architecture: ${CARCH}" >&2; return 1 ;;
    
      53    esac
    
      54    "${srcdir}/zig-${_zig_arch}-${_zig_version}/zig" build -Doptimize=ReleaseSafe
    
      55}
    
      56
    
      57package() {
    
      58    cd padctl
    
      59    ./zig-out/bin/padctl install --destdir "$pkgdir" --prefix /usr --no-user-service
    
      60
    
      61    install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      62}
    
      63

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2