picotool-git

maintainer j-stach · 6 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from the project's official GitHub repositories; skipped checksums are common for git sources and do not imply remote code execution, as the build uses publicly verifiable source commits.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from the project's official GitHub repositories; skipped checksums are common for git sources and do not imply remote code execution, as the build uses publicly verifiable source commits.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1
    
      2# Maintainer: j-stach (https://github.com/j-stach)
    
      3
    
      4pkgname=picotool-git
    
      5pkgver=r224.282a3ca
    
      6pkgrel=1
    
      7pkgdesc="Tool for working with RP2040/RP2350 binaries, and interacting with RP2040/RP2350 devices when they are in BOOTSEL mode."
    
      8arch=('x86_64')
    
      9url="https://github.com/raspberrypi/picotool"
    
      10license=('BSD-3-Clause')
    
      11depends=('gcc-libs' 'libusb')
    
      12makedepends=('git' 'cmake')
    
      13provides=('picotool')
    
      14conflicts=('picotool')
    
      15
    
      16source=(
    
      17  "git+https://github.com/raspberrypi/picotool.git"
    
      18  "git+https://github.com/raspberrypi/pico-sdk.git"
    
      19)
    
      20
    
      21sha512sums=(
    
      22  'SKIP'
    
      23  'SKIP'
    
      24)
    
      25
    
      26
    
      27pkgver() {
    
      28  cd "$srcdir/picotool"
    
      29
    
      30  ( set -o pipefail
    
      31    git describe --long 2>/dev/null | sed 's/\([^-]*-g\)/r\1/;s/-/./g' ||
    
      32    printf \
    
      33      "r%s.%s" \
    
      34      "$(git rev-list --count HEAD)" \
    
      35      "$(git rev-parse --short HEAD)"
    
      36  )
    
      37}
    
      38
    
      39build() {
    
      40  cd "$srcdir/picotool"
    
      41
    
      42  cmake \
    
      43        -B build \
    
      44        -S . \
    
      45        -DCMAKE_BUILD_TYPE=Release \
    
      46        -DCMAKE_INSTALL_PREFIX=/usr \
    
      47        -DPICO_SDK_PATH="$srcdir/pico-sdk"
    
      48
    
      49  cmake --build build --parallel
    
      50}
    
      51
    
      52package() {
    
      53  cd "$srcdir/picotool"
    
      54
    
      55  DESTDIR="$pkgdir" cmake --install build
    
      56
    
      57  install -Dm644 LICENSE.TXT "$pkgdir/usr/share/licenses/$pkgname/LICENSE.TXT"
    
      58
    
      59  install -Dm644 udev/60-picotool.rules \
    
      60    "$pkgdir/usr/lib/udev/rules.d/60-picotool.rules"
    
      61}
    
      62
    
      63

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,46 +1,63 @@
-# Maintainer: Jack Chen <redchenjs@live.com>
+
+# Maintainer: j-stach (https://github.com/j-stach)
 
 pkgname=picotool-git
-pkgver=r47.f6fe6b7
+pkgver=r224.282a3ca
 pkgrel=1
-pkgdesc="Tool for interacting with a RP2040 device in BOOTSEL mode, or with a RP2040 binary"
+pkgdesc="Tool for working with RP2040/RP2350 binaries, and interacting with RP2040/RP2350 devices when they are in BOOTSEL mode."
 arch=('x86_64')
 url="https://github.com/raspberrypi/picotool"
-license=('MIT')
+license=('BSD-3-Clause')
 depends=('gcc-libs' 'libusb')
 makedepends=('git' 'cmake')
 provides=('picotool')
 conflicts=('picotool')
+
 source=(
   "git+https://github.com/raspberrypi/picotool.git"
   "git+https://github.com/raspberrypi/pico-sdk.git"
 )
+
 sha512sums=(
   'SKIP'
   'SKIP'
 )
+
 
 pkgver() {
   cd "$srcdir/picotool"
 
   ( set -o pipefail
     git describe --long 2>/dev/null | sed 's/\([^-]*-g\)/r\1/;s/-/./g' ||
-    printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
+    printf \
+      "r%s.%s" \
+      "$(git rev-list --count HEAD)" \
+      "$(git rev-parse --short HEAD)"
   )
 }
 
 build() {
   cd "$srcdir/picotool"
 
-  mkdir -p build && cd build
-  PICO_SDK_PATH="$srcdir/pico-sdk" cmake ..
-  make
+  cmake \
+        -B build \
+        -S . \
+        -DCMAKE_BUILD_TYPE=Release \
+        -DCMAKE_INSTALL_PREFIX=/usr \
+        -DPICO_SDK_PATH="$srcdir/pico-sdk"
+
+  cmake --build build --parallel
 }
 
 package() {
   cd "$srcdir/picotool"
 
-  install -Dm755 build/picotool "$pkgdir/usr/bin/picotool"
-  install -Dm644 clipp/LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
+  DESTDIR="$pkgdir" cmake --install build
+
+  install -Dm644 LICENSE.TXT "$pkgdir/usr/share/licenses/$pkgname/LICENSE.TXT"
+
+  install -Dm644 udev/60-picotool.rules \
+    "$pkgdir/usr/lib/udev/rules.d/60-picotool.rules"
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 19:52:44	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0