pixelflasher
maintainer yochananmarqos
· 6 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The non-standard host is git+https://android.googlesource.com, which is Google's official source repository for Android; cloning source code from an official project repository is normal and safe, and the downloaded content is used only to regenerate protocol buffer files, not executed.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The non-standard host is git+https://android.googlesource.com, which is Google's official source repository for Android; cloning source code from an official project repository is normal and safe, and the downloaded content is used only to regenerate protocol buffer files, not executed.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:38
'git+https://android.googlesource.com/platform/system/update_engine.git'
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Mark Wagie <mark dot wagie at proton dot me>
2
pkgname=pixelflasher
3
pkgver=9.1.5.0
4
pkgrel=1
5
pkgdesc="Pixel phone flashing GUI utility with features."
6
arch=('any')
7
url="https://github.com/badabing2005/PixelFlasher"
8
license=('GPL-3.0-or-later')
9
depends=(
10
'hicolor-icon-theme'
11
'python-beautifulsoup4'
12
'python-bsdiff4'
13
'python-chardet'
14
'python-cryptography'
15
'python-darkdetect'
16
'python-json5'
17
'python-lz4'
18
'python-markdown'
19
'python-packaging'
20
'python-platformdirs'
21
'python-polib'
22
'python-protobuf'
23
'python-psutil'
24
'python-pyperclip'
25
'python-requests'
26
'python-rsa'
27
'python-wxpython'
28
'xdg-utils'
29
)
30
makedepends=('git')
31
optdepends=(
32
'android-tools: Use system platform tools'
33
'libnotify: Display system toast notifications'
34
'scrcpy: Launch Screen Copy'
35
)
36
options=('!strip')
37
source=("PixelFlasher-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz"
38
'git+https://android.googlesource.com/platform/system/update_engine.git'
39
'PixelFlasher.desktop')
40
sha256sums=('8d8050864c7109467ab1b84eb047e80f50ea1b4ff1fdff71da69909c1d28b497'
41
'SKIP'
42
'dbb31a1b359bdda2d6501ccf5d80fb888508619da948c3f98d4b0cb74f907615')
43
44
prepare() {
45
46
# Regenerate protos
47
protoc --proto_path=update_engine --python_out=. update_metadata.proto
48
cp -vf update_metadata_pb2.py "PixelFlasher-$pkgver/update_metadata_pb2.py"
49
}
50
51
build() {
52
cd "PixelFlasher-$pkgver"
53
python compile_po.py
54
}
55
56
package() {
57
cd "PixelFlasher-$pkgver"
58
install -Dm755 bin/* -t "$pkgdir/opt/$pkgname/bin/"
59
rm "$pkgdir/opt/$pkgname/bin"/7z{.dll,.exe}
60
61
for f in *.py *.json *.pem *.crt; do
62
install -m644 "${f}" -t "$pkgdir/opt/$pkgname/"
63
done
64
65
install -Dm644 images/*.png -t "$pkgdir/opt/$pkgname/images/"
66
install -Dm644 images/pif/*.png -t "$pkgdir/opt/$pkgname/images/pif/"
67
68
chmod +x "$pkgdir/opt/$pkgname/PixelFlasher.py"
69
install -d "$pkgdir/usr/bin"
70
ln -s "/opt/$pkgname/PixelFlasher.py" "$pkgdir/usr/bin/PixelFlasher"
71
72
for i in 64 128 256; do
73
install -Dm644 "images/icon-dark-${i}.png" \
74
"$pkgdir/usr/share/icons/hicolor/${i}x${i}/apps/$pkgname.png"
75
done
76
77
pushd locale
78
for lang in $(ls -d */); do
79
install -Dm644 "${lang%%/}/LC_MESSAGES/$pkgname.mo" -t \
80
"$pkgdir/opt/$pkgname/locale/${lang%%/}/LC_MESSAGES/"
81
done
82
popd
83
84
install -Dm644 "$srcdir/PixelFlasher.desktop" -t "$pkgdir/usr/share/applications/"
85
86
# Compile Python bytecode
87
python -m compileall -d / "$pkgdir/opt/$pkgname"
88
python -O -m compileall -d / "$pkgdir/opt/$pkgname"
89
}
90
Changes since previous scan
--- PKGBUILD @ 2026-07-16 00:05+++ PKGBUILD @ 2026-08-03 00:08@@ -1,6 +1,6 @@ # Maintainer: Mark Wagie <mark dot wagie at proton dot me> pkgname=pixelflasher-pkgver=9.1.4.0+pkgver=9.1.5.0 pkgrel=1 pkgdesc="Pixel phone flashing GUI utility with features." arch=('any')@@ -37,7 +37,7 @@ source=("PixelFlasher-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz" 'git+https://android.googlesource.com/platform/system/update_engine.git' 'PixelFlasher.desktop')-sha256sums=('f99ffd8c37e832d0682729dab27c50a6d47548210860185bba5145d54d03e4ab'+sha256sums=('8d8050864c7109467ab1b84eb047e80f50ea1b4ff1fdff71da69909c1d28b497' 'SKIP' 'dbb31a1b359bdda2d6501ccf5d80fb888508619da948c3f98d4b0cb74f907615') Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |
| 2026-07-17 00:06:16 | LOW | 2 |
| 2026-07-16 17:52:43 | MEDIUM | 1 |
| 2026-07-16 00:05:41 | LOW | 2 |