pixelflasher
LOW
maintainer yochananmarqos
6 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The non-standard host is a legitimate project source (android.googlesource.com) used to fetch update_engine for regenerating protos; this is a normal part of building the project from source and not a supply-chain risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The non-standard host is a legitimate project source (android.googlesource.com) used to fetch update_engine for regenerating protos; this is a normal part of building the project from source and not a supply-chain risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:39
'git+https://android.googlesource.com/platform/system/update_engine.git'
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Mark Wagie <mark dot wagie at proton dot me>
2
pkgname=pixelflasher
3
pkgver=10.2.0.0
4
pkgrel=1
5
pkgdesc="Pixel phone flashing GUI utility with features."
6
arch=('any')
7
url="https://github.com/badabing2005/PixelFlasher"
8
license=('GPL-3.0-or-later')
9
depends=(
10
'hicolor-icon-theme'
11
'payload_dumper'
12
'python-beautifulsoup4'
13
'python-bsdiff4'
14
'python-chardet'
15
'python-cryptography'
16
'python-darkdetect'
17
'python-json5'
18
'python-lz4'
19
'python-markdown'
20
'python-packaging'
21
'python-platformdirs'
22
'python-polib'
23
'python-protobuf'
24
'python-psutil'
25
'python-pyperclip'
26
'python-requests'
27
'python-rsa'
28
'python-wxpython'
29
'xdg-utils'
30
)
31
makedepends=('git')
32
optdepends=(
33
'android-tools: Use system platform tools'
34
'libnotify: Display system toast notifications'
35
'scrcpy: Launch Screen Copy'
36
)
37
options=('!strip')
38
source=("PixelFlasher-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz"
39
'git+https://android.googlesource.com/platform/system/update_engine.git'
40
'PixelFlasher.desktop')
41
sha256sums=('853a5a4aa64f54eec79545210c0a4c7a8e2590062c03ec24fd53b40e3a9e7937'
42
'SKIP'
43
'cd96ad8759d7cb5b530aa7b542b422be5f08d92ad92f28fcdf8413d3015dc7cb')
44
45
prepare() {
46
47
# Regenerate protos
48
protoc --proto_path=update_engine --python_out=. update_metadata.proto
49
cp -vf update_metadata_pb2.py "PixelFlasher-$pkgver/update_metadata_pb2.py"
50
}
51
52
build() {
53
cd "PixelFlasher-$pkgver"
54
python compile_po.py
55
}
56
57
package() {
58
cd "PixelFlasher-$pkgver"
59
install -Dm755 bin/* -t "$pkgdir/opt/$pkgname/bin/"
60
61
# Remove Windows & Mac binaries
62
rm "$pkgdir/opt/$pkgname/bin"/7z{.dll,.exe}
63
rm "$pkgdir/opt/$pkgname/bin"/erofs-extract-{macos,windows}-*
64
rm "$pkgdir/opt/$pkgname/bin"/pluck-{darwin,windows}-*
65
66
for f in *.py *.json *.pem *.crt; do
67
install -m644 "${f}" -t "$pkgdir/opt/$pkgname/"
68
done
69
70
install -Dm644 images/*.png -t "$pkgdir/opt/$pkgname/images/"
71
install -Dm644 images/pif/*.png -t "$pkgdir/opt/$pkgname/images/pif/"
72
73
chmod +x "$pkgdir/opt/$pkgname/PixelFlasher.py"
74
install -d "$pkgdir/usr/bin"
75
ln -s "/opt/$pkgname/PixelFlasher.py" "$pkgdir/usr/bin/PixelFlasher"
76
77
for i in 64 128 256; do
78
install -Dm644 "images/icon-dark-${i}.png" \
79
"$pkgdir/usr/share/icons/hicolor/${i}x${i}/apps/$pkgname.png"
80
done
81
82
pushd locale
83
for lang in $(ls -d */); do
84
install -Dm644 "${lang%%/}/LC_MESSAGES/$pkgname.mo" -t \
85
"$pkgdir/opt/$pkgname/locale/${lang%%/}/LC_MESSAGES/"
86
done
87
popd
88
89
install -Dm644 "$srcdir/PixelFlasher.desktop" -t "$pkgdir/usr/share/applications/"
90
91
# Compile Python bytecode
92
python -m compileall -d / "$pkgdir/opt/$pkgname"
93
python -O -m compileall -d / "$pkgdir/opt/$pkgname"
94
}
95
Changes since previous scan
--- PKGBUILD @ 2026-10-31 00:07+++ PKGBUILD @ 2026-11-01 00:21@@ -1,6 +1,6 @@ # Maintainer: Mark Wagie <mark dot wagie at proton dot me> pkgname=pixelflasher-pkgver=10.1.1.1+pkgver=10.2.0.0 pkgrel=1 pkgdesc="Pixel phone flashing GUI utility with features." arch=('any')@@ -38,7 +38,7 @@ source=("PixelFlasher-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz" 'git+https://android.googlesource.com/platform/system/update_engine.git' 'PixelFlasher.desktop')-sha256sums=('c106652b9de4dc1e2a12e15f6d02816d3173855d2050d26ce9868ae50df81e7f'+sha256sums=('853a5a4aa64f54eec79545210c0a4c7a8e2590062c03ec24fd53b40e3a9e7937' 'SKIP' 'cd96ad8759d7cb5b530aa7b542b422be5f08d92ad92f28fcdf8413d3015dc7cb') Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 17:58:44 | Medium | 1 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |