qcom-test-automation-controller-git

LOW

maintainer KarthikJay 0 votes scanned 2026-10-20 00:10:31.152894

View on AUR

Why flagged

The non-standard host is a Wayback Machine archive of the official FTDI chip vendor download (ftdichip.com), used to pre-fetch a dependency that upstream's CMake would otherwise download at build time; the checksum is hardcoded and non-SKIP, making silent substitution detectable. The prebuilt FTDI static library is linked into the built binaries but originates from the vendor's own infrastructure (archived copy), not an unrelated personal host. No obfuscated payloads, exfiltration, or remote code execution patterns are present; this is a legitimate packaging workaround for an offline build.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 75%): The non-standard host is a Wayback Machine archive of the official FTDI chip vendor download (ftdichip.com), used to pre-fetch a dependency that upstream's CMake would otherwise download at build time; the checksum is hardcoded and non-SKIP, making silent substitution detectable. The prebuilt FTDI static library is linked into the built binaries but originates from the vendor's own infrastructure (archived copy), not an unrelated personal host. No obfuscated payloads, exfiltration, or remote code execution patterns are present; this is a legitimate packaging workaround for an offline build.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:33 "https://web.archive.org/web/20250822044524/https://ftdichip.com/wp-content/uploads/2025/03/$_ftdi"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Karthik Jayakumar <valliyilkarthik@gmail.com>
    
      2
    
      3_pkgname=qcom-test-automation-controller
    
      4pkgname=$_pkgname-git
    
      5pkgver=6.9.0.r0.g954c804
    
      6pkgrel=2
    
      7pkgdesc="Qualcomm Test Automation Controller (QTAC) - control Qualcomm devices through a debug board"
    
      8arch=('x86_64')
    
      9url="https://github.com/qualcomm/qcom-test-automation-controller"
    
      10license=('BSD-3-Clause-Clear' 'LicenseRef-FTDI' 'LGPL-2.1-or-later')
    
      11depends=(
    
      12  'glibc'
    
      13  'hicolor-icon-theme'
    
      14  'hidapi'
    
      15  'libgcc'
    
      16  'libstdc++'
    
      17  'qt6-base'
    
      18  'qt6-multimedia'
    
      19  'qt6-serialport'
    
      20)
    
      21makedepends=('cmake' 'git' 'ninja')
    
      22optdepends=('python: TACDev Python interface and example scripts'
    
      23            'python-setuptools: install the TACDev Python package via setup.py'
    
      24            'python-yaml: MCP example scripts (they also need fastmcp)')
    
      25provides=("$_pkgname")
    
      26conflicts=("$_pkgname")
    
      27install="$pkgname.install"
    
      28
    
      29# Upstream's CMake downloads this archive at configure time and links its static
    
      30# library into every binary; fetch it here so the build works offline.
    
      31_ftdi=libftd2xx-linux-x86_64-1.4.33.tgz
    
      32source=("git+$url.git"
    
      33        "https://web.archive.org/web/20250822044524/https://ftdichip.com/wp-content/uploads/2025/03/$_ftdi"
    
      34        LICENSE.FTDI
    
      35        devlist-static-init.patch)
    
      36noextract=("$_ftdi")
    
      37sha256sums=('SKIP'
    
      38            'e260a4594a313583b87bf230c79cec9d46f11db6dcfd7c7d4f963279703214d3'
    
      39            '4b080f7fa03bc5a2448b0d7dfcf9e7f2837ca89b008d0c474bd5044441b4a5fa'
    
      40            'bf2099ddc56b5505dca549163a8a5f447b6545118491f50d21fda82beadfc384')
    
      41
    
      42# Paths are hardcoded in the sources (TACDev.py, ApplicationEnhancements.cpp, ...)
    
      43_prefix=/opt/qcom/QTAC
    
      44_datadir=/var/lib/qcom/data/QTAC
    
      45
    
      46pkgver() {
    
      47  cd "$_pkgname"
    
      48  # Only release tags (6.9.0, ...); upstream also has tags like develop-1.1.0
    
      49  git describe --long --tags --abbrev=7 --match '[0-9]*' | sed 's/\([^-]*-g\)/r\1/;s/-/./g'
    
      50}
    
      51
    
      52prepare() {
    
      53  cd "$_pkgname"
    
      54
    
      55  if ! grep -qF "$_ftdi" third-party/CMakeLists.txt; then
    
      56    error "third-party/CMakeLists.txt no longer uses $_ftdi; update _ftdi in the PKGBUILD"
    
      57    return 1
    
      58  fi
    
      59  ln -sf "$srcdir/$_ftdi" third-party/
    
      60
    
      61  # DevList misses the installed devicelist.json (static init order bug);
    
      62  # skipped automatically once upstream moves the global into main()
    
      63  if grep -q '^const QString kUSBDescriptorPath' src/applications/devlist/main.cpp; then
    
      64    patch -Np1 -i "$srcdir/devlist-static-init.patch"
    
      65  fi
    
      66
    
      67  # Arch has no 'dialout' group; serial devices belong to 'uucp'
    
      68  sed -i 's/GROUP="dialout"/GROUP="uucp"/' udev-rules/*.rules
    
      69}
    
      70
    
      71build() {
    
      72  # TRY_FIND_PACKAGE_MODE makes FetchContent use the system hidapi instead of
    
      73  # cloning it, and TARGETS_GLOBAL exposes hidapi::hidapi outside third-party/.
    
      74  # FULLY_DISCONNECTED turns any remaining download into an error.
    
      75  # No executable links a private shared library, so no RPATH is needed.
    
      76  cmake -S "$_pkgname" -B build -G Ninja \
    
      77    -DCMAKE_BUILD_TYPE=Release \
    
      78    -DCMAKE_SKIP_RPATH=ON \
    
      79    -DFETCHCONTENT_TRY_FIND_PACKAGE_MODE=ALWAYS \
    
      80    -DFETCHCONTENT_FULLY_DISCONNECTED=ON \
    
      81    -DCMAKE_FIND_PACKAGE_TARGETS_GLOBAL=ON \
    
      82    -Wno-dev
    
      83  cmake --build build
    
      84
    
      85  # Regenerate the device list from the shipped configurations, as upstream CI
    
      86  # and the .deb postinst do. HOME is redirected so nothing lands in ~/Documents.
    
      87  local _out="$srcdir/$_pkgname/__Builds/Linux/Release"
    
      88  rm -rf devicelist && mkdir devicelist
    
      89  cp "$_pkgname"/configurations/*.tcnf devicelist/
    
      90  HOME="$srcdir/home" QT_QPA_PLATFORM=offscreen \
    
      91    "$_out/bin/UpdateDeviceList" dir="$srcdir/devicelist"
    
      92  # It records absolute .tcnf paths; point them at the installed location
    
      93  sed -i "s|\"$srcdir/devicelist/|\"$_datadir/configurations/|" devicelist/devicelist.json
    
      94}
    
      95
    
      96package() {
    
      97  cd "$_pkgname"
    
      98  local _out=__Builds/Linux/Release _bin
    
      99
    
      100  # Layout mirrors upstream's packaging/linux/package_QTAC.sh
    
      101  install -d "$pkgdir/usr/bin" "$pkgdir$_prefix"/{bin,lib,docs/QTAC,examples,python}
    
      102
    
      103  # Install whatever executables upstream builds, so new tools need no PKGBUILD change
    
      104  for _bin in "$_out"/bin/*; do
    
      105    [[ -f $_bin && -x $_bin ]] || continue
    
      106    install -m755 "$_bin" "$pkgdir$_prefix/bin/"
    
      107    ln -s "$_prefix/bin/${_bin##*/}" "$pkgdir/usr/bin/${_bin##*/}"
    
      108  done
    
      109  cp -P "$_out"/lib/libTACDev.so* "$pkgdir$_prefix/lib/"
    
      110
    
      111  cp -r --no-preserve=ownership docs/. "$pkgdir$_prefix/docs/QTAC/"
    
      112  rm -rf "$pkgdir$_prefix/docs/QTAC/tools"  # Sphinx build scripts
    
      113  cp -r --no-preserve=ownership examples/. "$pkgdir$_prefix/examples/"
    
      114  cp -r --no-preserve=ownership interfaces/Python/. "$pkgdir$_prefix/python/"
    
      115
    
      116  install -Dm644 configurations/* -t "$pkgdir$_datadir/configurations/"
    
      117  install -Dm644 "$srcdir/devicelist/devicelist.json" -t "$pkgdir$_datadir/configurations/"
    
      118  install -Dm644 interfaces/C++/TACDev/*.h -t "$pkgdir$_datadir/interfaces/C++/TACDev/"
    
      119  install -d "$pkgdir$_datadir/interfaces"/{Python,Java}
    
      120  cp -r --no-preserve=ownership interfaces/Python/. "$pkgdir$_datadir/interfaces/Python/"
    
      121  cp -r --no-preserve=ownership interfaces/Java/. "$pkgdir$_datadir/interfaces/Java/"
    
      122
    
      123  # pacman's 35-systemd-udev-reload hook reloads udev after the transaction
    
      124  install -Dm644 udev-rules/*.rules -t "$pkgdir/usr/lib/udev/rules.d/"
    
      125
    
      126  local _app=src/applications
    
      127  install -Dm644 "$_app"/test-automation-controller/resources/TAC.desktop \
    
      128                 "$_app"/tac-configuration-editor/resources/TACConfigEditor.desktop \
    
      129                 "$_app"/device-catalog/resources/DeviceCatalog.desktop \
    
      130                 -t "$pkgdir/usr/share/applications/"
    
      131  install -Dm644 "$_app"/test-automation-controller/resources/TAC.png \
    
      132                 "$pkgdir/usr/share/icons/hicolor/256x256/apps/tac.png"
    
      133  install -Dm644 "$_app"/tac-configuration-editor/resources/TACConfigEditor.png \
    
      134                 "$pkgdir/usr/share/icons/hicolor/256x256/apps/tac-config-editor.png"
    
      135  install -Dm644 "$_app"/device-catalog/resources/device-catalog.png \
    
      136                 "$pkgdir/usr/share/icons/hicolor/256x256/apps/device-catalog.png"
    
      137
    
      138  install -Dm644 LICENSE -t "$pkgdir/usr/share/licenses/$pkgname/"
    
      139  install -Dm644 "$srcdir/LICENSE.FTDI" -t "$pkgdir/usr/share/licenses/$pkgname/"
    
      140}
    
      141

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-20 00:10:31	Low	3
2026-10-19 23:28:38	Low	3
2026-10-19 23:26:39	Medium	2