qfirehose
maintainer fuero
· 0 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
Source is a zip from Quectel's own official forum (forums.quectel.com), which is plausibly the vendor's own distribution channel; it is built from source rather than installed as a prebuilt binary, and has a checksum. The non-standard host is the vendor's forum, not an unrelated file-sharing service, so risk is low.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Source is a zip from Quectel's own official forum (forums.quectel.com), which is plausibly the vendor's own distribution channel; it is built from source rather than installed as a prebuilt binary, and has a checksum. The non-standard host is the vendor's forum, not an unrelated file-sharing service, so risk is low.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:15
"${_pkgname}.zip::https://forums.quectel.com/uploads/default/original/3X/9/f/9fc8d3a449c9780e4a3fed262e80129e89d27ef0.zip"
PKGBUILD
1 offending line(s) highlighted
1
pkgname=qfirehose
2
pkgrel=1
3
pkgver=1.4.21
4
_pkgname="QFirehose_Linux_and_Android_V${pkgver}"
5
arch=(x86_64)
6
options=('!strip' '!debug')
7
license=('proprietary')
8
url='https://github.com/nippynetworks/qfirehose'
9
description='Driver for Quectel PCI Express modems'
10
makedepends=(
11
gcc
12
git
13
)
14
source=(
15
"${_pkgname}.zip::https://forums.quectel.com/uploads/default/original/3X/9/f/9fc8d3a449c9780e4a3fed262e80129e89d27ef0.zip"
16
)
17
18
sha256sums=('9e32fa5deba4001ee0857a0ed6a39d774700d000dd73000f03dcbee5d2f03398')
19
20
_to_filter=(
21
-fstack-clash-protection
22
-fstack-protector-strong
23
-fstack-protector
24
)
25
26
_filter_flags() {
27
local -n var="$1"
28
local -n remove="$2"
29
local filtered=()
30
local flag skip
31
32
# Split CFLAGS into words
33
read -ra flags <<< "${var}"
34
35
for flag in "${flags[@]}"; do
36
skip=0
37
for r in "${remove[@]}"; do
38
if [[ "${flag}" == "${r}" ]]; then
39
skip=1
40
break
41
fi
42
done
43
44
((skip)) || filtered+=("${flag}")
45
done
46
47
var="${filtered[*]}"
48
}
49
50
prepare() {
51
cd "${_pkgname}"
52
rm -rf out
53
sed -i -e 's/-Werror//g' Makefile
54
}
55
56
build() {
57
cd "${_pkgname}"
58
_filter_flags CFLAGS _to_filter
59
_filter_flags CXXFLAGS _to_filter
60
make
61
}
62
63
package() {
64
cd "${_pkgname}"
65
install -Dm0755 out/QFirehose "${pkgdir}/usr/bin/QFirehose"
66
for i in README.md NOTICE
67
do
68
install -Dm0644 "${i}" "${pkgdir}/usr/share/doc/${pkgname}/${i}"
69
done
70
}
71
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |
| 2026-07-17 00:06:16 | LOW | 2 |
| 2026-07-16 00:05:41 | LOW | 2 |
| 2026-07-15 00:09:25 | LOW | 2 |