qfirehose

LOW

maintainer fuero 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

Source is a zip from Quectel's own official forum (forums.quectel.com), which is plausibly the vendor's own distribution channel; it is built from source rather than installed as a prebuilt binary, and has a checksum. The non-standard host is the vendor's forum, not an unrelated file-sharing service, so risk is low.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Source is a zip from Quectel's own official forum (forums.quectel.com), which is plausibly the vendor's own distribution channel; it is built from source rather than installed as a prebuilt binary, and has a checksum. The non-standard host is the vendor's forum, not an unrelated file-sharing service, so risk is low.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 "${_pkgname}.zip::https://forums.quectel.com/uploads/default/original/3X/9/f/9fc8d3a449c9780e4a3fed262e80129e89d27ef0.zip"

PKGBUILD

1 offending line(s) highlighted

      1pkgname=qfirehose
    
      2pkgrel=1
    
      3pkgver=1.4.21
    
      4_pkgname="QFirehose_Linux_and_Android_V${pkgver}"
    
      5arch=(x86_64)
    
      6options=('!strip' '!debug')
    
      7license=('proprietary')
    
      8url='https://github.com/nippynetworks/qfirehose'
    
      9description='Driver for Quectel PCI Express modems'
    
      10makedepends=(
    
      11  gcc
    
      12  git
    
      13)
    
      14source=(
    
      15  "${_pkgname}.zip::https://forums.quectel.com/uploads/default/original/3X/9/f/9fc8d3a449c9780e4a3fed262e80129e89d27ef0.zip"
    
      16)
    
      17
    
      18sha256sums=('9e32fa5deba4001ee0857a0ed6a39d774700d000dd73000f03dcbee5d2f03398')
    
      19
    
      20_to_filter=(
    
      21  -fstack-clash-protection
    
      22  -fstack-protector-strong
    
      23  -fstack-protector
    
      24)
    
      25
    
      26_filter_flags() {
    
      27  local -n var="$1"
    
      28  local -n remove="$2"
    
      29  local filtered=()
    
      30  local flag skip
    
      31
    
      32  # Split CFLAGS into words
    
      33  read -ra flags <<< "${var}"
    
      34
    
      35  for flag in "${flags[@]}"; do
    
      36      skip=0
    
      37      for r in "${remove[@]}"; do
    
      38          if [[ "${flag}" == "${r}" ]]; then
    
      39              skip=1
    
      40              break
    
      41          fi
    
      42      done
    
      43
    
      44      ((skip)) || filtered+=("${flag}")
    
      45  done
    
      46
    
      47  var="${filtered[*]}"
    
      48}
    
      49
    
      50prepare() {
    
      51  cd "${_pkgname}"
    
      52  rm -rf out
    
      53  sed -i -e 's/-Werror//g' Makefile
    
      54}
    
      55
    
      56build() {
    
      57  cd "${_pkgname}"
    
      58  _filter_flags CFLAGS _to_filter
    
      59  _filter_flags CXXFLAGS _to_filter
    
      60  make
    
      61}
    
      62
    
      63package() {
    
      64  cd "${_pkgname}"
    
      65  install -Dm0755 out/QFirehose "${pkgdir}/usr/bin/QFirehose"
    
      66  for i in README.md NOTICE
    
      67  do
    
      68    install -Dm0644 "${i}" "${pkgdir}/usr/share/doc/${pkgname}/${i}"
    
      69  done
    
      70}
    
      71

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2