qlcplus4-bin

maintainer darkmagicsauce · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt .deb from the project's official site, which is an unverifiable binary artifact; while the host is plausibly official, the lack of source build and reliance on a precompiled package from a non-whitelisted host creates a supply-chain risk if the download were swapped.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:27 source=("qlcplus-${pkgver}.deb::https://www.qlcplus.org/downloads/${pkgver}/qlcplus_${pkgver}_amd64.deb")

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt .deb from the project's official site, which is an unverifiable binary artifact; while the host is plausibly official, the lack of source build and reliance on a precompiled package from a non-whitelisted host creates a supply-chain risk if the download were swapped.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Caitlyn Williams <caitlyn dot williams at proton dot me>
    
      2
    
      3pkgname=qlcplus4-bin
    
      4pkgver=4.14.4
    
      5pkgrel=2
    
      6pkgdesc="Open-source lighting control for DMX, Art-Net, sACN and more."
    
      7arch=('x86_64')
    
      8url="https://www.qlcplus.org"
    
      9license=("Apache-2.0")
    
      10depends=(
    
      11  'fftw'
    
      12  'libftdi'
    
      13  'libmad'
    
      14  'libsndfile'
    
      15  'qt6-3d'
    
      16  'qt6-multimedia'
    
      17  'qt6-serialport'
    
      18  'qt6-svg'
    
      19  'qt6-websockets'
    
      20)
    
      21optdepends=(
    
      22  'ola: Open Lighting Architecture plugin'
    
      23)
    
      24provides=('qlcplus' 'qlcplus4')
    
      25conflicts=('qlcplus')
    
      26options=('strip' '!libtool' '!staticlibs' '!emptydirs')
    
      27source=("qlcplus-${pkgver}.deb::https://www.qlcplus.org/downloads/${pkgver}/qlcplus_${pkgver}_amd64.deb")
    
      28
    
      29package() {
    
      30	tar -xvf ${srcdir}/data.tar.zst -C ${pkgdir}
    
      31	mv -vn ${pkgdir}/usr/lib/x86_64-linux-gnu/* ${pkgdir}/usr/lib/ # move libraries into path
    
      32	install -d -m755 ${pkgdir}/usr/lib/udev/rules.d/
    
      33	mv -vn ${pkgdir}/etc/udev/rules.d/* ${pkgdir}/usr/lib/udev/rules.d/ # move udev rules into location for standard hook
    
      34}
    
      35
    
      36sha256sums=('2a1145eb38a7393076c5e56fa8350e9c9f6109571f82810738567c199fd7c83d')
    
      37

Changes since previous scan

--- PKGBUILD @ 2026-07-19 00:17
+++ PKGBUILD @ 2026-08-03 00:08
@@ -2,7 +2,7 @@
 
 pkgname=qlcplus4-bin
 pkgver=4.14.4
-pkgrel=1
+pkgrel=2
 pkgdesc="Open-source lighting control for DMX, Art-Net, sACN and more."
 arch=('x86_64')
 url="https://www.qlcplus.org"
@@ -28,6 +28,9 @@
 
 package() {
 	tar -xvf ${srcdir}/data.tar.zst -C ${pkgdir}
+	mv -vn ${pkgdir}/usr/lib/x86_64-linux-gnu/* ${pkgdir}/usr/lib/ # move libraries into path
+	install -d -m755 ${pkgdir}/usr/lib/udev/rules.d/
+	mv -vn ${pkgdir}/etc/udev/rules.d/* ${pkgdir}/usr/lib/udev/rules.d/ # move udev rules into location for standard hook
 }
 
 sha256sums=('2a1145eb38a7393076c5e56fa8350e9c9f6109571f82810738567c199fd7c83d')

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 00:29:32	MEDIUM	3
2026-07-21 00:24:15	MEDIUM	3
2026-07-20 00:19:49	MEDIUM	3
2026-07-19 09:10:42	MEDIUM	3
2026-07-19 00:17:08	LOW	3
2026-07-18 18:02:07	LOW	3
2026-07-18 17:58:54	MEDIUM	3