qualcomm-software-center

maintainer chuanshanjia · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt .deb from Qualcomm's official domain, which is not on standard whitelists but is plausibly legitimate; it then extracts and repackages the application with minor path fixes, posing low risk as the source is verifiable and no untrusted code execution occurs.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt .deb from Qualcomm's official domain, which is not on standard whitelists but is plausibly legitimate; it then extracts and repackages the application with minor path fixes, posing low risk as the source is verifiable and no untrusted code execution occurs.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source=("https://softwarecenter.qualcomm.com/api/download/software/tools/Qualcomm_Software_Center/Linux/Debian/${pkgver}/QualcommSoftwareCenter${pkgver}.Linux-x86.deb"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Chuanshanjia <1845776552@qq.com>
    
      2# Based on Qualcomm Software Center 1.28.2
    
      3
    
      4pkgname=qualcomm-software-center
    
      5pkgver=1.28.2
    
      6pkgrel=2
    
      7pkgdesc="Qualcomm Software Center - Discover and download software distributions, service tasks, tools and change requests"
    
      8arch=('x86_64')
    
      9url="https://www.qualcomm.com/developer/software/qualcomm-software-center"
    
      10license=('custom')
    
      11depends=('electron41' 'hicolor-icon-theme')
    
      12makedepends=()
    
      13install=qualcomm-software-center.install
    
      14provides=('qualcomm-software-center')
    
      15conflicts=()
    
      16backup=()
    
      17options=('!strip' '!emptydirs')
    
      18source=("https://softwarecenter.qualcomm.com/api/download/software/tools/Qualcomm_Software_Center/Linux/Debian/${pkgver}/QualcommSoftwareCenter${pkgver}.Linux-x86.deb"
    
      19        "qualcomm-software-center.sh"
    
      20        "qualcomm-software-center.install")
    
      21sha256sums=('dbce860cd11ac3e190a5cacb3612a714e91198e97a737a2d146803cbb59a727d'
    
      22            'e283d6b9e441b9ccefe986582201b1608180be379af7b519f8aca02fbf330076'
    
      23            '10429b8404856be05897ab1b712f97ab6104cebefffc1661b6f1dcf34875479b')
    
      24
    
      25prepare() {
    
      26    # 解压deb包
    
      27    ar x "QualcommSoftwareCenter${pkgver}.Linux-x86.deb"
    
      28
    
      29    # 解压data.tar.xz
    
      30    mkdir -p temp_extract
    
      31    tar -xf data.tar.xz -C temp_extract
    
      32
    
      33    # 修改应用代码中的资源路径（保持原deb包路径不变）
    
      34    if [[ -d "temp_extract/opt/qcom/softwarecenter/bin/resources/app" ]]; then
    
      35        find "temp_extract/opt/qcom/softwarecenter/bin/resources/app" -type f -name "*.js" -exec sed -i "s|process.resourcesPath|\"/opt/qcom/softwarecenter/bin/resources\"|g" {} +
    
      36
    
      37        # Arch 的 /etc/os-release 没有 VERSION_ID，读取失败会导致 QLHandler 初始化崩溃
    
      38        sed -i 's@osReleaseInfoMap.get("VERSION_ID").replace@(osReleaseInfoMap.get("VERSION_ID") || "rolling").replace@g' \
    
      39            "temp_extract/opt/qcom/softwarecenter/bin/resources/app/dist/start-server.js"
    
      40
    
      41        # 上游写死的 /local/mnt/workspace 在普通系统上不可写，改成用户可写的默认下载目录
    
      42        sed -i 's|\[enums_1.Path.PRODUCT_DOWNLOAD, "/local/mnt/workspace/"\]|[enums_1.Path.PRODUCT_DOWNLOAD, "/var/tmp/qcom/softwarecenter/downloads"]|g' \
    
      43            "temp_extract/opt/qcom/softwarecenter/bin/resources/app/dist/main.js" \
    
      44            "temp_extract/opt/qcom/softwarecenter/bin/resources/app/dist/start-server.js"
    
      45    fi
    
      46}
    
      47
    
      48package() {
    
      49    # 安装启动脚本
    
      50    install -Dm755 "${srcdir}/qualcomm-software-center.sh" "${pkgdir}/usr/bin/${pkgname}"
    
      51
    
      52    # 安装应用资源目录
    
      53    local _lib_dir="${pkgdir}/opt/qcom/softwarecenter/bin"
    
      54    install -d "${_lib_dir}"
    
      55
    
      56    # 安装应用文件（排除原始electron二进制）
    
      57    find temp_extract/opt/qcom/softwarecenter/bin -mindepth 1 -maxdepth 1 ! -name "softwarecenter" -exec cp -r {} "${_lib_dir}/" \;
    
      58
    
      59    # 记录应用版本，安装脚本用它更新 QIK 组件数据库
    
      60    echo "${pkgver}" > "${pkgdir}/opt/qcom/softwarecenter/bin/qsc-version"
    
      61
    
      62    # 创建必要的目录并复制桌面文件
    
      63    install -d "${pkgdir}/usr/share/applications"
    
      64    cp temp_extract/usr/share/applications/qualcommsoftwarecenter.desktop "${pkgdir}/usr/share/applications/"
    
      65    sed -i "s|Exec=/opt/qcom/softwarecenter/bin/softwarecenter %u|Exec=/usr/bin/${pkgname} %u|g" "${pkgdir}/usr/share/applications/qualcommsoftwarecenter.desktop"
    
      66
    
      67    # 复制图标
    
      68    install -d "${pkgdir}/usr/share/icons/hicolor/256x256/apps"
    
      69    cp temp_extract/opt/qcom/softwarecenter/bin/resources/app/dist/assets/icons/software-center.png \
    
      70       "${pkgdir}/usr/share/icons/hicolor/256x256/apps/qualcommsoftwarecenter.png"
    
      71
    
      72    
    
      73    # 复制许可证
    
      74    install -Dm644 "temp_extract/opt/qcom/softwarecenter/bin/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      75
    
      76    # 清理临时文件
    
      77    rm -rf temp_extract
    
      78    rm -f control.tar.xz data.tar.xz debian-binary
    
      79}
    
      80

Changes since previous scan

--- PKGBUILD @ 2026-08-01 00:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,14 +1,14 @@
 # Maintainer: Chuanshanjia <1845776552@qq.com>
-# Based on Qualcomm Software Center 1.26.4
+# Based on Qualcomm Software Center 1.28.2
 
 pkgname=qualcomm-software-center
-pkgver=1.26.4
-pkgrel=1
+pkgver=1.28.2
+pkgrel=2
 pkgdesc="Qualcomm Software Center - Discover and download software distributions, service tasks, tools and change requests"
 arch=('x86_64')
 url="https://www.qualcomm.com/developer/software/qualcomm-software-center"
 license=('custom')
-depends=('electron32' 'hicolor-icon-theme')
+depends=('electron41' 'hicolor-icon-theme')
 makedepends=()
 install=qualcomm-software-center.install
 provides=('qualcomm-software-center')
@@ -18,9 +18,9 @@
 source=("https://softwarecenter.qualcomm.com/api/download/software/tools/Qualcomm_Software_Center/Linux/Debian/${pkgver}/QualcommSoftwareCenter${pkgver}.Linux-x86.deb"
         "qualcomm-software-center.sh"
         "qualcomm-software-center.install")
-sha256sums=('b10cb470c94b6e853725ff2f07ec6e194c7707dcc8523c6c0be59f93c752bc6e'
-            'f877241c7daeb0e8f8f21fe4fa858479d8aabdd88aaf1e8ba8a3e8e93e72a933'
-            '9b58edaa2f2afd61a52b8145facd4cb793481edaf5e4d9f9dd8093a099b5822b')
+sha256sums=('dbce860cd11ac3e190a5cacb3612a714e91198e97a737a2d146803cbb59a727d'
+            'e283d6b9e441b9ccefe986582201b1608180be379af7b519f8aca02fbf330076'
+            '10429b8404856be05897ab1b712f97ab6104cebefffc1661b6f1dcf34875479b')
 
 prepare() {
     # 解压deb包
@@ -33,6 +33,15 @@
     # 修改应用代码中的资源路径（保持原deb包路径不变）
     if [[ -d "temp_extract/opt/qcom/softwarecenter/bin/resources/app" ]]; then
         find "temp_extract/opt/qcom/softwarecenter/bin/resources/app" -type f -name "*.js" -exec sed -i "s|process.resourcesPath|\"/opt/qcom/softwarecenter/bin/resources\"|g" {} +
+
+        # Arch 的 /etc/os-release 没有 VERSION_ID，读取失败会导致 QLHandler 初始化崩溃
+        sed -i 's@osReleaseInfoMap.get("VERSION_ID").replace@(osReleaseInfoMap.get("VERSION_ID") || "rolling").replace@g' \
+            "temp_extract/opt/qcom/softwarecenter/bin/resources/app/dist/start-server.js"
+
+        # 上游写死的 /local/mnt/workspace 在普通系统上不可写，改成用户可写的默认下载目录
+        sed -i 's|\[enums_1.Path.PRODUCT_DOWNLOAD, "/local/mnt/workspace/"\]|[enums_1.Path.PRODUCT_DOWNLOAD, "/var/tmp/qcom/softwarecenter/downloads"]|g' \
+            "temp_extract/opt/qcom/softwarecenter/bin/resources/app/dist/main.js" \
+            "temp_extract/opt/qcom/softwarecenter/bin/resources/app/dist/start-server.js"
     fi
 }
 
@@ -46,6 +55,9 @@
 
     # 安装应用文件（排除原始electron二进制）
     find temp_extract/opt/qcom/softwarecenter/bin -mindepth 1 -maxdepth 1 ! -name "softwarecenter" -exec cp -r {} "${_lib_dir}/" \;
+
+    # 记录应用版本，安装脚本用它更新 QIK 组件数据库
+    echo "${pkgver}" > "${pkgdir}/opt/qcom/softwarecenter/bin/qsc-version"
 
     # 创建必要的目录并复制桌面文件
     install -d "${pkgdir}/usr/share/applications"
@@ -65,3 +77,4 @@
     rm -rf temp_extract
     rm -f control.tar.xz data.tar.xz debian-binary
 }
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 09:20:18	MEDIUM	1
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2