rongta-label-printer-cups

maintainer BrainwreckedTech · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a driver ZIP from a non-whitelisted but plausibly official vendor host; it installs PPD files and a CUPS filter binary built from vendor source, which is normal for hardware drivers, and poses minimal risk beyond the inherent trust in the vendor's code.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a driver ZIP from a non-whitelisted but plausibly official vendor host; it installs PPD files and a CUPS filter binary built from vendor source, which is normal for hardware drivers, and poses minimal risk beyond the inherent trust in the vendor's code.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source=('rtpd.zip::https://pt.rongtatech.com/uploadfile/downloads/Label%20Printer%20Driver%20(Linux&Chinese%20domestic%20system).zip')

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: BrainwreckedTech <bwt at bwt dot com dot de>
    
      2
    
      3pkgname=rongta-label-printer-cups
    
      4pkgver=1.1.3
    
      5pkgrel=1
    
      6pkgdesc='Rongta Label Printer CUPS PPD drivers'
    
      7# Arch only matters for the rastertortlabel CUPS filter
    
      8arch=(aarch64 loongarch64 x86 x86_64)
    
      9url='https://pt.rongtatech.com/category/downloads/1_2'
    
      10# Licensing is not explicitly stated by Rongta.
    
      11# The filter driver is most likely proprietary.
    
      12# The PPD files *might* be Apache-2.0
    
      13license=(custom)
    
      14depends=(cups ghostscript)
    
      15# I've only been able to find this driver on the PT and CN web sites.
    
      16# www.rongtatech.com (presumably US) does not have the Linux CUPS drivers.
    
      17# The CN web site's ZIP file has Chinese characters in the top dir name.
    
      18source=('rtpd.zip::https://pt.rongtatech.com/uploadfile/downloads/Label%20Printer%20Driver%20(Linux&Chinese%20domestic%20system).zip')
    
      19sha256sums=('303cce9ccf5ecb36c844947e6c16cd456a0040d561ed73d00198f4683de18654')
    
      20
    
      21# This is just an abuse of arrays to document compatible models.
    
      22compat=(ACEV1S ACEM1  RI460 RP211  RP212   RP215  RP216  RP216   RP310
    
      23        RP310D RP311  RP400 RP400A RP400H  RP410  RP410C RP410N  RP410Y
    
      24        RP411  RP415  RP420 RP421  RP421A  RP422  RP425  RP500   RP500A
    
      25        RP8    RP80VI RP810 RPF412 RPP04   RPP30  RPP320 RPP320N RPP322 RPW210)
    
      26
    
      27package() {
    
      28  # The top-level directory name in the ZIP file uses non-standard characters.
    
      29  # Use a glob to rename it to confines of the typeable US latin alphabet.
    
      30  mv Label* "Label Printer Driver"
    
      31  dirname="Label Printer Driver/RTLabel_LinuxDriver_v${pkgver}"
    
      32  install -D -m755 -t ${pkgdir}/usr/lib/cups/filter "${dirname}"/filter/${CARCH}/rastertortlabel
    
      33  install -D -m644 -t ${pkgdir}/usr/share/ppd/rongta "${dirname}"/ppd/*
    
      34  # Yes, they freaking misspelled Label after correctly spelling it elsewhere
    
      35  install -D -m644 -t ${pkgdir}/usr/share/doc/rongta "${dirname}"/RTLableLinuxGuide_English.pdf
    
      36}
    
      37

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2