ruffle-nightly

maintainer ZhangHua · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The flagged pipx/uv/poetry/cargo pattern is a false positive; the package builds from source using cargo as a standard build tool for a Rust project, which is normal and safe for AUR packages.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged pipx/uv/poetry/cargo pattern is a false positive; the package builds from source using cargo as a standard build tool for a Rust project, which is normal and safe for AUR packages.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:42 cargo install wasm-bindgen-cli --version "$require_wasm_bindgen_version"

PKGBUILD

1 offending line(s) highlighted

      1_system_wasm_bindgen=false
    
      2_version=0.5.0
    
      3_channel=nightly
    
      4_date=2026-08-01
    
      5
    
      6pkgbase=ruffle-nightly
    
      7pkgname=(ruffle-nightly
    
      ruffle-demo-nightly
    
      ruffle-selfhosted-nightly
    
      firefox-extension-ruffle-nightly
    
      chromium-extension-ruffle-nightly)
    
      12pkgver="$_version+$_channel+${_date//-}"
    
      13pkgrel=1
    
      14arch=("x86_64")
    
      15pkgdesc="A Flash Player emulator written in Rust. (Nightly version)"
    
      16url="https://ruffle.rs/"
    
      17license=("MIT OR Apache-2.0")
    
      18makedepends=("cargo" "cmake" "java-environment" "npm" "nodejs-lts-jod"
    
           "binaryen" "gtk3" "alsa-lib" "libxcb" "systemd-libs"
    
           "clang" "jq" "git" "openssl" "rust-wasm" "rust-src")
    
      21if "$_system_wasm_bindgen"
    
      22then
    
  makedepends+=("wasm-bindgen")
    
      24else
    
  makedepends+=("yq")
    
      26fi
    
      27source=("git+https://github.com/ruffle-rs/ruffle.git#tag=$_channel-$_date"
    
      "chromium-extension-ruffle.key")
    
      29source=("git+https://github.com/ruffle-rs/ruffle.git#tag=$_channel-$_date")
    
      30sha256sums=('6d4cc80872b52fe07d99f814be832b9477dba8d03503b2f2bd2efb3ff9242f5a')
    
      31options=("!lto")
    
      32
    
      33_FIREFOX_EXTENSION_ID="ruffle@ruffle.rs"
    
      34
    
      35prepare() {
    
  cd "$srcdir/ruffle"
    
  export RUSTUP_TOOLCHAIN=stable
    
  if ! "$_system_wasm_bindgen"
    
  then
    
      local require_wasm_bindgen_version
    
      require_wasm_bindgen_version="$(tomlq -r '.package[] | select(.name == "wasm-bindgen") | .version' Cargo.lock)"
    
      cargo install wasm-bindgen-cli --version "$require_wasm_bindgen_version"
    
  fi
    
  cargo fetch --locked --target host-tuple
    
  cargo fetch --locked --target wasm32-unknown-unknown
    
  cd web
    
  npm ci
    
  # TODO version_name=$version_number when not nightly
    
  jq --null-input \
    
      --arg version_channel "$_channel" \
    
      --arg version_number "$_version" \
    
      --arg version_name "$_channel $_date" \
    
      --arg build_date "$(date --utc --date="@${SOURCE_DATE_EPOCH:-$(date +%s)}" +%Y-%m-%d)" \
    
      --arg build_id "$pkgrel" \
    
      --arg commitHash "$(git rev-parse HEAD)" \
    
      --arg firefox_extension_id "$_FIREFOX_EXTENSION_ID" \
    
  '$ARGS.named' > version_seal.json
    
  echo "Generated version_seal.json:"
    
  cat version_seal.json
    
      60}
    
      61
    
      62build() {
    
  cd "$srcdir/ruffle"
    
  if ! "$_system_wasm_bindgen"
    
  then
    
      export PATH="$PATH:$HOME/.cargo/bin"
    
  fi
    
  export RUSTUP_TOOLCHAIN=stable
    
  export CARGO_TARGET_DIR=target
    
  # libtracy_client-sys seems missing some symbols, skip enabling all features.
    
  # jpegxr is not compatible to rust 1.94.0
    
  cargo build --frozen --release \
    
      --package=ruffle_desktop \
    
      --package=ruffle_scanner \
    
      --package=exporter
    
      76
    
  # Script will read binary at hardcoded path
    
  # See web/packages/core/tools/build_wasm.ts for more info.
    
  unset CARGO_TARGET_DIR
    
  # Flags does not supported by WASM target:
    
  # C/CXX: -mtune -march -fcf-protection
    
  # RUST: -Ctarget-cpu
    
  CFLAGS="$(echo "$CFLAGS" | sed -E 's/-m(tune|arch)=[0-9a-zA-Z-]+//g;s/-fcf-protection//g')"
    
  CXXFLAGS="$(echo "$CXXFLAGS" | sed -E 's/-m(tune|arch)=[0-9a-zA-Z-]+//g;s/-fcf-protection//g')"
    
  RUSTFLAGS="$(echo "$RUSTFLAGS" | sed -E 's/\s*-C\s*target-cpu=[0-9a-zA-Z]+//')"
    
      86
    
  cd web
    
  npm run build:repro
    
      89}
    
      90
    
      91check() {
    
  cd "$srcdir/ruffle"
    
  export RUSTUP_TOOLCHAIN=stable
    
  cargo test --frozen \
    
      --package=ruffle_desktop \
    
      --package=ruffle_scanner \
    
      --package=exporter
    
      98
    
  cd web
    
  npm run test
    
      101}
    
      102
    
      103package_ruffle-nightly() {
    
  depends=("hicolor-icon-theme" "alsa-lib" "systemd-libs" "gcc-libs" "glibc")
    
  pkgdesc+=" (Desktop app and utils)"
    
  provides=("ruffle")
    
  conflicts=("ruffle")
    
      108
    
  cd "$srcdir/ruffle"
    
  local f
    
  find target/release -maxdepth 1 -executable -type f | while read -r f
    
  do
    
      local target
    
      target="$(basename "$f")"
    
      target=${target/_/-}
    
      if ! [[ "$target" =~ ^ruffle- ]]
    
      then
    
          target="ruffle-$target"
    
      fi
    
      if [[ "$target" == "ruffle-desktop" ]]
    
      then
    
          target="ruffle"
    
      fi
    
      echo "Installing $f to $target..."
    
      install -Dm755 "$f" "$pkgdir/usr/bin/$target"
    
  done
    
      127
    
  install -Dm644 desktop/packages/linux/rs.ruffle.Ruffle.desktop \
    
      "$pkgdir/usr/share/applications/rs.ruffle.Ruffle.desktop"
    
  install -Dm644 desktop/packages/linux/rs.ruffle.Ruffle.metainfo.xml \
    
      "$pkgdir/usr/share/metainfo/rs.ruffle.Ruffle.metainfo.xml"
    
  install -Dm644 desktop/packages/linux/rs.ruffle.Ruffle.svg \
    
      "$pkgdir/usr/share/icons/hicolor/scalable/apps/rs.ruffle.Ruffle.svg"
    
  install -Dm644 LICENSE.md \
    
      "$pkgdir/usr/share/licenses/$pkgname/LICENSE.md"
    
  install -Dm644 README.md \
    
      "$pkgdir/usr/share/doc/ruffle/README.md"
    
      138}
    
      139
    
      140package_ruffle-demo-nightly() {
    
  pkgdesc+=" (Demo web app)"
    
  arch=("any")
    
  provides=("ruffle-demo")
    
  conflicts=("ruffle-demo")
    
      145
    
  cd "$srcdir/ruffle"
    
  mkdir -p "$pkgdir/usr/share/webapps"
    
  cp -a --no-preserve=ownership \
    
      web/packages/demo/dist \
    
      "$pkgdir/usr/share/webapps/ruffle"
    
  install -Dm644 web/packages/demo/LICENSE_APACHE \
    
      "$pkgdir/usr/share/licenses/$pkgname/LICENSE_APACHE"
    
  install -Dm644 web/packages/demo/LICENSE_MIT \
    
      "$pkgdir/usr/share/licenses/$pkgname/LICENSE_MIT"
    
  install -Dm644 web/packages/demo/README.md \
    
      "$pkgdir/usr/share/doc/ruffle/demo/README.md"
    
      157}
    
      158
    
      159package_ruffle-selfhosted-nightly() {
    
  pkgdesc+=" (JavaScript module)"
    
  arch=("any")
    
  provides=("ruffle-selfhosted")
    
  conflicts=("ruffle-selfhosted")
    
      164
    
  cd "$srcdir/ruffle"
    
  mkdir -p \
    
      "$pkgdir/usr/lib/node_modules" \
    
      "$pkgdir/usr/share/licenses/$pkgname"
    
  cp -a --no-preserve=ownership \
    
      web/packages/selfhosted/dist \
    
      "$pkgdir/usr/lib/node_modules/ruffle"
    
  ln -srfv \
    
      "$pkgdir/usr/lib/node_modules/ruffle/LICENSE_APACHE" \
    
      "$pkgdir/usr/share/licenses/$pkgname/LICENSE_APACHE"
    
  ln -srfv \
    
      "$pkgdir/usr/lib/node_modules/ruffle/LICENSE_MIT" \
    
      "$pkgdir/usr/share/licenses/$pkgname/LICENSE_MIT"
    
  install -Dm644 web/packages/selfhosted/README.md \
    
      "$pkgdir/usr/share/doc/ruffle/selfhosted/README.md"
    
      180}
    
      181
    
      182package_firefox-extension-ruffle-nightly() {
    
  optdepends=("firefox: Load extension in browser.")
    
  pkgdesc+=" (Unsigned Firefox extension)"
    
  arch=("any")
    
  provides=("firefox-extension-ruffle")
    
  conflicts=("firefox-extension-ruffle")
    
      188
    
  cd "$srcdir/ruffle"
    
  install -Dm644 web/packages/extension/dist/firefox_unsigned.xpi \
    
      "$pkgdir/usr/lib/firefox/browser/extensions/$_FIREFOX_EXTENSION_ID.xpi"
    
  install -Dm644 web/packages/extension/LICENSE_APACHE \
    
      "$pkgdir/usr/share/licenses/$pkgname/LICENSE_APACHE"
    
  install -Dm644 web/packages/extension/LICENSE_MIT \
    
      "$pkgdir/usr/share/licenses/$pkgname/LICENSE_MIT"
    
      196}
    
      197
    
      198package_chromium-extension-ruffle-nightly() {
    
  optdepends=("chromium: Load extension in browser.")
    
  pkgdesc+=" (Chromium extension)"
    
  arch=("any")
    
  provides=("chromium-extension-ruffle")
    
  conflicts=("chromium-extension-ruffle")
    
      204
    
  cd "$srcdir/ruffle"
    
  local extension_id=donbcfbmhbcapadipfkeojnmajbakjdc # https://chromewebstore.google.com/detail/ruffle-flash-emulator/donbcfbmhbcapadipfkeojnmajbakjdc
    
  echo  "Installing chromium extension $extension_id..."
    
  jq --null-input --raw-output \
    
      --arg external_update_url https://clients2.google.com/service/update2/crx \
    
      '$ARGS.named' | \
    
  install -Dm644 "/dev/stdin" \
    
          "$pkgdir/usr/share/chromium/extensions/$extension_id.json"
    
  install -Dm644 web/packages/extension/LICENSE_APACHE \
    
      "$pkgdir/usr/share/licenses/$pkgname/LICENSE_APACHE"
    
  install -Dm644 web/packages/extension/LICENSE_MIT \
    
      "$pkgdir/usr/share/licenses/$pkgname/LICENSE_MIT"
    
      217}
    
      218

Changes since previous scan

--- PKGBUILD @ 2026-08-01 00:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,7 +1,7 @@
 _system_wasm_bindgen=false
 _version=0.5.0
 _channel=nightly
-_date=2026-07-31
+_date=2026-08-01
 
 pkgbase=ruffle-nightly
 pkgname=(ruffle-nightly
@@ -27,7 +27,7 @@
 source=("git+https://github.com/ruffle-rs/ruffle.git#tag=$_channel-$_date"
         "chromium-extension-ruffle.key")
 source=("git+https://github.com/ruffle-rs/ruffle.git#tag=$_channel-$_date")
-sha256sums=('0aa2ec25fc9793b8571ae1ed32600acbfef3dd80e721f2639e8cf85e7c606639')
+sha256sums=('6d4cc80872b52fe07d99f814be832b9477dba8d03503b2f2bd2efb3ff9242f5a')
 options=("!lto")
 
 _FIREFOX_EXTENSION_ID="ruffle@ruffle.rs"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 05:20:08	MEDIUM	1
2026-08-01 00:11:18	LOW	2
2026-07-31 05:17:13	MEDIUM	1
2026-07-31 00:14:10	LOW	2
2026-07-30 05:14:03	MEDIUM	1
2026-07-30 00:17:23	LOW	2
2026-07-29 05:10:22	MEDIUM	1
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 05:34:42	MEDIUM	1
2026-07-27 00:24:32	LOW	2
2026-07-26 05:31:42	MEDIUM	1
2026-07-26 00:07:32	LOW	2
2026-07-25 05:29:17	MEDIUM	1
2026-07-25 00:13:44	LOW	2
2026-07-24 05:27:22	MEDIUM	1
2026-07-24 00:02:28	LOW	2
2026-07-23 05:22:32	MEDIUM	1