ruffle-selfhosted

LOW

maintainer ZhangHua 0 votes base ruffle scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The flagged pattern involves installing wasm-bindgen-cli via cargo in prepare(), but this is a build-time dependency fetched from crates.io using a version pinned from Cargo.lock, which is part of the audited source; the build is otherwise self-contained and uses official project sources.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged pattern involves installing wasm-bindgen-cli via cargo in prepare(), but this is a build-time dependency fetched from crates.io using a version pinned from Cargo.lock, which is part of the audited source; the build is otherwise self-contained and uses official project sources.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:37 cargo install wasm-bindgen-cli --version "$require_wasm_bindgen_version"

PKGBUILD

1 offending line(s) highlighted

      1_system_wasm_bindgen=false
    
      2
    
      3pkgbase=ruffle
    
      4pkgname=(ruffle
    
      ruffle-demo
    
      ruffle-selfhosted
    
      firefox-extension-ruffle
    
      chromium-extension-ruffle)
    
      9pkgver=0.5.0
    
      10pkgrel=1
    
      11arch=("x86_64")
    
      12pkgdesc="A Flash Player emulator written in Rust."
    
      13url="https://ruffle.rs/"
    
      14license=("MIT OR Apache-2.0")
    
      15makedepends=("cargo" "cmake" "java-environment" "npm" "nodejs-lts-jod"
    
           "binaryen" "gtk3" "alsa-lib" "libxcb" "systemd-libs"
    
           "clang" "jq" "git" "openssl" "rust-wasm" "rust-src")
    
      18if "$_system_wasm_bindgen"
    
      19then
    
  makedepends+=("wasm-bindgen")
    
      21else
    
  makedepends+=("yq")
    
      23fi
    
      24source=("git+https://github.com/ruffle-rs/ruffle.git#tag=v$pkgver")
    
      25sha256sums=('7cdbf9bd0200721a73e68286c217325b893062037dd220fc7093f36e891fa71f')
    
      26options=("!lto")
    
      27
    
      28_FIREFOX_EXTENSION_ID="ruffle@ruffle.rs"
    
      29
    
      30prepare() {
    
  cd "$srcdir/ruffle"
    
  export RUSTUP_TOOLCHAIN=stable
    
  if ! "$_system_wasm_bindgen"
    
  then
    
      local require_wasm_bindgen_version
    
      require_wasm_bindgen_version="$(tomlq -r '.package[] | select(.name == "wasm-bindgen") | .version' Cargo.lock)"
    
      cargo install wasm-bindgen-cli --version "$require_wasm_bindgen_version"
    
  fi
    
  cargo fetch --locked --target host-tuple
    
  cargo fetch --locked --target wasm32-unknown-unknown
    
  cd web
    
  npm ci
    
  jq --null-input \
    
      --arg version_channel "stable" \
    
      --arg version_number "$pkgver" \
    
      --arg version_name "$pkgver" \
    
      --arg build_date "$(date --utc --date="@${SOURCE_DATE_EPOCH:-$(date +%s)}" +%Y-%m-%d)" \
    
      --arg build_id "$pkgrel" \
    
      --arg commitHash "$(git rev-parse HEAD)" \
    
      --arg firefox_extension_id "$_FIREFOX_EXTENSION_ID" \
    
  '$ARGS.named' > version_seal.json
    
  echo "Generated version_seal.json:"
    
  cat version_seal.json
    
      54}
    
      55
    
      56build() {
    
  cd "$srcdir/ruffle"
    
  if ! "$_system_wasm_bindgen"
    
  then
    
      export PATH="$PATH:$HOME/.cargo/bin"
    
  fi
    
  export RUSTUP_TOOLCHAIN=stable
    
  export CARGO_TARGET_DIR=target
    
  # libtracy_client-sys seems missing some symbols, skip enabling all features.
    
  # jpegxr is not compatible to rust 1.94.0
    
  cargo build --frozen --release \
    
      --package=ruffle_desktop \
    
      --package=ruffle_scanner \
    
      --package=exporter
    
      70
    
  # Script will read binary at hardcoded path
    
  # See web/packages/core/tools/build_wasm.ts for more info.
    
  unset CARGO_TARGET_DIR
    
  # Flags does not supported by WASM target:
    
  # C/CXX: -mtune -march -fcf-protection
    
  # RUST: -Ctarget-cpu
    
  CFLAGS="$(echo "$CFLAGS" | sed -E 's/-m(tune|arch)=[0-9a-zA-Z-]+//g;s/-fcf-protection//g')"
    
  CXXFLAGS="$(echo "$CXXFLAGS" | sed -E 's/-m(tune|arch)=[0-9a-zA-Z-]+//g;s/-fcf-protection//g')"
    
  RUSTFLAGS="$(echo "$RUSTFLAGS" | sed -E 's/\s*-C\s*target-cpu=[0-9a-zA-Z]+//')"
    
      80
    
  cd web
    
  npm run build:repro
    
      83}
    
      84
    
      85check() {
    
  cd "$srcdir/ruffle"
    
  export RUSTUP_TOOLCHAIN=stable
    
  cargo test --frozen \
    
      --package=ruffle_desktop \
    
      --package=ruffle_scanner \
    
      --package=exporter
    
      92
    
  cd web
    
  npm run test
    
      95}
    
      96
    
      97package_ruffle() {
    
  depends=("hicolor-icon-theme" "alsa-lib" "systemd-libs" "libgcc" "glibc")
    
  pkgdesc+=" (Desktop app and utils)"
    
      100
    
  cd "$srcdir/ruffle"
    
  local f
    
  find target/release -maxdepth 1 -executable -type f | while read -r f
    
  do
    
      local target
    
      target="$(basename "$f")"
    
      target=${target/_/-}
    
      if ! [[ "$target" =~ ^ruffle- ]]
    
      then
    
          target="ruffle-$target"
    
      fi
    
      if [[ "$target" == "ruffle-desktop" ]]
    
      then
    
          target="ruffle"
    
      fi
    
      echo "Installing $f to $target..."
    
      install -Dm755 "$f" "$pkgdir/usr/bin/$target"
    
  done
    
      119
    
  install -Dm644 desktop/packages/linux/rs.ruffle.Ruffle.desktop \
    
      "$pkgdir/usr/share/applications/rs.ruffle.Ruffle.desktop"
    
  install -Dm644 desktop/packages/linux/rs.ruffle.Ruffle.metainfo.xml \
    
      "$pkgdir/usr/share/metainfo/rs.ruffle.Ruffle.metainfo.xml"
    
  install -Dm644 desktop/packages/linux/rs.ruffle.Ruffle.svg \
    
      "$pkgdir/usr/share/icons/hicolor/scalable/apps/rs.ruffle.Ruffle.svg"
    
  install -Dm644 LICENSE.md \
    
      "$pkgdir/usr/share/licenses/$pkgname/LICENSE.md"
    
  install -Dm644 README.md \
    
      "$pkgdir/usr/share/doc/ruffle/README.md"
    
      130}
    
      131
    
      132package_ruffle-demo() {
    
  pkgdesc+=" (Demo web app)"
    
  arch=("any")
    
      135
    
  cd "$srcdir/ruffle"
    
  mkdir -p "$pkgdir/usr/share/webapps"
    
  cp -a --no-preserve=ownership \
    
      web/packages/demo/dist \
    
      "$pkgdir/usr/share/webapps/ruffle"
    
  install -Dm644 web/packages/demo/LICENSE_APACHE \
    
      "$pkgdir/usr/share/licenses/$pkgname/LICENSE_APACHE"
    
  install -Dm644 web/packages/demo/LICENSE_MIT \
    
      "$pkgdir/usr/share/licenses/$pkgname/LICENSE_MIT"
    
  install -Dm644 web/packages/demo/README.md \
    
      "$pkgdir/usr/share/doc/ruffle/demo/README.md"
    
      147}
    
      148
    
      149package_ruffle-selfhosted() {
    
  pkgdesc+=" (JavaScript module)"
    
  arch=("any")
    
      152
    
  cd "$srcdir/ruffle"
    
  mkdir -p \
    
      "$pkgdir/usr/lib/node_modules" \
    
      "$pkgdir/usr/share/licenses/$pkgname"
    
  cp -a --no-preserve=ownership \
    
      web/packages/selfhosted/dist \
    
      "$pkgdir/usr/lib/node_modules/ruffle"
    
  ln -srfv \
    
      "$pkgdir/usr/lib/node_modules/ruffle/LICENSE_APACHE" \
    
      "$pkgdir/usr/share/licenses/$pkgname/LICENSE_APACHE"
    
  ln -srfv \
    
      "$pkgdir/usr/lib/node_modules/ruffle/LICENSE_MIT" \
    
      "$pkgdir/usr/share/licenses/$pkgname/LICENSE_MIT"
    
  install -Dm644 web/packages/selfhosted/README.md \
    
      "$pkgdir/usr/share/doc/ruffle/selfhosted/README.md"
    
      168}
    
      169
    
      170package_firefox-extension-ruffle() {
    
  optdepends=("firefox: Load extension in browser.")
    
  pkgdesc+=" (Unsigned Firefox extension)"
    
  arch=("any")
    
      174
    
  cd "$srcdir/ruffle"
    
  install -Dm644 web/packages/extension/dist/firefox_unsigned.xpi \
    
      "$pkgdir/usr/lib/firefox/browser/extensions/$_FIREFOX_EXTENSION_ID.xpi"
    
  install -Dm644 web/packages/extension/LICENSE_APACHE \
    
      "$pkgdir/usr/share/licenses/$pkgname/LICENSE_APACHE"
    
  install -Dm644 web/packages/extension/LICENSE_MIT \
    
      "$pkgdir/usr/share/licenses/$pkgname/LICENSE_MIT"
    
      182}
    
      183
    
      184package_chromium-extension-ruffle() {
    
  optdepends=("chromium: Load extension in browser.")
    
  pkgdesc+=" (Chromium extension)"
    
  arch=("any")
    
      188
    
  cd "$srcdir/ruffle"
    
  local extension_id=donbcfbmhbcapadipfkeojnmajbakjdc # https://chromewebstore.google.com/detail/ruffle-flash-emulator/donbcfbmhbcapadipfkeojnmajbakjdc
    
  echo  "Installing chromium extension $extension_id..."
    
  jq --null-input --raw-output \
    
      --arg external_update_url https://clients2.google.com/service/update2/crx \
    
      '$ARGS.named' | \
    
  install -Dm644 "/dev/stdin" \
    
          "$pkgdir/usr/share/chromium/extensions/$extension_id.json"
    
  install -Dm644 web/packages/extension/LICENSE_APACHE \
    
      "$pkgdir/usr/share/licenses/$pkgname/LICENSE_APACHE"
    
  install -Dm644 web/packages/extension/LICENSE_MIT \
    
      "$pkgdir/usr/share/licenses/$pkgname/LICENSE_MIT"
    
      201}
    
      202

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 03:13:17	Medium	1
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2