ruffle-selfhosted-nightly
LOW
maintainer ZhangHua
1 votes
base
ruffle-nightly
scanned 2026-09-17 00:27:14.276658
Why flagged
The flagged 'external install' is a development tool (wasm-bindgen-cli) installed via cargo during prepare(), which is a standard and safe practice when building Rust projects from source; the source is the official GitHub repository, and no untrusted remote code is executed.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged 'external install' is a development tool (wasm-bindgen-cli) installed via cargo during prepare(), which is a standard and safe practice when building Rust projects from source; the source is the official GitHub repository, and no untrusted remote code is executed.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
External install via pipx/uv/poetry/cargo/go/gem
alt_pkg_manager_install
A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:42
cargo install wasm-bindgen-cli --version "$require_wasm_bindgen_version"
PKGBUILD
1 offending line(s) highlighted
1
_system_wasm_bindgen=false
2
_version=0.7.0
3
_channel=nightly
4
_date=2026-09-16
5
6
pkgbase=ruffle-nightly
7
pkgname=(ruffle-nightly
8
ruffle-demo-nightly
9
ruffle-selfhosted-nightly
10
firefox-extension-ruffle-nightly
11
chromium-extension-ruffle-nightly)
12
pkgver="$_version+$_channel+${_date//-}"
13
pkgrel=1
14
arch=("x86_64")
15
pkgdesc="A Flash Player emulator written in Rust. (Nightly version)"
16
url="https://ruffle.rs/"
17
license=("MIT OR Apache-2.0")
18
makedepends=("cargo" "cmake" "java-environment" "npm" "nodejs-lts-jod"
19
"binaryen" "gtk3" "alsa-lib" "libxcb" "systemd-libs"
20
"clang" "jq" "git" "openssl" "rust-wasm" "rust-src")
21
if "$_system_wasm_bindgen"
22
then
23
makedepends+=("wasm-bindgen")
24
else
25
makedepends+=("yq")
26
fi
27
source=("git+https://github.com/ruffle-rs/ruffle.git#tag=$_channel-$_date"
28
"chromium-extension-ruffle.key")
29
source=("git+https://github.com/ruffle-rs/ruffle.git#tag=$_channel-$_date")
30
sha256sums=('098f8801c73d0e7952626465a28dd7be26944f8696ccec6e0ed8ab6bb015c951')
31
options=("!lto")
32
33
_FIREFOX_EXTENSION_ID="ruffle@ruffle.rs"
34
35
prepare() {
36
cd "$srcdir/ruffle"
37
export RUSTUP_TOOLCHAIN=stable
38
if ! "$_system_wasm_bindgen"
39
then
40
local require_wasm_bindgen_version
41
require_wasm_bindgen_version="$(tomlq -r '.package[] | select(.name == "wasm-bindgen") | .version' Cargo.lock)"
42
cargo install wasm-bindgen-cli --version "$require_wasm_bindgen_version"
43
fi
44
cargo fetch --locked --target host-tuple
45
cargo fetch --locked --target wasm32-unknown-unknown
46
cd web
47
npm ci
48
# TODO version_name=$version_number when not nightly
49
jq --null-input \
50
--arg version_channel "$_channel" \
51
--arg version_number "$_version" \
52
--arg version_name "$_channel $_date" \
53
--arg build_date "$(date --utc --date="@${SOURCE_DATE_EPOCH:-$(date +%s)}" +%Y-%m-%d)" \
54
--arg build_id "$pkgrel" \
55
--arg commitHash "$(git rev-parse HEAD)" \
56
--arg firefox_extension_id "$_FIREFOX_EXTENSION_ID" \
57
'$ARGS.named' > version_seal.json
58
echo "Generated version_seal.json:"
59
cat version_seal.json
60
}
61
62
build() {
63
cd "$srcdir/ruffle"
64
if ! "$_system_wasm_bindgen"
65
then
66
export PATH="$PATH:$HOME/.cargo/bin"
67
fi
68
export RUSTUP_TOOLCHAIN=stable
69
export CARGO_TARGET_DIR=target
70
# libtracy_client-sys seems missing some symbols, skip enabling all features.
71
# jpegxr is not compatible to rust 1.94.0
72
cargo build --frozen --release \
73
--package=ruffle_desktop \
74
--package=ruffle_scanner \
75
--package=exporter
76
77
# Script will read binary at hardcoded path
78
# See web/packages/core/tools/build_wasm.ts for more info.
79
unset CARGO_TARGET_DIR
80
# Flags does not supported by WASM target:
81
# C/CXX: -mtune -march -fcf-protection
82
# RUST: -Ctarget-cpu
83
CFLAGS="$(echo "$CFLAGS" | sed -E 's/-m(tune|arch)=[0-9a-zA-Z-]+//g;s/-fcf-protection//g')"
84
CXXFLAGS="$(echo "$CXXFLAGS" | sed -E 's/-m(tune|arch)=[0-9a-zA-Z-]+//g;s/-fcf-protection//g')"
85
RUSTFLAGS="$(echo "$RUSTFLAGS" | sed -E 's/\s*-C\s*target-cpu=[0-9a-zA-Z]+//')"
86
87
cd web
88
npm run build:repro
89
}
90
91
check() {
92
cd "$srcdir/ruffle"
93
export RUSTUP_TOOLCHAIN=stable
94
cargo test --frozen \
95
--package=ruffle_desktop \
96
--package=ruffle_scanner \
97
--package=exporter
98
99
cd web
100
npm run test
101
}
102
103
package_ruffle-nightly() {
104
depends=("hicolor-icon-theme" "alsa-lib" "systemd-libs" "gcc-libs" "glibc")
105
pkgdesc+=" (Desktop app and utils)"
106
provides=("ruffle")
107
conflicts=("ruffle")
108
109
cd "$srcdir/ruffle"
110
local f
111
find target/release -maxdepth 1 -executable -type f | while read -r f
112
do
113
local target
114
target="$(basename "$f")"
115
target=${target/_/-}
116
if ! [[ "$target" =~ ^ruffle- ]]
117
then
118
target="ruffle-$target"
119
fi
120
if [[ "$target" == "ruffle-desktop" ]]
121
then
122
target="ruffle"
123
fi
124
echo "Installing $f to $target..."
125
install -Dm755 "$f" "$pkgdir/usr/bin/$target"
126
done
127
128
install -Dm644 desktop/packages/linux/rs.ruffle.Ruffle.desktop \
129
"$pkgdir/usr/share/applications/rs.ruffle.Ruffle.desktop"
130
install -Dm644 desktop/packages/linux/rs.ruffle.Ruffle.metainfo.xml \
131
"$pkgdir/usr/share/metainfo/rs.ruffle.Ruffle.metainfo.xml"
132
install -Dm644 desktop/packages/linux/rs.ruffle.Ruffle.svg \
133
"$pkgdir/usr/share/icons/hicolor/scalable/apps/rs.ruffle.Ruffle.svg"
134
install -Dm644 LICENSE.md \
135
"$pkgdir/usr/share/licenses/$pkgname/LICENSE.md"
136
install -Dm644 README.md \
137
"$pkgdir/usr/share/doc/ruffle/README.md"
138
}
139
140
package_ruffle-demo-nightly() {
141
pkgdesc+=" (Demo web app)"
142
arch=("any")
143
provides=("ruffle-demo")
144
conflicts=("ruffle-demo")
145
146
cd "$srcdir/ruffle"
147
mkdir -p "$pkgdir/usr/share/webapps"
148
cp -a --no-preserve=ownership \
149
web/packages/demo/dist \
150
"$pkgdir/usr/share/webapps/ruffle"
151
install -Dm644 web/packages/demo/LICENSE_APACHE \
152
"$pkgdir/usr/share/licenses/$pkgname/LICENSE_APACHE"
153
install -Dm644 web/packages/demo/LICENSE_MIT \
154
"$pkgdir/usr/share/licenses/$pkgname/LICENSE_MIT"
155
install -Dm644 web/packages/demo/README.md \
156
"$pkgdir/usr/share/doc/ruffle/demo/README.md"
157
}
158
159
package_ruffle-selfhosted-nightly() {
160
pkgdesc+=" (JavaScript module)"
161
arch=("any")
162
provides=("ruffle-selfhosted")
163
conflicts=("ruffle-selfhosted")
164
165
cd "$srcdir/ruffle"
166
mkdir -p \
167
"$pkgdir/usr/lib/node_modules" \
168
"$pkgdir/usr/share/licenses/$pkgname"
169
cp -a --no-preserve=ownership \
170
web/packages/selfhosted/dist \
171
"$pkgdir/usr/lib/node_modules/ruffle"
172
ln -srfv \
173
"$pkgdir/usr/lib/node_modules/ruffle/LICENSE_APACHE" \
174
"$pkgdir/usr/share/licenses/$pkgname/LICENSE_APACHE"
175
ln -srfv \
176
"$pkgdir/usr/lib/node_modules/ruffle/LICENSE_MIT" \
177
"$pkgdir/usr/share/licenses/$pkgname/LICENSE_MIT"
178
install -Dm644 web/packages/selfhosted/README.md \
179
"$pkgdir/usr/share/doc/ruffle/selfhosted/README.md"
180
}
181
182
package_firefox-extension-ruffle-nightly() {
183
optdepends=("firefox: Load extension in browser.")
184
pkgdesc+=" (Unsigned Firefox extension)"
185
arch=("any")
186
provides=("firefox-extension-ruffle")
187
conflicts=("firefox-extension-ruffle")
188
189
cd "$srcdir/ruffle"
190
install -Dm644 web/packages/extension/dist/firefox_unsigned.xpi \
191
"$pkgdir/usr/lib/firefox/browser/extensions/$_FIREFOX_EXTENSION_ID.xpi"
192
install -Dm644 web/packages/extension/LICENSE_APACHE \
193
"$pkgdir/usr/share/licenses/$pkgname/LICENSE_APACHE"
194
install -Dm644 web/packages/extension/LICENSE_MIT \
195
"$pkgdir/usr/share/licenses/$pkgname/LICENSE_MIT"
196
}
197
198
package_chromium-extension-ruffle-nightly() {
199
optdepends=("chromium: Load extension in browser.")
200
pkgdesc+=" (Chromium extension)"
201
arch=("any")
202
provides=("chromium-extension-ruffle")
203
conflicts=("chromium-extension-ruffle")
204
205
cd "$srcdir/ruffle"
206
local extension_id=donbcfbmhbcapadipfkeojnmajbakjdc # https://chromewebstore.google.com/detail/ruffle-flash-emulator/donbcfbmhbcapadipfkeojnmajbakjdc
207
echo "Installing chromium extension $extension_id..."
208
jq --null-input --raw-output \
209
--arg external_update_url https://clients2.google.com/service/update2/crx \
210
'$ARGS.named' | \
211
install -Dm644 "/dev/stdin" \
212
"$pkgdir/usr/share/chromium/extensions/$extension_id.json"
213
install -Dm644 web/packages/extension/LICENSE_APACHE \
214
"$pkgdir/usr/share/licenses/$pkgname/LICENSE_APACHE"
215
install -Dm644 web/packages/extension/LICENSE_MIT \
216
"$pkgdir/usr/share/licenses/$pkgname/LICENSE_MIT"
217
}
218
Changes since previous scan
--- PKGBUILD @ 2026-09-16 00:03+++ PKGBUILD @ 2026-09-17 00:27@@ -1,7 +1,7 @@ _system_wasm_bindgen=false _version=0.7.0 _channel=nightly-_date=2026-09-15+_date=2026-09-16 pkgbase=ruffle-nightly pkgname=(ruffle-nightly@@ -27,7 +27,7 @@ source=("git+https://github.com/ruffle-rs/ruffle.git#tag=$_channel-$_date" "chromium-extension-ruffle.key") source=("git+https://github.com/ruffle-rs/ruffle.git#tag=$_channel-$_date")-sha256sums=('db22a3f48d23d7456042dd7ba688626e1ceb0469179624164ee91708d332ce21')+sha256sums=('098f8801c73d0e7952626465a28dd7be26944f8696ccec6e0ed8ab6bb015c951') options=("!lto") _FIREFOX_EXTENSION_ID="ruffle@ruffle.rs"Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 07:21:35 | Medium | 1 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 07:19:15 | Medium | 1 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 07:16:35 | Medium | 1 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 07:11:01 | Medium | 1 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 07:22:16 | Medium | 1 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 07:20:26 | Medium | 1 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 07:19:13 | Medium | 1 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 07:16:32 | Medium | 1 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 03:13:17 | Medium | 1 |
| 2026-09-07 00:30:15 | Low | 2 |