scangearmp-mx510series-x86_64

maintainer s3lph · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source URL is a Canon-operated redirect host (c-wss.com is Canon's content delivery/download infrastructure, widely used across Canon driver packages in the AUR). The md5sum is hardcoded, providing at least basic integrity verification. The package installs a vendor-supplied scanner driver RPM, which is a common pattern for proprietary hardware drivers in the AUR. The main concerns are: (1) the redirect URL makes the actual downloaded filename opaque, (2) md5 is a weak hash, and (3) the package uses $startdir which is deprecated. However, c-wss.com is a legitimate Canon domain used for driver distribution, not a personal or unofficial host. The cheaper model's concern about silent swapping applies equally to any redirect URL, but Canon's CDN infrastructure is the standard distribution mechanism for these drivers. This is sloppy/non-standard packaging (deprecated $startdir, weak hash, opaque redirect URL) but not a genuine supply-chain threat beyond what any official vendor binary entails.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 72%): The source URL is a Canon-operated redirect host (c-wss.com is Canon's content delivery/download infrastructure, widely used across Canon driver packages in the AUR). The md5sum is hardcoded, providing at least basic integrity verification. The package installs a vendor-supplied scanner driver RPM, which is a common pattern for proprietary hardware drivers in the AUR. The main concerns are: (1) the redirect URL makes the actual downloaded filename opaque, (2) md5 is a weak hash, and (3) the package uses $startdir which is deprecated. However, c-wss.com is a legitimate Canon domain used for driver distribution, not a personal or unofficial host. The cheaper model's concern about silent swapping applies equally to any redirect URL, but Canon's CDN infrastructure is the standard distribution mechanism for these drivers. This is sloppy/non-standard packaging (deprecated $startdir, weak hash, opaque redirect URL) but not a genuine supply-chain threat beyond what any official vendor binary entails.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=('http://pdisp01.c-wss.com/gdl/WWUFORedirectTarget.do?id=MDEwMDAwNDEzMTAx&cmp=ACB&lang=EN')

PKGBUILD

1 offending line(s) highlighted

      1pkgname=scangearmp-mx510series-x86_64
    
      2pkgver=1.90
    
      3pkgrel=1
    
      4pkgdesc="Canon Scanner Driver (MX510 Series) x86_64"
    
      5url="http://support-th.canon-asia.com/contents/TH/EN/0100413102.html"
    
      6arch=('x86_64')
    
      7license=('custom')
    
      8depends=('sane' 'pangox-compat')
    
      9conflicts=('scangearmp')
    
      10makedepends=('rpmextract')
    
      11source=('http://pdisp01.c-wss.com/gdl/WWUFORedirectTarget.do?id=MDEwMDAwNDEzMTAx&cmp=ACB&lang=EN')
    
      12md5sums=('d055b3dc640ebe1c6b60b77c78916b8e')
    
      13
    
      14build() {
    
      15  cd "$startdir/src"
    
      16  tar -xf "$startdir/src/WWUFORedirectTarget.do?id=MDEwMDAwNDEzMTAx&cmp=ACB&lang=EN"
    
      17}
    
      18
    
      19package() {
    
      20  cd $pkgdir
    
      21  rpmextract.sh $startdir/src/scangearmp-mx510series-$pkgver-$pkgrel-rpm/packages/scangearmp-common-$pkgver-$pkgrel.x86_64.rpm
    
      22  rpmextract.sh $startdir/src/scangearmp-mx510series-$pkgver-$pkgrel-rpm/packages/scangearmp-mx510series-$pkgver-$pkgrel.x86_64.rpm
    
      23  mkdir -p usr/share/licenses/${pkgname}
    
      24  mv usr/lib64 usr/lib
    
      25  chmod -R a+rX usr/
    
      26  mkdir -p usr/share/applications
    
      27  cat > usr/share/applications/scangearmp.desktop <<EOF
    
      28[Desktop Entry]
    
      29Version=1.0
    
      30Terminal=false
    
      31Type=Application
    
      32Name=Canon ScanGearMP
    
      33Exec=/usr/local/bin/scangearmp
    
      34Icon=scanner
    
      35Categories=Office;
    
      36EOF
    
      37}
    
      38

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2