sfptool

LOW

maintainer jonasled 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package builds from source code hosted on the project maintainer's own domain and GitHub, which is normal for AUR packages; the non-whitelisted host is the maintainer's personal site, but the sources are verifiable via checksums and the build process does not execute unreviewed remote code.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from source code hosted on the project maintainer's own domain and GitHub, which is normal for AUR packages; the non-whitelisted host is the maintainer's personal site, but the sources are verifiable via checksums and the build process does not execute unreviewed remote code.

PKGBUILD:32 yarn install --frozen-lockfile --cache-folder "$npm_config_cache"

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 "sfp-tool-v${pkgver}.tar.gz::https://jonasled.dev/jonasled/sfp-tool/-/archive/v1.7.0/sfp-tool-v1.7.0.tar.gz"

PKGBUILD

2 offending line(s) highlighted

      1pkgname=sfptool
    
      2pkgver=1.7.0
    
      3pkgrel=1
    
      4pkgdesc="Desktop utility for reading and programming SFP and QSFP transceivers"
    
      5arch=('x86_64' 'aarch64')
    
      6url="https://jonasled.dev/jonasled/sfp-tool"
    
      7license=('GPL3')
    
      8depends=('gtk3' 'webkit2gtk-4.1' 'libayatana-appindicator')
    
      9makedepends=('cargo' 'cmake' 'conan' 'desktop-file-utils' 'emscripten' 'fmt' 'git' 'binutils' 'ninja' 'nlohmann-json' 'nodejs' 'patchelf' 'pkgconf' 'python' 'rust' 'libsoup3' 'webkit2gtk-4.1' 'yarn')
    
      10provides=('sfptool')
    
      11conflicts=('sfptool-bin')
    
      12source=(
    
      13  "sfp-tool-v${pkgver}.tar.gz::https://jonasled.dev/jonasled/sfp-tool/-/archive/v1.7.0/sfp-tool-v1.7.0.tar.gz"
    
      14  "transceivertool-811da32d7b3bc7b8138fee5b18ae847da470c161.tar.gz::https://github.com/robinchrist/TransceiverTool/archive/811da32d7b3bc7b8138fee5b18ae847da470c161.tar.gz"
    
      15  "cppcodec-v0.2.tar.gz::https://github.com/tplgy/cppcodec/archive/refs/tags/v0.2.tar.gz"
    
      16)
    
      17sha256sums=('5a3557c950fdfadcbfd4835515be5fd29269e7a5f4a957b57a342524feb97e72' 'f1e568c1e4dcf1e8e02d4e90d53e285457a8a77db7c39a54ba3ea6106545f6d0' '0edaea2a9d9709d456aa99a1c3e17812ed130f9ef2b5c2d152c230a5cbc5c482')
    
      18
    
      19prepare() {
    
      20  cd "$srcdir/sfp-tool-v${pkgver}"
    
      21  rm -rf external/TransceiverTool external/cppcodec
    
      22  mkdir -p external
    
      23  mv "$srcdir/TransceiverTool-811da32d7b3bc7b8138fee5b18ae847da470c161" external/TransceiverTool
    
      24  mv "$srcdir/cppcodec-0.2" external/cppcodec
    
      25}
    
      26
    
      27build() {
    
      28  cd "$srcdir/sfp-tool-v${pkgver}/software/App/SFP-Tool"
    
      29  export CPP_CODEC_DIR="$srcdir/sfp-tool-v${pkgver}/external/cppcodec"
    
      30  export CARGO_TARGET_DIR="$srcdir/target"
    
      31  export npm_config_cache="$srcdir/npm-cache"
    
      32  yarn install --frozen-lockfile --cache-folder "$npm_config_cache"
    
      33  bash scripts/build-transceiver-wasm.sh
    
      34  python - <<'PY'
    
      35import json
    
      36from pathlib import Path
    
      37
    
      38config_path = Path("src-tauri/tauri.conf.json")
    
      39config = json.loads(config_path.read_text())
    
      40config["version"] = "1.7.0"
    
      41config.setdefault("bundle", {})["createUpdaterArtifacts"] = False
    
      42config_path.write_text(json.dumps(config, indent=2))
    
      43PY
    
      44  yarn tauri build --bundles deb
    
      45}
    
      46
    
      47package() {
    
      48  cd "$srcdir/target/release/bundle/deb"
    
      49  local deb_arch
    
      50  local data_archive
    
      51  case "$CARCH" in
    
      52    x86_64) deb_arch="amd64" ;;
    
      53    aarch64) deb_arch="arm64" ;;
    
      54    *) echo "Unsupported architecture: $CARCH" >&2; return 1 ;;
    
      55  esac
    
      56  ar x sfp-tool_*.deb
    
      57  tar -xvf data.tar.* -C "$pkgdir/"
    
      58}
    
      59

Changes since previous scan

--- PKGBUILD @ 2026-10-25 00:20
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,5 +1,5 @@
 pkgname=sfptool
-pkgver=1.6.4
+pkgver=1.7.0
 pkgrel=1
 pkgdesc="Desktop utility for reading and programming SFP and QSFP transceivers"
 arch=('x86_64' 'aarch64')
@@ -10,11 +10,11 @@
 provides=('sfptool')
 conflicts=('sfptool-bin')
 source=(
-  "sfp-tool-v${pkgver}.tar.gz::https://jonasled.dev/jonasled/sfp-tool/-/archive/v1.6.4/sfp-tool-v1.6.4.tar.gz"
+  "sfp-tool-v${pkgver}.tar.gz::https://jonasled.dev/jonasled/sfp-tool/-/archive/v1.7.0/sfp-tool-v1.7.0.tar.gz"
   "transceivertool-811da32d7b3bc7b8138fee5b18ae847da470c161.tar.gz::https://github.com/robinchrist/TransceiverTool/archive/811da32d7b3bc7b8138fee5b18ae847da470c161.tar.gz"
   "cppcodec-v0.2.tar.gz::https://github.com/tplgy/cppcodec/archive/refs/tags/v0.2.tar.gz"
 )
-sha256sums=('d2874f8fcce16ebfc158bca3858d0bbb19feabfecf8a2d63acec89afb4801d32' 'f1e568c1e4dcf1e8e02d4e90d53e285457a8a77db7c39a54ba3ea6106545f6d0' '0edaea2a9d9709d456aa99a1c3e17812ed130f9ef2b5c2d152c230a5cbc5c482')
+sha256sums=('5a3557c950fdfadcbfd4835515be5fd29269e7a5f4a957b57a342524feb97e72' 'f1e568c1e4dcf1e8e02d4e90d53e285457a8a77db7c39a54ba3ea6106545f6d0' '0edaea2a9d9709d456aa99a1c3e17812ed130f9ef2b5c2d152c230a5cbc5c482')
 
 prepare() {
   cd "$srcdir/sfp-tool-v${pkgver}"
@@ -37,7 +37,7 @@
 
 config_path = Path("src-tauri/tauri.conf.json")
 config = json.loads(config_path.read_text())
-config["version"] = "1.6.4"
+config["version"] = "1.7.0"
 config.setdefault("bundle", {})["createUpdaterArtifacts"] = False
 config_path.write_text(json.dumps(config, indent=2))
 PY

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 15:42:54	Medium	1
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 21:29:05	Medium	1
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2