sfptool

maintainer jonasled · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from source code hosted on plausible project-owned domains (jonasled.dev, GitHub) and bundles dependencies for local compilation, which is normal for AUR packages; the non-whitelisted host is the project's own site, and the variable-named package installation is part of a standard build process without evidence of remote code execution or supply-chain compromise.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from source code hosted on plausible project-owned domains (jonasled.dev, GitHub) and bundles dependencies for local compilation, which is normal for AUR packages; the non-whitelisted host is the project's own site, and the variable-named package installation is part of a standard build process without evidence of remote code execution or supply-chain compromise.

PKGBUILD:32 yarn install --frozen-lockfile --cache-folder "$npm_config_cache"

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 "sfp-tool-v${pkgver}.tar.gz::https://jonasled.dev/jonasled/sfp-tool/-/archive/v1.4.2/sfp-tool-v1.4.2.tar.gz"

PKGBUILD

2 offending line(s) highlighted

      1pkgname=sfptool
    
      2pkgver=1.4.2
    
      3pkgrel=1
    
      4pkgdesc="Desktop utility for reading and programming SFP and QSFP transceivers"
    
      5arch=('x86_64' 'aarch64')
    
      6url="https://jonasled.dev/jonasled/sfp-tool"
    
      7license=('GPL3')
    
      8depends=('gtk3' 'webkit2gtk-4.1' 'libayatana-appindicator')
    
      9makedepends=('cargo' 'cmake' 'conan' 'desktop-file-utils' 'emscripten' 'fmt' 'git' 'binutils' 'ninja' 'nlohmann-json' 'nodejs' 'patchelf' 'pkgconf' 'python' 'rust' 'libsoup3' 'webkit2gtk-4.1' 'yarn')
    
      10provides=('sfptool')
    
      11conflicts=('sfptool-bin')
    
      12source=(
    
      13  "sfp-tool-v${pkgver}.tar.gz::https://jonasled.dev/jonasled/sfp-tool/-/archive/v1.4.2/sfp-tool-v1.4.2.tar.gz"
    
      14  "transceivertool-ae0163efc991402f1e0231078e69379471613ee4.tar.gz::https://github.com/robinchrist/TransceiverTool/archive/ae0163efc991402f1e0231078e69379471613ee4.tar.gz"
    
      15  "cppcodec-v0.2.tar.gz::https://github.com/tplgy/cppcodec/archive/refs/tags/v0.2.tar.gz"
    
      16)
    
      17sha256sums=('f2cb7f505a7afe0d85df634f621dca160596a4dde44fd64bd756723da38b3df1' '77b030fc853dbd3f94d31d99c66e3e2a7c81c7c1654ba5cae01581b0959018ac' '0edaea2a9d9709d456aa99a1c3e17812ed130f9ef2b5c2d152c230a5cbc5c482')
    
      18
    
      19prepare() {
    
      20  cd "$srcdir/sfp-tool-v${pkgver}"
    
      21  rm -rf external/TransceiverTool external/cppcodec
    
      22  mkdir -p external
    
      23  mv "$srcdir/TransceiverTool-ae0163efc991402f1e0231078e69379471613ee4" external/TransceiverTool
    
      24  mv "$srcdir/cppcodec-0.2" external/cppcodec
    
      25}
    
      26
    
      27build() {
    
      28  cd "$srcdir/sfp-tool-v${pkgver}/software/App/SFP-Tool"
    
      29  export CPP_CODEC_DIR="$srcdir/sfp-tool-v${pkgver}/external/cppcodec"
    
      30  export CARGO_TARGET_DIR="$srcdir/target"
    
      31  export npm_config_cache="$srcdir/npm-cache"
    
      32  yarn install --frozen-lockfile --cache-folder "$npm_config_cache"
    
      33  bash scripts/build-transceiver-wasm.sh
    
      34  python - <<'PY'
    
      35import json
    
      36from pathlib import Path
    
      37
    
      38config_path = Path("src-tauri/tauri.conf.json")
    
      39config = json.loads(config_path.read_text())
    
      40config["version"] = "1.4.2"
    
      41config.setdefault("bundle", {})["createUpdaterArtifacts"] = False
    
      42config_path.write_text(json.dumps(config, indent=2))
    
      43PY
    
      44  yarn tauri build --bundles deb
    
      45}
    
      46
    
      47package() {
    
      48  cd "$srcdir/target/release/bundle/deb"
    
      49  local deb_arch
    
      50  local data_archive
    
      51  case "$CARCH" in
    
      52    x86_64) deb_arch="amd64" ;;
    
      53    aarch64) deb_arch="arm64" ;;
    
      54    *) echo "Unsupported architecture: $CARCH" >&2; return 1 ;;
    
      55  esac
    
      56  ar x sfp-tool_*.deb
    
      57  tar -xvf data.tar.* -C "$pkgdir/"
    
      58}
    
      59

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2