sfptool

LOW

maintainer jonasled 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package builds from source hosted on the project's own domain and GitHub, with no execution of remote code or unverifiable binaries; the non-whitelisted host is the project's official site, and dependencies are submodules from trusted GitHub repositories.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from source hosted on the project's own domain and GitHub, with no execution of remote code or unverifiable binaries; the non-whitelisted host is the project's official site, and dependencies are submodules from trusted GitHub repositories.

PKGBUILD:32 yarn install --frozen-lockfile --cache-folder "$npm_config_cache"

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 "sfp-tool-v${pkgver}.tar.gz::https://jonasled.dev/jonasled/sfp-tool/-/archive/v1.5.0/sfp-tool-v1.5.0.tar.gz"

PKGBUILD

2 offending line(s) highlighted

      1pkgname=sfptool
    
      2pkgver=1.5.0
    
      3pkgrel=1
    
      4pkgdesc="Desktop utility for reading and programming SFP and QSFP transceivers"
    
      5arch=('x86_64' 'aarch64')
    
      6url="https://jonasled.dev/jonasled/sfp-tool"
    
      7license=('GPL3')
    
      8depends=('gtk3' 'webkit2gtk-4.1' 'libayatana-appindicator')
    
      9makedepends=('cargo' 'cmake' 'conan' 'desktop-file-utils' 'emscripten' 'fmt' 'git' 'binutils' 'ninja' 'nlohmann-json' 'nodejs' 'patchelf' 'pkgconf' 'python' 'rust' 'libsoup3' 'webkit2gtk-4.1' 'yarn')
    
      10provides=('sfptool')
    
      11conflicts=('sfptool-bin')
    
      12source=(
    
      13  "sfp-tool-v${pkgver}.tar.gz::https://jonasled.dev/jonasled/sfp-tool/-/archive/v1.5.0/sfp-tool-v1.5.0.tar.gz"
    
      14  "transceivertool-7ba6762349a6ac9ad73f4c1a4d7d67bdfc966986.tar.gz::https://github.com/robinchrist/TransceiverTool/archive/7ba6762349a6ac9ad73f4c1a4d7d67bdfc966986.tar.gz"
    
      15  "cppcodec-v0.2.tar.gz::https://github.com/tplgy/cppcodec/archive/refs/tags/v0.2.tar.gz"
    
      16)
    
      17sha256sums=('60ea96beed69dc30f3fd109f1ede7e86292ac28a1f18dfa64c46d537031470fa' '73639400c97390ec24ffc3fd566f877bf06064ea961278f555c9d6c8fee49bb8' '0edaea2a9d9709d456aa99a1c3e17812ed130f9ef2b5c2d152c230a5cbc5c482')
    
      18
    
      19prepare() {
    
      20  cd "$srcdir/sfp-tool-v${pkgver}"
    
      21  rm -rf external/TransceiverTool external/cppcodec
    
      22  mkdir -p external
    
      23  mv "$srcdir/TransceiverTool-7ba6762349a6ac9ad73f4c1a4d7d67bdfc966986" external/TransceiverTool
    
      24  mv "$srcdir/cppcodec-0.2" external/cppcodec
    
      25}
    
      26
    
      27build() {
    
      28  cd "$srcdir/sfp-tool-v${pkgver}/software/App/SFP-Tool"
    
      29  export CPP_CODEC_DIR="$srcdir/sfp-tool-v${pkgver}/external/cppcodec"
    
      30  export CARGO_TARGET_DIR="$srcdir/target"
    
      31  export npm_config_cache="$srcdir/npm-cache"
    
      32  yarn install --frozen-lockfile --cache-folder "$npm_config_cache"
    
      33  bash scripts/build-transceiver-wasm.sh
    
      34  python - <<'PY'
    
      35import json
    
      36from pathlib import Path
    
      37
    
      38config_path = Path("src-tauri/tauri.conf.json")
    
      39config = json.loads(config_path.read_text())
    
      40config["version"] = "1.5.0"
    
      41config.setdefault("bundle", {})["createUpdaterArtifacts"] = False
    
      42config_path.write_text(json.dumps(config, indent=2))
    
      43PY
    
      44  yarn tauri build --bundles deb
    
      45}
    
      46
    
      47package() {
    
      48  cd "$srcdir/target/release/bundle/deb"
    
      49  local deb_arch
    
      50  local data_archive
    
      51  case "$CARCH" in
    
      52    x86_64) deb_arch="amd64" ;;
    
      53    aarch64) deb_arch="arm64" ;;
    
      54    *) echo "Unsupported architecture: $CARCH" >&2; return 1 ;;
    
      55  esac
    
      56  ar x sfp-tool_*.deb
    
      57  tar -xvf data.tar.* -C "$pkgdir/"
    
      58}
    
      59

Changes since previous scan

--- PKGBUILD @ 2026-09-06 00:17
+++ PKGBUILD @ 2026-09-17 00:27
@@ -1,5 +1,5 @@
 pkgname=sfptool
-pkgver=1.4.2
+pkgver=1.5.0
 pkgrel=1
 pkgdesc="Desktop utility for reading and programming SFP and QSFP transceivers"
 arch=('x86_64' 'aarch64')
@@ -10,17 +10,17 @@
 provides=('sfptool')
 conflicts=('sfptool-bin')
 source=(
-  "sfp-tool-v${pkgver}.tar.gz::https://jonasled.dev/jonasled/sfp-tool/-/archive/v1.4.2/sfp-tool-v1.4.2.tar.gz"
-  "transceivertool-ae0163efc991402f1e0231078e69379471613ee4.tar.gz::https://github.com/robinchrist/TransceiverTool/archive/ae0163efc991402f1e0231078e69379471613ee4.tar.gz"
+  "sfp-tool-v${pkgver}.tar.gz::https://jonasled.dev/jonasled/sfp-tool/-/archive/v1.5.0/sfp-tool-v1.5.0.tar.gz"
+  "transceivertool-7ba6762349a6ac9ad73f4c1a4d7d67bdfc966986.tar.gz::https://github.com/robinchrist/TransceiverTool/archive/7ba6762349a6ac9ad73f4c1a4d7d67bdfc966986.tar.gz"
   "cppcodec-v0.2.tar.gz::https://github.com/tplgy/cppcodec/archive/refs/tags/v0.2.tar.gz"
 )
-sha256sums=('f2cb7f505a7afe0d85df634f621dca160596a4dde44fd64bd756723da38b3df1' '77b030fc853dbd3f94d31d99c66e3e2a7c81c7c1654ba5cae01581b0959018ac' '0edaea2a9d9709d456aa99a1c3e17812ed130f9ef2b5c2d152c230a5cbc5c482')
+sha256sums=('60ea96beed69dc30f3fd109f1ede7e86292ac28a1f18dfa64c46d537031470fa' '73639400c97390ec24ffc3fd566f877bf06064ea961278f555c9d6c8fee49bb8' '0edaea2a9d9709d456aa99a1c3e17812ed130f9ef2b5c2d152c230a5cbc5c482')
 
 prepare() {
   cd "$srcdir/sfp-tool-v${pkgver}"
   rm -rf external/TransceiverTool external/cppcodec
   mkdir -p external
-  mv "$srcdir/TransceiverTool-ae0163efc991402f1e0231078e69379471613ee4" external/TransceiverTool
+  mv "$srcdir/TransceiverTool-7ba6762349a6ac9ad73f4c1a4d7d67bdfc966986" external/TransceiverTool
   mv "$srcdir/cppcodec-0.2" external/cppcodec
 }
 
@@ -37,7 +37,7 @@
 
 config_path = Path("src-tauri/tauri.conf.json")
 config = json.loads(config_path.read_text())
-config["version"] = "1.4.2"
+config["version"] = "1.5.0"
 config.setdefault("bundle", {})["createUpdaterArtifacts"] = False
 config_path.write_text(json.dumps(config, indent=2))
 PY

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 21:12:32	Medium	1
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2