spflashtool5-bin
maintainer Omar007
· 3 votes
· scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged
This PKGBUILD downloads and installs a prebuilt closed-source binary (flash_tool) from spflashtools.com, which is a third-party aggregator/mirror site rather than the official MediaTek/SP Flash Tool vendor. The binary is executed directly on the user's system with LD_LIBRARY_PATH set to its own directory. While sha256sums are present (providing integrity checking against the specific file at time of packaging), the host is not an official vendor distribution channel — spflashtools.com is a community mirror that could substitute binaries without the maintainer's knowledge. The 'unknown' license also indicates the provenance is unclear. This is a genuine medium-severity supply-chain concern: an unofficial host serving executed binaries, not a false positive.
Triggered rules
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:15
source=("https://spflashtools.com/wp-content/uploads/SP_Flash_Tool_v${pkgver}_Linux.zip"
MEDIUM
AI review
llm_review
An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 75%): This PKGBUILD downloads and installs a prebuilt closed-source binary (flash_tool) from spflashtools.com, which is a third-party aggregator/mirror site rather than the official MediaTek/SP Flash Tool vendor. The binary is executed directly on the user's system with LD_LIBRARY_PATH set to its own directory. While sha256sums are present (providing integrity checking against the specific file at time of packaging), the host is not an official vendor distribution channel — spflashtools.com is a community mirror that could substitute binaries without the maintainer's knowledge. The 'unknown' license also indicates the provenance is unclear. This is a genuine medium-severity supply-chain concern: an unofficial host serving executed binaries, not a false positive.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Omar Pakker <archlinux@opakker.nl>
2
3
_pkgname=spflashtool5
4
pkgname="${_pkgname}-bin"
5
pkgver="5.2228"
6
pkgrel=1
7
pkgdesc="SP Flash Tool is an application to flash your MediaTek (MTK) SmartPhone. Version 5 variant."
8
arch=('x86_64')
9
url="http://spflashtools.com/category/linux"
10
license=('unknown')
11
depends=('gcc-libs' 'libpng12' 'qtwebkit')
12
makedepends=('gendesk')
13
provides=("${_pkgname}")
14
conflicts=("${_pkgname}")
15
source=("https://spflashtools.com/wp-content/uploads/SP_Flash_Tool_v${pkgver}_Linux.zip"
16
'spflashtool5.png'
17
'60-spflashtool5.rules')
18
sha256sums=('18b11eed341fd57feb7fbc58a7b8eb93429bacc7d25a993878af8a0b6e98df10'
19
'fe0b9c1de77c687623bfc07733041d1387f755493cdf904e6afcb47f784d34c7'
20
'a0e20dea13cfc63a92444e3763c764701162cfb5a8d04092dc69169f4214fb8d')
21
22
# Workaround for source file download, which requires the 'Referer' header to be set
23
DLAGENTS=('https::/usr/bin/curl -gqb "" -fLC - --retry 3 --retry-delay 3 -o %o %u -e %u'
24
"${DLAGENTS[@]}")
25
26
prepare() {
27
# Create .desktop file.
28
gendesk -f -n \
29
--pkgname "${_pkgname}" \
30
--pkgdesc "${pkgdesc}" \
31
--name "SP Flash Tool" \
32
--genericname "Firmware Flasher" \
33
--comment "MediaTek (MTK) Firmware Flasher" \
34
--exec "/usr/bin/${_pkgname}" \
35
--categories "System;"
36
37
# Create exec file. Required for the binary to find its own .so files
38
{
39
echo '#!/bin/sh'
40
echo 'export LD_LIBRARY_PATH="/opt/'"${_pkgname}"'"'
41
echo 'exec /opt/'"${_pkgname}"'/flash_tool "${@}"'
42
} > "${srcdir}/${_pkgname}"
43
}
44
45
package() {
46
local folderName="SP_Flash_Tool_v${pkgver}_Linux"
47
48
# Clean files we do not need
49
rm -r "${srcdir}/${folderName}/bin"
50
rm -r "${srcdir}/${folderName}/Driver"
51
rm -r "${srcdir}/${folderName}/lib"
52
rm -r "${srcdir}/${folderName}/plugins"
53
rm "${srcdir}/${folderName}/99-ttyacms.rules"
54
rm "${srcdir}/${folderName}/modemmanagercmd.sh"
55
rm "${srcdir}/${folderName}/flash_tool.sh"
56
57
# Install remaining files
58
install -Dm644 -t "${pkgdir}/opt/${_pkgname}/" "${srcdir}/${folderName}/"*
59
60
# Mark the binary as executable and install the shell file created in prepare()
61
chmod 755 "${pkgdir}/opt/${_pkgname}/flash_tool"
62
install -Dm755 "${srcdir}/${_pkgname}" "${pkgdir}/usr/bin/${_pkgname}"
63
64
# Desktop file and icon
65
install -Dm644 "${srcdir}/${_pkgname}.png" "${pkgdir}/usr/share/pixmaps/${_pkgname}.png"
66
install -Dm644 "${srcdir}/${_pkgname}.desktop" "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
67
68
# Udev rule
69
install -Dm644 "${srcdir}/60-${_pkgname}.rules" "${pkgdir}/usr/lib/udev/rules.d/60-${_pkgname}.rules"
70
71
# Link QT assistant so the help menu works
72
install -dm755 "${pkgdir}/opt/${_pkgname}/bin"
73
ln -sf "/usr/lib/qt4/bin/assistant" "${pkgdir}/opt/${_pkgname}/bin/assistant"
74
}
75
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | MEDIUM | 2 |
| 2026-08-02 00:16:08 | MEDIUM | 2 |
| 2026-08-01 00:11:18 | MEDIUM | 2 |
| 2026-07-31 00:14:10 | MEDIUM | 2 |
| 2026-07-30 00:17:23 | MEDIUM | 2 |
| 2026-07-29 00:25:53 | MEDIUM | 2 |
| 2026-07-28 00:07:28 | MEDIUM | 2 |
| 2026-07-27 00:24:32 | MEDIUM | 2 |
| 2026-07-26 00:07:32 | MEDIUM | 2 |
| 2026-07-25 00:13:44 | MEDIUM | 2 |
| 2026-07-24 00:02:28 | MEDIUM | 2 |
| 2026-07-23 00:14:47 | MEDIUM | 2 |
| 2026-07-22 00:29:32 | MEDIUM | 2 |
| 2026-07-21 00:24:15 | MEDIUM | 2 |
| 2026-07-20 00:19:49 | MEDIUM | 2 |
| 2026-07-19 00:17:08 | MEDIUM | 2 |
| 2026-07-18 00:14:48 | MEDIUM | 2 |
| 2026-07-17 00:06:16 | MEDIUM | 2 |
| 2026-07-16 00:05:41 | MEDIUM | 2 |
| 2026-07-15 00:09:25 | MEDIUM | 2 |