storcli

maintainer k0ste · 16 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The package downloads official Broadcom zip files from docs.broadcom.com, which is a plausible host for documentation and downloads; the files contain RPMs that are extracted and installed, but these are official vendor binaries, so while the host is not a standard software distribution domain, it is not inherently suspicious for this vendor's content, and no untrusted executable or malicious payload is introduced.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads official Broadcom zip files from docs.broadcom.com, which is a plausible host for documentation and downloads; the files contain RPMs that are extracted and installed, but these are official vendor binaries, so while the host is not a standard software distribution domain, it is not inherently suspicious for this vendor's content, and no untrusted executable or malicious payload is introduced.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("https://docs.broadcom.com/docs-and-downloads/host-bus-adapters/host-bus-adapters-common-files/sas_sata_nvme_12g_p${_phase}/${_name}${_phase}.zip"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Konstantin Shalygin <k0ste@k0ste.ru>
    
      2# Contributor: Konstantin Shalygin <k0ste@k0ste.ru>
    
      3
    
      4pkgname='storcli'
    
      5_name='STORCLI_SAS3.5_P'
    
      6pkgver='007.3703.0000.0000'
    
      7pkgrel='1'
    
      8_phase='38'
    
      9_prefix='univ_viva_cli_rel/Unified_storcli_all_os'
    
      10pkgdesc="CLI program for LSI MegaRAID cards"
    
      11url='https://www.broadcom.com/'
    
      12license=('custom')
    
      13arch=('x86_64' 'aarch64')
    
      14makedepends=('libarchive')
    
      15source=("https://docs.broadcom.com/docs-and-downloads/host-bus-adapters/host-bus-adapters-common-files/sas_sata_nvme_12g_p${_phase}/${_name}${_phase}.zip"
    
      16	"https://docs.broadcom.com/docs-and-downloads/host-bus-adapters/host-bus-adapters-common-files/sas_sata_nvme_12g_p28/${_name}28.zip")
    
      17sha256sums=('d0f6065d3ed2993d64eaa1df274f08c624d4dc61bcdd802a1afdb552f0b6b511'
    
      18            'c15ef2d5b66f1d5988aa2bc318c49025f248d69058533e02a8f0acc86681cc85')
    
      19
    
      20_archstr=$([[ "${CARCH}" == 'x86_64' ]] && echo -n "Linux" || echo -n "ARM/Linux")
    
      21_filearch=$([[ "${CARCH}" == 'x86_64' ]] && echo -n "noarch" || echo -n "${CARCH}")
    
      22
    
      23prepare() {
    
      24  mkdir "${pkgname}_${pkgver}" "${pkgname}_legacy"
    
      25  bsdtar -xf "${_name}${_phase}/${_prefix}/${_archstr}/${pkgname}-${pkgver}-1.${_filearch}.rpm" -C "${pkgname}_${pkgver}"
    
      26# The legacy is version of software for support 9305 controllers, after this version the support of this controller is absent
    
      27  bsdtar -xf "${_name}28/${_prefix}/${_archstr}/${pkgname}-007.2703.0000.0000-1.${_filearch}.rpm" -C "${pkgname}_legacy"
    
      28}
    
      29
    
      30package() {
    
      31  install -Dm0755 "${pkgname}_${pkgver}/opt/MegaRAID/${pkgname}/${pkgname}64" "${pkgdir}/usr/bin/${pkgname}"
    
      32  install -Dm0755 "${pkgname}_legacy/opt/MegaRAID/${pkgname}/${pkgname}64" "${pkgdir}/usr/bin/${pkgname}-legacy"
    
      33  install -Dm0755 -d "${pkgdir}/opt/MegaRAID/${pkgname}"
    
      34  ln -s "/usr/bin/${pkgname}" "${pkgdir}/opt/MegaRAID/${pkgname}/${pkgname}"
    
      35  ln -s "/usr/bin/${pkgname}" "${pkgdir}/opt/MegaRAID/${pkgname}/${pkgname}64"
    
      36
    
      37  install -Dm0644 "${_name}${_phase}/${_prefix}/ThirdPartyLicenseNotice.pdf" \
    
      38    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.pdf"
    
      39}
    
      40

Changes since previous scan

--- PKGBUILD @ 2026-06-19 19:07
+++ PKGBUILD @ 2026-08-18 00:03
@@ -3,9 +3,9 @@
 
 pkgname='storcli'
 _name='STORCLI_SAS3.5_P'
-pkgver='007.3603.0000.0000'
+pkgver='007.3703.0000.0000'
 pkgrel='1'
-_phase='37'
+_phase='38'
 _prefix='univ_viva_cli_rel/Unified_storcli_all_os'
 pkgdesc="CLI program for LSI MegaRAID cards"
 url='https://www.broadcom.com/'
@@ -14,7 +14,7 @@
 makedepends=('libarchive')
 source=("https://docs.broadcom.com/docs-and-downloads/host-bus-adapters/host-bus-adapters-common-files/sas_sata_nvme_12g_p${_phase}/${_name}${_phase}.zip"
 	"https://docs.broadcom.com/docs-and-downloads/host-bus-adapters/host-bus-adapters-common-files/sas_sata_nvme_12g_p28/${_name}28.zip")
-sha256sums=('aa864c1055eb1488368593f72c0d064177fc53bd5857e4ac126a2b5a1784b754'
+sha256sums=('d0f6065d3ed2993d64eaa1df274f08c624d4dc61bcdd802a1afdb552f0b6b511'
             'c15ef2d5b66f1d5988aa2bc318c49025f248d69058533e02a8f0acc86681cc85')
 
 _archstr=$([[ "${CARCH}" == 'x86_64' ]] && echo -n "Linux" || echo -n "ARM/Linux")

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 00:26:13	LOW	2
2026-08-14 00:03:41	LOW	2
2026-08-13 00:17:07	LOW	2
2026-08-12 11:23:23	MEDIUM	1
2026-06-19 19:07:35	CLEAN	2
2026-06-19 18:54:17	CLEAN	2
2026-06-18 16:11:54	MEDIUM	1