ubi_reader

maintainer yataro · 7 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The package builds from source hosted on the project's official GitHub repository, which is a normal and safe practice for AUR packages; the flagged 'recently orphaned & re-adopted' status does not indicate inherent danger.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from source hosted on the project's official GitHub repository, which is a normal and safe practice for AUR packages; the flagged 'recently orphaned & re-adopted' status does not indicate inherent danger.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: Ryan Farley <ryan.farley@gmx.com>
    
      2# Contributor: Thomas Sänger <thomas+aur@gecko.space>
    
      3# Contributor: Sergej Pupykin <pupykin.s+arch@gmail.com>
    
      4# Contributor: Morgan LEFIEUX <comete_AT_archlinuxfr.org>
    
      5
    
      6pkgname=ubi_reader
    
      7pkgver=0.8.14
    
      8pkgrel=1
    
      9pkgdesc="Collection of Python scripts for reading information about and extracting data from UBI and UBIFS images."
    
      10arch=("any")
    
      11url="https://github.com/onekey-sec/ubi_reader"
    
      12license=("GPL-3.0-or-later")
    
      13depends=("python" "python-lzo" "python-lzallright" "python-cryptography" "python-zstandard")
    
      14makedepends=("python-build" "python-installer" "python-wheel" "python-poetry")
    
      15source=("$pkgname-$pkgver.tar.gz::https://github.com/onekey-sec/ubi_reader/archive/refs/tags/$pkgver.tar.gz")
    
      16b2sums=('e84700ac83937850dc4237a2018fbafaa07642f2d540fcb3d36a2eb69fbf5eeb8d9bef3b1132cefa2272b1c47b013980ad3ae3473d6cd3416168aea01d2a52b4')
    
      17
    
      18build() {
    
      19  cd "${pkgname}-${pkgver}"
    
      20  python -m build --wheel --no-isolation
    
      21}
    
      22
    
      23package() {
    
      24  cd "${pkgname}-${pkgver}"
    
      25  python -m installer --destdir="$pkgdir" dist/*.whl
    
      26}
    
      27

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-18 00:03
@@ -4,16 +4,16 @@
 # Contributor: Morgan LEFIEUX <comete_AT_archlinuxfr.org>
 
 pkgname=ubi_reader
-pkgver=0.8.12
+pkgver=0.8.14
 pkgrel=1
 pkgdesc="Collection of Python scripts for reading information about and extracting data from UBI and UBIFS images."
 arch=("any")
-url="https://github.com/jrspruitt/ubi_reader"
-license=("GPL3")
-depends=("python" "python-lzo")
+url="https://github.com/onekey-sec/ubi_reader"
+license=("GPL-3.0-or-later")
+depends=("python" "python-lzo" "python-lzallright" "python-cryptography" "python-zstandard")
 makedepends=("python-build" "python-installer" "python-wheel" "python-poetry")
 source=("$pkgname-$pkgver.tar.gz::https://github.com/onekey-sec/ubi_reader/archive/refs/tags/$pkgver.tar.gz")
-b2sums=('c274e89c9f62127d36f06ac5cebec8d5a4806bf7c1746d9bad4adaafe9b5e8add79cd0c5b267d815fdc0b9c6c9c2033ca905e6fa464fec11ebc94f973ecb4d32')
+b2sums=('e84700ac83937850dc4237a2018fbafaa07642f2d540fcb3d36a2eb69fbf5eeb8d9bef3b1132cefa2272b1c47b013980ad3ae3473d6cd3416168aea01d2a52b4')
 
 build() {
   cd "${pkgname}-${pkgver}"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 00:26:13	LOW	2
2026-08-14 00:03:41	LOW	2
2026-08-13 00:17:07	LOW	2
2026-08-12 17:24:46	MEDIUM	1
2026-06-26 22:27:36	CLEAN	0
2026-06-18 16:11:54	CLEAN	0