vfio-native-qemu

LOW

maintainer Sandwich 0 votes scanned 2026-09-06 00:17:06.051191

View on AUR

Why flagged

The git source is from a personal/project host (archworks.co) with SKIP'd checksum, but it only provides patch files applied to the official QEMU tarball (which has a verified sha256sum); the worst case of a swapped git repo is malicious patches applied to QEMU source, which is a real but limited supply-chain concern typical of any AUR patch-set package rather than clear malice.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 75%): The git source is from a personal/project host (archworks.co) with SKIP'd checksum, but it only provides patch files applied to the official QEMU tarball (which has a verified sha256sum); the worst case of a swapped git repo is malicious patches applied to QEMU source, which is a real but limited supply-chain concern typical of any AUR patch-set package rather than clear malice.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:25 "https://download.qemu.org/qemu-${_qver}.tar.xz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Sandwich <sandwich@archworks.co>
    
      2#
    
      3# QEMU 11.1.1 with the platform-identity patches from vfio-native, installed
    
      4# under /opt/qemu-native so the system qemu package is never touched. Clears
    
      5# FIRMWARE, VIRTUAL_DISK, DISK_SERIAL, PCI_VENDOR, DEVICES, QEMU_FW_CFG and
    
      6# QEMU_USB. Only the x86_64 system emulator is built.
    
      7
    
      8pkgname=vfio-native-qemu
    
      9_qver=11.1.1
    
      10_tag=1.1.0
    
      11pkgver=${_qver}
    
      12pkgrel=1
    
      13pkgdesc="QEMU ${_qver} with the vfio-native platform-identity patches, in /opt/qemu-native"
    
      14arch=('x86_64')
    
      15url="https://git.archworks.co/sandwich/vfio-native"
    
      16license=('GPL-2.0-only')
    
      17depends=('glib2' 'pixman' 'zlib' 'zstd' 'libaio' 'liburing' 'libcap-ng' 'libseccomp'
    
      18         'gnutls' 'nettle' 'libslirp' 'spice' 'spice-protocol' 'libepoxy' 'virglrenderer'
    
      19         'mesa' 'libjpeg-turbo' 'libpng' 'libusb' 'usbredir' 'numactl' 'libxkbcommon'
    
      20         'libgcrypt' 'libtasn1' 'lzo' 'snappy' 'pipewire')
    
      21makedepends=('git' 'meson' 'ninja' 'python')
    
      22optdepends=('vfio-native: the setup tooling that points a domain at this build')
    
      23options=('!strip')
    
      24source=("git+${url}.git#tag=v${_tag}"
    
      25        "https://download.qemu.org/qemu-${_qver}.tar.xz")
    
      26sha256sums=('SKIP'
    
      27            '079ffbff8a7111bbc89022107cbabf3bbfd614d5fc9d7cc675991196aca12482')
    
      28
    
      29prepare() {
    
      30    cd "qemu-${_qver}"
    
      31    for p in "${srcdir}"/vfio-native/patches/qemu/0[1-8]-*.patch; do
    
      32        msg2 "applying ${p##*/}"
    
      33        patch -Np1 --no-backup-if-mismatch -i "$p"
    
      34    done
    
      35}
    
      36
    
      37build() {
    
      38    cd "qemu-${_qver}"
    
      39    mkdir -p build && cd build
    
      40    ../configure --prefix=/opt/qemu-native --target-list=x86_64-softmmu \
    
      41        --enable-kvm --enable-spice --enable-opengl --enable-virglrenderer \
    
      42        --enable-tpm --enable-slirp --disable-docs --disable-werror --disable-user \
    
      43        --disable-gtk --disable-sdl
    
      44    ninja
    
      45}
    
      46
    
      47package() {
    
      48    cd "qemu-${_qver}/build"
    
      49    DESTDIR="${pkgdir}" ninja install
    
      50}
    
      51

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-06 00:17:06	Low	3
2026-09-06 00:03:06	Low	3
2026-09-06 00:01:42	Medium	2