vfio-native-qemu

LOW

maintainer Sandwich 0 votes scanned 2026-10-21 00:12:50.227280

View on AUR

Why flagged

The source uses a non-standard host (git.archworks.co) for the patchset, but it is paired with an official qemu.org tarball; the patches are applied locally and the build is self-contained, limiting supply-chain risk to the patch content, which would need manual review but does not enable remote code execution.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source uses a non-standard host (git.archworks.co) for the patchset, but it is paired with an official qemu.org tarball; the patches are applied locally and the build is self-contained, limiting supply-chain risk to the patch content, which would need manual review but does not enable remote code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:25 "https://download.qemu.org/qemu-${_qver}.tar.xz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Sandwich <sandwich@archworks.co>
    
      2#
    
      3# QEMU 11.1.2 with the platform-identity patches from vfio-native, installed
    
      4# under /opt/qemu-native so the system qemu package is never touched. Clears
    
      5# FIRMWARE, VIRTUAL_DISK, DISK_SERIAL, PCI_VENDOR, DEVICES, QEMU_FW_CFG and
    
      6# QEMU_USB. Only the x86_64 system emulator is built.
    
      7
    
      8pkgname=vfio-native-qemu
    
      9_qver=11.1.2
    
      10_tag=1.4.2
    
      11pkgver=${_qver}
    
      12pkgrel=4
    
      13pkgdesc="QEMU ${_qver} with the vfio-native platform-identity patches, in /opt/qemu-native"
    
      14arch=('x86_64')
    
      15url="https://git.archworks.co/sandwich/vfio-native"
    
      16license=('GPL-2.0-only')
    
      17depends=('glib2' 'pixman' 'zlib' 'zstd' 'libaio' 'liburing' 'libcap-ng' 'libseccomp'
    
      18         'gnutls' 'nettle' 'libslirp' 'spice' 'spice-protocol' 'libepoxy' 'virglrenderer'
    
      19         'mesa' 'libjpeg-turbo' 'libpng' 'libusb' 'usbredir' 'numactl' 'libxkbcommon'
    
      20         'libgcrypt' 'libtasn1' 'lzo' 'snappy' 'pipewire')
    
      21makedepends=('git' 'meson' 'ninja' 'python')
    
      22optdepends=('vfio-native: the setup tooling that points a domain at this build')
    
      23options=('!strip')
    
      24source=("git+${url}.git#tag=v${_tag}"
    
      25        "https://download.qemu.org/qemu-${_qver}.tar.xz")
    
      26sha256sums=('SKIP'
    
      27            '731b5681e4bb18be313231579b8efd0296c5b015fa36dc533874b639ba838016')
    
      28
    
      29prepare() {
    
      30    cd "qemu-${_qver}"
    
      31    for p in "${srcdir}"/vfio-native/patches/qemu/[0-9][0-9]-*.patch; do
    
      32        msg2 "applying ${p##*/}"
    
      33        patch -Np1 --no-backup-if-mismatch -i "$p"
    
      34    done
    
      35}
    
      36
    
      37build() {
    
      38    cd "qemu-${_qver}"
    
      39    mkdir -p build && cd build
    
      40    ../configure --prefix=/opt/qemu-native --target-list=x86_64-softmmu \
    
      41        --enable-kvm --enable-spice --enable-opengl --enable-virglrenderer \
    
      42        --enable-tpm --enable-slirp --disable-docs --disable-werror --disable-user \
    
      43        --disable-gtk --disable-sdl
    
      44    ninja
    
      45}
    
      46
    
      47package() {
    
      48    cd "qemu-${_qver}/build"
    
      49    DESTDIR="${pkgdir}" ninja install
    
      50}
    
      51

Changes since previous scan

--- PKGBUILD @ 2026-10-10 04:12
+++ PKGBUILD @ 2026-10-21 00:12
@@ -7,9 +7,9 @@
 
 pkgname=vfio-native-qemu
 _qver=11.1.2
-_tag=1.4.1
+_tag=1.4.2
 pkgver=${_qver}
-pkgrel=3
+pkgrel=4
 pkgdesc="QEMU ${_qver} with the vfio-native platform-identity patches, in /opt/qemu-native"
 arch=('x86_64')
 url="https://git.archworks.co/sandwich/vfio-native"

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2
2026-10-12 00:18:51	Low	2
2026-10-11 00:26:05	Low	2
2026-10-10 12:14:12	Medium	1
2026-10-10 04:12:59	Medium	1
2026-10-10 02:12:41	Medium	1
2026-10-10 00:11:52	Low	2
2026-10-09 00:05:33	Low	2
2026-10-08 00:28:03	Low	2
2026-10-07 00:21:34	Low	2
2026-10-06 00:13:36	Low	2
2026-10-05 00:08:03	Low	2