wootility

MEDIUM

maintainer AlphaLynx 21 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt AppImage executable from a non-whitelisted but project-owned API endpoint (api.wooting.io), which is unverifiable and could be silently swapped, posing a supply-chain risk despite being from the official vendor.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("$_appimage::https://api.wooting.io/public/$pkgname/download?os=linux&version=$pkgver"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt AppImage executable from a non-whitelisted but project-owned API endpoint (api.wooting.io), which is unverifiable and could be silently swapped, posing a supply-chain risk despite being from the official vendor.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: AlphaLynx <alphalynx at alphalynx dot dev>
    
      2# Contributor: Frederik “Freso” S. Olesen <archlinux@freso.dk>
    
      3# Contributor: Shayne Hartford <shayneehartford@gmail.com>
    
      4
    
      5pkgname=wootility
    
      6_name=${pkgname^}
    
      7pkgver=5.4.1
    
      8pkgrel=1
    
      9pkgdesc='Utility for configuring Wooting keyboards'
    
      10arch=(x86_64)
    
      11url=https://wooting.io/$pkgname
    
      12license=(unknown)
    
      13depends=(glibc fuse2 hicolor-icon-theme zlib)
    
      14options=(!strip !debug)
    
      15_appimage=$_name-$pkgver.AppImage
    
      16source=("$_appimage::https://api.wooting.io/public/$pkgname/download?os=linux&version=$pkgver"
    
      17        70-wooting.rules)
    
      18noextract=($_appimage)
    
      19b2sums=('658e11bcb9a1d5ffde1329021fc096ca061ebc73024f430c0a125f0c1f3d8446d1b1130380399a7069168fc05dfc69385c490ff3b9502a2c29def1d7a2b25837'
    
      20        '80b4a516f8aafb6eada36cdde59295f2358b22e6cc28b1a21b0b5f22a59bcfabc63bba956d23544faca5fd76a1c4b4c1ff98ada41e7c9ad015d48c7c436dbac1')
    
      21
    
      22prepare() {
    
      23    # Copy AppImage in case $SRCDEST is mounted with noexec
    
      24    cp $_appimage $_appimage.copy
    
      25    chmod +x $_appimage.copy
    
      26    ./$_appimage.copy --appimage-extract $pkgname.desktop
    
      27    ./$_appimage.copy --appimage-extract usr/share/icons
    
      28    rm $_appimage.copy
    
      29
    
      30    # Adjust .desktop so it will work outside of AppImage container
    
      31    sed -i -E "s|Exec=AppRun|Exec=env DESKTOPINTEGRATION=false /usr/bin/$pkgname|" \
    
      32        "squashfs-root/$pkgname.desktop"
    
      33    # Fix permissions; .AppImage permissions are 700 for all directories
    
      34    chmod -R a-x+rX squashfs-root/usr
    
      35}
    
      36
    
      37package() {
    
      38    install -Dm755 $_appimage -t "$pkgdir/opt/$_name"
    
      39
    
      40    # Symlink executable
    
      41    install -d "$pkgdir/usr/bin/"
    
      42    ln -s /opt/$_name/$_appimage "$pkgdir/usr/bin/$pkgname"
    
      43
    
      44    # Install desktop entry and icons
    
      45    install -Dm644 squashfs-root/$pkgname.desktop -t "$pkgdir/usr/share/applications"
    
      46    install -d "$pkgdir/usr/share/"
    
      47    cp -a squashfs-root/usr/share/icons "$pkgdir/usr/share/"
    
      48
    
      49    # Install udev rules
    
      50    install -Dm644 70-wooting.rules -t "$pkgdir/usr/lib/udev/rules.d"
    
      51}
    
      52

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2
2026-10-13 00:23:45	Medium	2