wootility

MEDIUM

maintainer AlphaLynx 21 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt AppImage executable from a non-whitelisted but project-owned API endpoint (api.wooting.io), which is unverifiable and could be silently swapped, posing a supply-chain risk despite being from the official vendor.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("$_appimage::https://api.wooting.io/public/$pkgname/download?os=linux&version=$pkgver"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt AppImage executable from a non-whitelisted but project-owned API endpoint (api.wooting.io), which is unverifiable and could be silently swapped, posing a supply-chain risk despite being from the official vendor.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: AlphaLynx <alphalynx at alphalynx dot dev>
    
      2# Contributor: Frederik “Freso” S. Olesen <archlinux@freso.dk>
    
      3# Contributor: Shayne Hartford <shayneehartford@gmail.com>
    
      4
    
      5pkgname=wootility
    
      6_name=${pkgname^}
    
      7pkgver=5.4.1
    
      8pkgrel=1
    
      9pkgdesc='Utility for configuring Wooting keyboards'
    
      10arch=(x86_64)
    
      11url=https://wooting.io/$pkgname
    
      12license=(unknown)
    
      13depends=(glibc fuse2 hicolor-icon-theme zlib)
    
      14options=(!strip !debug)
    
      15_appimage=$_name-$pkgver.AppImage
    
      16source=("$_appimage::https://api.wooting.io/public/$pkgname/download?os=linux&version=$pkgver"
    
      17        70-wooting.rules)
    
      18noextract=($_appimage)
    
      19b2sums=('658e11bcb9a1d5ffde1329021fc096ca061ebc73024f430c0a125f0c1f3d8446d1b1130380399a7069168fc05dfc69385c490ff3b9502a2c29def1d7a2b25837'
    
      20        '80b4a516f8aafb6eada36cdde59295f2358b22e6cc28b1a21b0b5f22a59bcfabc63bba956d23544faca5fd76a1c4b4c1ff98ada41e7c9ad015d48c7c436dbac1')
    
      21
    
      22prepare() {
    
      23    # Copy AppImage in case $SRCDEST is mounted with noexec
    
      24    cp $_appimage $_appimage.copy
    
      25    chmod +x $_appimage.copy
    
      26    ./$_appimage.copy --appimage-extract $pkgname.desktop
    
      27    ./$_appimage.copy --appimage-extract usr/share/icons
    
      28    rm $_appimage.copy
    
      29
    
      30    # Adjust .desktop so it will work outside of AppImage container
    
      31    sed -i -E "s|Exec=AppRun|Exec=env DESKTOPINTEGRATION=false /usr/bin/$pkgname|" \
    
      32        "squashfs-root/$pkgname.desktop"
    
      33    # Fix permissions; .AppImage permissions are 700 for all directories
    
      34    chmod -R a-x+rX squashfs-root/usr
    
      35}
    
      36
    
      37package() {
    
      38    install -Dm755 $_appimage -t "$pkgdir/opt/$_name"
    
      39
    
      40    # Symlink executable
    
      41    install -d "$pkgdir/usr/bin/"
    
      42    ln -s /opt/$_name/$_appimage "$pkgdir/usr/bin/$pkgname"
    
      43
    
      44    # Install desktop entry and icons
    
      45    install -Dm644 squashfs-root/$pkgname.desktop -t "$pkgdir/usr/share/applications"
    
      46    install -d "$pkgdir/usr/share/"
    
      47    cp -a squashfs-root/usr/share/icons "$pkgdir/usr/share/"
    
      48
    
      49    # Install udev rules
    
      50    install -Dm644 70-wooting.rules -t "$pkgdir/usr/lib/udev/rules.d"
    
      51}
    
      52

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 05:10:45	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2