wootility

maintainer AlphaLynx · 21 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt AppImage executable from a non-whitelisted but project-owned API endpoint (api.wooting.io), which is unverifiable and could be silently swapped, posing a supply-chain risk despite being from the official vendor.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("$_appimage::https://api.wooting.io/public/$pkgname/download?os=linux&version=$pkgver"

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt AppImage executable from a non-whitelisted but project-owned API endpoint (api.wooting.io), which is unverifiable and could be silently swapped, posing a supply-chain risk despite being from the official vendor.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: AlphaLynx <alphalynx at alphalynx dot dev>
    
      2# Contributor: Frederik “Freso” S. Olesen <archlinux@freso.dk>
    
      3# Contributor: Shayne Hartford <shayneehartford@gmail.com>
    
      4
    
      5pkgname=wootility
    
      6_name=${pkgname^}
    
      7pkgver=5.4.1
    
      8pkgrel=1
    
      9pkgdesc='Utility for configuring Wooting keyboards'
    
      10arch=(x86_64)
    
      11url=https://wooting.io/$pkgname
    
      12license=(unknown)
    
      13depends=(glibc fuse2 hicolor-icon-theme zlib)
    
      14options=(!strip !debug)
    
      15_appimage=$_name-$pkgver.AppImage
    
      16source=("$_appimage::https://api.wooting.io/public/$pkgname/download?os=linux&version=$pkgver"
    
      17        70-wooting.rules)
    
      18noextract=($_appimage)
    
      19b2sums=('658e11bcb9a1d5ffde1329021fc096ca061ebc73024f430c0a125f0c1f3d8446d1b1130380399a7069168fc05dfc69385c490ff3b9502a2c29def1d7a2b25837'
    
      20        '80b4a516f8aafb6eada36cdde59295f2358b22e6cc28b1a21b0b5f22a59bcfabc63bba956d23544faca5fd76a1c4b4c1ff98ada41e7c9ad015d48c7c436dbac1')
    
      21
    
      22prepare() {
    
      23    # Copy AppImage in case $SRCDEST is mounted with noexec
    
      24    cp $_appimage $_appimage.copy
    
      25    chmod +x $_appimage.copy
    
      26    ./$_appimage.copy --appimage-extract $pkgname.desktop
    
      27    ./$_appimage.copy --appimage-extract usr/share/icons
    
      28    rm $_appimage.copy
    
      29
    
      30    # Adjust .desktop so it will work outside of AppImage container
    
      31    sed -i -E "s|Exec=AppRun|Exec=env DESKTOPINTEGRATION=false /usr/bin/$pkgname|" \
    
      32        "squashfs-root/$pkgname.desktop"
    
      33    # Fix permissions; .AppImage permissions are 700 for all directories
    
      34    chmod -R a-x+rX squashfs-root/usr
    
      35}
    
      36
    
      37package() {
    
      38    install -Dm755 $_appimage -t "$pkgdir/opt/$_name"
    
      39
    
      40    # Symlink executable
    
      41    install -d "$pkgdir/usr/bin/"
    
      42    ln -s /opt/$_name/$_appimage "$pkgdir/usr/bin/$pkgname"
    
      43
    
      44    # Install desktop entry and icons
    
      45    install -Dm644 squashfs-root/$pkgname.desktop -t "$pkgdir/usr/share/applications"
    
      46    install -d "$pkgdir/usr/share/"
    
      47    cp -a squashfs-root/usr/share/icons "$pkgdir/usr/share/"
    
      48
    
      49    # Install udev rules
    
      50    install -Dm644 70-wooting.rules -t "$pkgdir/usr/lib/udev/rules.d"
    
      51}
    
      52

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 05:47:53	MEDIUM	2