wuffs-fuzzers

LOW
maintainer Kimiblock 0 votes base wuffs scanned 2026-11-01 00:21:48.120785
View on AUR
Why flagged

The flagged 'external install via go' is part of the project's own build process using upstream Go tools to compile and install its own command-line utilities, which are then packaged; this is normal for Go-based projects and does not involve untrusted or obfuscated remote code execution.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged 'external install via go' is part of the project's own build process using upstream Go tools to compile and install its own command-line utilities, which are then packaged; this is normal for Go-based projects and does not involve untrusted or obfuscated remote code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

  • PKGBUILD:60 go install github.com/google/wuffs/cmd/...

PKGBUILD

1 offending line(s) highlighted
1pkgbase="wuffs"
2
3pkgname=(
4 "wuffs-lib"
5 #"wuffs-examples"
6 "wuffs-fuzzers"
7 "wuffs-lang"
8 "wuffs-docs"
9 "wuffs-license"
10)
11
12pkgdesc="A memory-safe programming language, and a standard library, for Wrangling Untrusted File Formats Safely. Wrangling includes parsing, decoding and encoding. Example file formats include images, audio, video, fonts and compressed archives."
13
14pkgver=0.3.6
15pkgrel=1
16
17arch=(
18 'x86_64'
19)
20url="https://github.com/google/wuffs"
21license=(
22 "MIT"
23 "Apache-2.0"
24)
25makedepends=(
26 'gcc'
27 'gcc-libs'
28 'glibc'
29 'git'
30 'go'
31 "libxcb"
32 "lz4"
33 "sdl2"
34 "sdl2_image"
35 "xcb-util-image"
36 "xcb-util-renderutil"
37 "zlib"
38 "zstd"
39 "clang"
40)
41
42checkdepends=()
43
44source=(
45 "source::git+${url}.git#tag=v${pkgver}"
46)
47sha256sums=('575956ed312cd4e68e8f228f59be6e3ee340ff7ee0881a023e431e8643205c89')
48
49build() {
50 cd source
51 export GOPATH="${srcdir}/go"
52 export GOBIN="${GOPATH}/bin"
53 export PATH="/usr/bin:${GOPATH}/bin"
54 sed -i 's|go test|#go test|g' ./build-all.sh
55 sed -i 's|wuffs bench|#wuffs bench|g' ./build-all.sh
56 #./build-all.sh
57
58 CC=${CC:-gcc}
59 CXX=${CXX:-g++}
60 go install github.com/google/wuffs/cmd/...
61 wuffs gen
62 WARNING_FLAGS="-Wall -Werror -Wpedantic -Wcast-qual -Wcast-align -Wpointer-arith -Wfloat-equal -Wundef -Wvla -Wconversion -Wshadow -Wredundant-decls -Wunused-const-variable"
63 C_WARNING_FLAGS="$WARNING_FLAGS -Wstrict-prototypes -Wold-style-definition"
64 CXX_WARNING_FLAGS="$WARNING_FLAGS"
65 wuffs genlib -skipgen
66 wuffs test -skipgen -mimic
67 ./build-fuzz.sh
68}
69
70package_wuffs-lib() {
71 cd source
72 pkgdesc='A memory-safe standard library for Wrangling Untrusted File Formats Safely. Wrangling includes parsing, decoding and encoding. Example file formats include images, audio, video, fonts and compressed archives.'
73 depends=(
74 "glibc"
75 "wuffs-license"
76 )
77 provides=(
78 "libwuffs.so"
79 "libwuffs.a"
80 )
81 optdepends=(
82 "python-pywuffs: Python bindings"
83 "wuffs-docs: Docs"
84 )
85 install -vDm644 \
86 -t "${pkgdir}/usr/include" \
87 release/c/*.c gen/c/*.c
88 install -vDm644 \
89 -t "${pkgdir}/usr/include/wuffs" \
90 release/c/*.c gen/c/*.c
91 install -vDm755 \
92 -t "${pkgdir}/usr/lib" \
93 gen/lib/c/gcc-dynamic/libwuffs.so
94 install -vDm644 -t \
95 "${pkgdir}/usr/lib" \
96 gen/lib/c/gcc-static/libwuffs.a
97 install -vDm644 -t \
98 "${pkgdir}/usr/share/doc/wuffs-lib" \
99 release/c/README.md
100 install -vdm644 "${pkgdir}/usr/share/licenses"
101 ln -srf \
102 "${pkgdir}/usr/share/licenses/wuffs" \
103 "${pkgdir}/usr/share/licenses"/wuffs-lib
104}
105
106package_wuffs-examples() {
107 pkgdesc='Example programmes for wuffs, a memory-safe programming language and standard library for Wrangling Untrusted File Formats Safely.'
108 depends=(
109 "gcc-libs"
110 "glibc"
111 "sdl2"
112 "sdl2_image"
113 "xcb-util-image"
114 "xcb-util-renderutil"
115 "wuffs-license"
116 )
117 cd source
118 declare _bins
119 _bins=`ls -1 gen/bin/example-*`
120 for _bin in ${_bins}; do
121 _name="$(basename "${_bin}" | sed -E -e 's|^example-||')"
122 install -vDm755 \
123 "${_bin}" \
124 "${pkgdir}/usr/bin"/wuffs-"${_name}"
125 done
126 install -vDm644 -t \
127 "${pkgdir}/usr/share/doc/wuffs-examples" \
128 example/README.md
129 install -vdm644 "${pkgdir}/usr/share/licenses"
130 ln -srf \
131 "${pkgdir}/usr/share/licenses/wuffs" \
132 "${pkgdir}/usr/share/licenses"/wuffs-examples
133}
134
135package_wuffs-fuzzers() {
136 pkgdesc='Fuzzer programmes for wuffs, a memory-safe programming language and standard library for Wrangling Untrusted File Formats Safely.'
137 depends=(
138 "gcc-libs"
139 "glibc"
140 "wuffs-license"
141 )
142
143 cd source
144 declare _bins
145 _bins=`ls -1 gen/bin/fuzz-*`
146 for _bin in ${_bins}; do
147 _name="$(basename "${_bin}")"
148 install -vDm755 \
149 "${_bin}" \
150 "${pkgdir}/usr/bin"/wuffs-"${_name}"
151 done
152
153 install -vDm644 \
154 -t "${pkgdir}/usr/share/doc/wuffs-fuzzers" \
155 fuzz/c/std/README.md
156
157 install -vdm644 "${pkgdir}/usr/share/licenses"
158 ln -srf \
159 "${pkgdir}/usr/share/licenses/wuffs" \
160 "${pkgdir}/usr/share/licenses"/wuffs-fuzzers
161}
162
163package_wuffs-lang() {
164 pkgdesc='A memory-safe programming language for Wrangling Untrusted File Formats Safely. Wrangling includes parsing, decoding and encoding. Example file formats include images, audio, video, fonts and compressed archives.'
165 depends=(
166 "wuffs-license"
167
168 # ractool deps
169 glibc
170 liblz4.so
171 libz.so
172 libzstd.so
173 )
174 provides=(
175 "dumbindent=${pkgver}"
176 #"handsum=${pkgver}"
177 "ractool=${pkgver}"
178 "wuffs=${pkgver}"
179 "wuffs-c=${pkgver}"
180 "wuffsfmt=${pkgver}"
181 )
182 optdepends=(
183 "wuffs-docs: Docs"
184 )
185
186 cd source
187 export GOPATH="${srcdir}/go"
188 export GOBIN="${GOPATH}/bin"
189 install -Dvm755 \
190 -t "${pkgdir}/usr/bin" \
191 "${GOBIN}"/{dumbindent,ractool,wuffs,wuffs-c,wuffsfmt}
192 install -vdm644 \
193 "${pkgdir}/usr/share/licenses"
194 ln -srf \
195 "${pkgdir}/usr/share/licenses/wuffs" \
196 "${pkgdir}/usr/share/licenses"/wuffs-lang
197}
198
199package_wuffs-docs() {
200 pkgdesc='Documentation for "Wuffs the Library" and "Wuffs the Language", as well as the corresponding example binaries.'
201 depends=("wuffs-license")
202 arch=('any')
203
204 cd source
205 install -Dvm644 \
206 -t "${pkgdir}/usr/share/doc/wuffs" \
207 AUTHORS \
208 *.md \
209 CONTRIBUTORS
210 cp -r \
211 doc \
212 "${pkgdir}/usr/share/doc/wuffs"/
213 install -vdm644 \
214 "${pkgdir}/usr/share/licenses"
215 ln -srf \
216 "${pkgdir}/usr/share/licenses/wuffs" \
217 "${pkgdir}/usr/share/licenses"/wuffs-docs
218}
219
220package_wuffs-license() {
221 pkgdesc='Common license for "Wuffs the Library" and "Wuffs the Language", as well as the corresponding example binaries.'
222 depends=()
223 arch=('any')
224 cd source
225 install -vDm644 \
226 -t "${pkgdir}/usr/share/licenses/wuffs" \
227 LICENSE*
228 ln -srf \
229 "${pkgdir}/usr/share/licenses/wuffs" \
230 "${pkgdir}/usr/share/licenses"/wuffs-license
231 ln -srf \
232 "${pkgdir}/usr/share/licenses/wuffs" \
233 "${pkgdir}/usr/share/licenses"/wuffs-license
234}
235

Changes since previous scan

--- PKGBUILD @ 2026-10-20 00:10
+++ PKGBUILD @ 2026-11-01 00:21
@@ -11,7 +11,7 @@
pkgdesc="A memory-safe programming language, and a standard library, for Wrangling Untrusted File Formats Safely. Wrangling includes parsing, decoding and encoding. Example file formats include images, audio, video, fonts and compressed archives."
-pkgver=0.3.5
+pkgver=0.3.6
pkgrel=1
arch=(
@@ -44,7 +44,7 @@
source=(
"source::git+${url}.git#tag=v${pkgver}"
)
-sha256sums=('b9b5e80b0cd003da7fac2fa9cb4f7bf76806f9a88f867cc9a9eb2996514fce36')
+sha256sums=('575956ed312cd4e68e8f228f59be6e3ee340ff7ee0881a023e431e8643205c89')
build() {
cd source

Scan history

Scanned at (UTC)SeverityRules
2026-11-01 00:21:48 Low 2
2026-10-31 00:07:41 Low 2
2026-10-30 00:29:30 Low 2
2026-10-29 00:13:55 Low 2
2026-10-28 00:06:54 Low 2
2026-10-27 00:23:28 Low 2
2026-10-26 00:12:40 Low 2
2026-10-25 00:20:48 Low 2
2026-10-24 00:14:55 Low 2
2026-10-23 00:02:19 Low 2
2026-10-22 00:13:10 Low 2
2026-10-21 00:12:50 Low 2
2026-10-20 13:28:00 Medium 1
2026-10-20 00:10:31 Low 2
2026-10-19 00:03:55 Low 2
2026-10-18 00:06:55 Low 2
2026-10-17 00:21:55 Low 2
2026-10-16 00:12:47 Low 2
2026-10-15 00:28:05 Low 2
2026-10-14 00:06:47 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion