wuffs-fuzzers-git

LOW
maintainer dreieck 0 votes base wuffs-git scanned 2026-10-02 00:00:32.890515
View on AUR
Why flagged

The package builds from the official GitHub source of a legitimate project and uses 'go get' to fetch build tools from the same trusted domain; the non-standard host is due to variable use but resolves to github.com, posing no real risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from the official GitHub source of a legitimate project and uses 'go get' to fetch build tools from the same trusted domain; the non-standard host is due to variable use but resolves to github.com, posing no real risk.

2 higher static findings superseded - not the current verdict (shown for transparency)
Medium External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

  • PKGBUILD:120 go install -v -modcacherw github.com/google/wuffs/cmd/...
Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:56 "${_gitname}::git+https://${_githost}/${_gituser}/${_gitname}.git"

PKGBUILD

2 offending line(s) highlighted
1# Maintainer: dreieck (https://aur.archlinux.org/account/dreieck)
2
3_gitname="wuffs"
4_pkgbase="${_gitname}"
5pkgbase="${_pkgbase}-git"
6
7pkgname=(
8 "${_pkgbase}-lib-git"
9 "${_pkgbase}-examples-git"
10 "${_pkgbase}-fuzzers-git"
11 "${_pkgbase}-lang-git"
12 "${_pkgbase}-docs-git"
13 "${_pkgbase}-license-git"
14)
15
16pkgdesc="A memory-safe programming language, and a standard library, for Wrangling Untrusted File Formats Safely. Wrangling includes parsing, decoding and encoding. Example file formats include images, audio, video, fonts and compressed archives."
17
18pkgver=0.3.5+47.r4035.20260916.f31d952b
19pkgrel=1
20
21arch=(
22 'i686'
23 'x86_64'
24 'armv6h'
25 'armv7h'
26 'aarch64'
27 'pentium4'
28 'riscv64'
29)
30_githost='github.com'
31_gituser='google'
32url="https://${_githost}/${_gituser}/${_gitname}"
33license=(
34 "MIT"
35 "Apache-2.0"
36)
37makedepends=(
38 'gcc' # Yes, it needs both clang and GCC!
39 'gcc-libs'
40 'glibc'
41 'git'
42 'go'
43 "libxcb"
44 "lz4"
45 "sdl2"
46 "sdl2_image"
47 "xcb-util-image"
48 "xcb-util-renderutil"
49 "zlib"
50 "zstd"
51)
52
53checkdepends=()
54
55source=(
56 "${_gitname}::git+https://${_githost}/${_gituser}/${_gitname}.git"
57 # "wuffs-build-all_disable-tests.patch" # Not needed if we don't run build-all.sh.
58 "wuffs-test-all.sh"
59)
60sha256sums=(
61 'SKIP' # Main upstream source.
62 # '85cbe5911efa30fde54fc364aecf8f2d1e89f0cb387654127d020037caef447c' # wuffs-build-all_disable-tests.patch
63 '2cd9df1708364eb3db73c56beb5bd0400adef6d670033195c4647378ec612d29' # wuffs-test-all.sh
64)
65
66prepare() {
67 export GOPATH="${srcdir}/.go"
68 export GOBIN="${GOPATH}/bin"
69
70 cd "${srcdir}/${_gitname}"
71
72 # for _patch in "${srcdir}"/wuffs-build-all_disable-tests.patch; do # Not needed if we don't run build-all.sh.
73 # printf '%s\n' " -> Applying patch '$(basename "${_patch}")' ..."
74 # patch -Np1 --follow-symlinks -i "${_patch}"
75 # done
76
77 printf '%s\n' " --> running 'go get -v -modcacherw github.com/google/wuffs/cmd/...' ..."
78 go get -v -modcacherw github.com/google/wuffs/cmd/...
79 printf '\n'
80
81 git log > "${srcdir}/git.log"
82}
83
84pkgver() {
85 cd "${srcdir}/${_gitname}"
86
87 _ver="$(git describe --tags | sed -E -e 's|^spin-in-||' -e 's|^[vV]||' -e 's|\-g[0-9a-f]*$||' | tr '-' '+')"
88 _rev="$(git rev-list --count HEAD)"
89 _date="$(git log -1 --date=format:"%Y%m%d" --format="%ad")"
90 _hash="$(git rev-parse --short HEAD)"
91
92 if [ -z "${_ver}" ]; then
93 error "Version could not be determined."
94 return 1
95 else
96 printf '%s' "${_ver}.r${_rev}.${_date}.${_hash}"
97 fi
98}
99
100build() {
101 export GOPATH="${srcdir}/.go"
102 export GOBIN="${GOPATH}/bin"
103 export PATH="${GOBIN}:${PATH}"
104
105 local _CFLAGSADDITIONS=""
106 local _SILENCEWARNINGS=("stringop-overflow")
107 local _warning
108 for _warning in "${_SILENCEWARNINGS[@]}"; do
109 _CFLAGSADDITIONS+=" -Wno-${_warning} -Wno-error=${_warning}"
110 done
111 CFLAGS+="${_CFLAGSADDITIONS}"
112 CXXFLAGS+="${_CFLAGSADDITIONS}"
113 export CFLAGS
114 export CXXFLAGS
115
116 cd "${srcdir}/${_gitname}"
117
118 # Excerpts from build-all.sh:
119 printf '%s\n' " --> running 'go install -v -modcacherw github.com/google/wuffs/cmd/...' ..."
120 go install -v -modcacherw github.com/google/wuffs/cmd/...
121 printf '\n'
122 printf '%s\n' " --> running 'wuffs gen -langs 'c'' ..."
123 wuffs gen -langs 'c'
124 printf '\n'
125 printf '%s\n' " --> running 'wuffs genlib -ccompilers gcc -langs 'c' -skipgen' ..."
126 wuffs genlib -ccompilers gcc -langs 'c' -skipgen
127 printf '\n'
128 printf '%s\n' " --> running './build-example.sh' ..."
129 ./build-example.sh
130 printf '\n'
131 printf '%s\n' " --> running './build-fuzz.sh' ..."
132 ./build-fuzz.sh
133 printf '\n'
134}
135
136# ### 2026-08-03: `check()` Disabled, since `gen/bin/fuzz-pixel_swizzler` crashes with a segmentation fault.
137# check() {
138# cd "${srcdir}/${_gitname}"
139#
140# "${srcdir}"/wuffs-test-all.sh
141# }
142
143package_wuffs-lib-git() {
144 pkgdesc='A memory-safe standard library for Wrangling Untrusted File Formats Safely. Wrangling includes parsing, decoding and encoding. Example file formats include images, audio, video, fonts and compressed archives.'
145 depends=(
146 "glibc"
147 "wuffs-license"
148 )
149 provides=(
150 "wuffs-lib=${pkgver}"
151 "libwuffs.so"
152 "libwuffs.a"
153 )
154 conflicts=(
155 "wuffs-lib"
156 )
157 optdepends=(
158 "python-pywuffs: For python binding."
159 "wuffs-docs: For the documentation of this software."
160 )
161
162 cd "${srcdir}/${_gitname}"
163
164 install -Dvm644 -t "${pkgdir}/usr/include" release/c/*.c gen/c/*.c
165 install -Dvm755 -t "${pkgdir}/usr/lib" gen/lib/c/gcc-dynamic/libwuffs.so
166 install -Dvm644 -t "${pkgdir}/usr/lib" gen/lib/c/gcc-static/libwuffs.a
167
168 install -Dvm644 -t "${pkgdir}/usr/share/doc/wuffs-lib" release/c/README.md
169
170 install -dvm755 "${pkgdir}/usr/share/licenses"
171 ln -svr "${pkgdir}/usr/share/licenses/wuffs" "${pkgdir}/usr/share/licenses"/wuffs-lib-git
172}
173
174package_wuffs-examples-git() {
175 pkgdesc='Example programmes for wuffs, a memory-safe programming language and standard library for Wrangling Untrusted File Formats Safely.'
176 depends=(
177 "gcc-libs"
178 "glibc"
179 "sdl2"
180 "sdl2_image"
181 "xcb-util-image"
182 "xcb-util-renderutil"
183 "wuffs-license"
184 )
185 provides=(
186 "wuffs-examples=${pkgver}"
187 )
188 conflicts=(
189 "wuffs-examples"
190 )
191 optdepends=(
192 "wuffs-docs: For the documentation of this software."
193 )
194
195 cd "${srcdir}/${_gitname}"
196
197 local _bins _bin
198 _bins=`ls -1 gen/bin/example-*`
199 for _bin in ${_bins}; do
200 _name="$(basename "${_bin}" | sed -E -e 's|^example-||')"
201 install -Dvm755 "${_bin}" "${pkgdir}/usr/bin"/wuffs-"${_name}"
202 done
203
204 install -Dvm644 -t "${pkgdir}/usr/share/doc/wuffs-examples" example/README.md
205
206 install -dvm755 "${pkgdir}/usr/share/licenses"
207 ln -svr "${pkgdir}/usr/share/licenses/wuffs" "${pkgdir}/usr/share/licenses"/wuffs-examples-git
208}
209
210package_wuffs-fuzzers-git() {
211 pkgdesc='Fuzzer programmes for wuffs, a memory-safe programming language and standard library for Wrangling Untrusted File Formats Safely.'
212 depends=(
213 "gcc-libs"
214 "glibc"
215 "wuffs-license"
216 )
217 provides=(
218 "wuffs-fuzzers=${pkgver}"
219 )
220 conflicts=(
221 "wuffs-fuzzers"
222 )
223 optdepends=(
224 "wuffs-docs: For the documentation of this software."
225 )
226
227 cd "${srcdir}/${_gitname}"
228
229 local _bins _bin
230 _bins=`ls -1 gen/bin/fuzz-*`
231 for _bin in ${_bins}; do
232 _name="$(basename "${_bin}")"
233 install -Dvm755 "${_bin}" "${pkgdir}/usr/bin"/wuffs-"${_name}"
234 done
235
236 install -Dvm644 -t "${pkgdir}/usr/share/doc/wuffs-fuzzers" fuzz/c/std/README.md
237
238 install -dvm755 "${pkgdir}/usr/share/licenses"
239 ln -svr "${pkgdir}/usr/share/licenses/wuffs" "${pkgdir}/usr/share/licenses"/wuffs-fuzzers-git
240}
241
242package_wuffs-lang-git() {
243 pkgdesc='A memory-safe programming language for Wrangling Untrusted File Formats Safely. Wrangling includes parsing, decoding and encoding. Example file formats include images, audio, video, fonts and compressed archives.'
244 depends=(
245 "wuffs-license"
246 )
247 provides=(
248 "wuffs-lang=${pkgver}"
249 "dumbindent=${pkgver}"
250 "handsum=${pkgver}"
251 "ractool=${pkgver}"
252 "wuffs=${pkgver}"
253 "wuffs-c=${pkgver}"
254 "wuffsfmt=${pkgver}"
255 )
256 conflicts=(
257 "wuffs-lang"
258 "dumbindent"
259 "handsum"
260 "ractool"
261 "wuffs"
262 "wuffs-c"
263 "wuffsfmt"
264 )
265 optdepends=(
266 "glibc: For 'ractool'."
267 "liblz4.so: For 'ractool'."
268 "libz.so: For 'ractool'."
269 "libzstd.so: For 'ractool'."
270 "wuffs-docs: For the documentation of this software."
271 )
272
273 export GOPATH="${srcdir}/.go"
274 export GOBIN="${GOPATH}/bin"
275
276 cd "${srcdir}/${_gitname}"
277
278 install -Dvm755 -t "${pkgdir}/usr/bin" "${GOBIN}"/{dumbindent,handsum,ractool,wuffs,wuffs-c,wuffsfmt}
279
280 install -dvm755 "${pkgdir}/usr/share/licenses"
281 ln -svr "${pkgdir}/usr/share/licenses/wuffs" "${pkgdir}/usr/share/licenses"/wuffs-lang-git
282}
283
284package_wuffs-docs-git() {
285 pkgdesc='Documentation for "Wuffs the Library" and "Wuffs the Language", as well as the corresponding example binaries.'
286 depends=("wuffs-license")
287 provides=(
288 "wuffs-docs=${pkgver}"
289 )
290 conflicts=(
291 "wuffs-docs"
292 )
293 optdepends=(
294 "wuffs-lib: The library this documentation is for."
295 "wuffs-lang: The programming language this documentation is for."
296 "wuffs-examples: The example programmes this documentation is for."
297 "wuffs-fuzzers: The fuzzer programmes this documentation is for."
298 )
299 arch=('any')
300
301 cd "${srcdir}/${_gitname}"
302
303 install -Dvm644 -t "${pkgdir}/usr/share/doc/${_pkgbase}" "${srcdir}"/git.log AUTHORS BUILD.md CONTRIBUTING.md CONTRIBUTORS README.md
304 cp -rv doc "${pkgdir}/usr/share/doc/${_pkgbase}"/
305
306 install -dvm755 "${pkgdir}/usr/share/licenses"
307 ln -svr "${pkgdir}/usr/share/licenses/wuffs" "${pkgdir}/usr/share/licenses"/wuffs-docs-git
308}
309
310package_wuffs-license-git() {
311 pkgdesc='Common license for "Wuffs the Library" and "Wuffs the Language", as well as the corresponding example binaries.'
312 depends=()
313 provides=(
314 "wuffs-license=${pkgver}"
315 )
316 conflicts=(
317 "wuffs-license"
318 )
319 optdepends=(
320 "wuffs-lib: The library this license is for."
321 "wuffs-lang: The programming language this license is for."
322 "wuffs-examples: The example programmes this license is for."
323 "wuffs-fuzzers: The fuzzer programmes this license is for."
324 )
325 arch=('any')
326
327 cd "${srcdir}/${_gitname}"
328
329 cd "${srcdir}/${_gitname}"
330 install -Dvm644 -t "${pkgdir}/usr/share/licenses/wuffs" LICENSE LICENSE-APACHE LICENSE-MIT
331 ln -svr "${pkgdir}/usr/share/licenses/wuffs" "${pkgdir}/usr/share/licenses"/wuffs-license-git
332 ln -svr "${pkgdir}/usr/share/licenses/wuffs" "${pkgdir}/usr/share/licenses"/wuffs-license
333}
334

Changes since previous scan

--- PKGBUILD @ 2026-09-22 00:15
+++ PKGBUILD @ 2026-10-02 00:00
@@ -15,7 +15,7 @@
pkgdesc="A memory-safe programming language, and a standard library, for Wrangling Untrusted File Formats Safely. Wrangling includes parsing, decoding and encoding. Example file formats include images, audio, video, fonts and compressed archives."
-pkgver=0.3.5+30.r4018.20260903.0f214ba5
+pkgver=0.3.5+47.r4035.20260916.f31d952b
pkgrel=1
arch=(

Scan history

Scanned at (UTC)SeverityRules
2026-10-02 00:00:32 Low 3
2026-10-01 00:02:06 Low 3
2026-09-30 00:20:07 Low 3
2026-09-29 00:07:46 Low 3
2026-09-28 00:28:32 Low 3
2026-09-27 00:07:07 Low 3
2026-09-26 00:12:15 Low 3
2026-09-25 00:03:36 Low 3
2026-09-24 00:24:14 Low 3
2026-09-23 00:28:13 Low 3
2026-09-22 13:37:53 Medium 2
2026-09-22 00:15:14 Low 3
2026-09-21 00:26:32 Low 3
2026-09-20 00:25:31 Low 3
2026-09-19 00:25:36 Low 3
2026-09-18 00:17:11 Low 3
2026-09-17 00:27:14 Low 3
2026-09-16 00:03:17 Low 3
2026-09-15 00:25:31 Low 3
2026-09-14 00:27:57 Low 3

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion