◎ AURWatch - AUR Security Monitor
scan coverage …
Last scan …
Next scan -

wuffs-lib

maintainer Kimiblock · 0 votes · base wuffs · scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged The flagged 'external install via go' refers to 'go install' of the project's own cmd/... tools from the fetched source, which is a normal part of building Go projects and not a supply-chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged 'external install via go' refers to 'go install' of the project's own cmd/... tools from the fetched source, which is a normal part of building Go projects and not a supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

  • PKGBUILD:60 go install github.com/google/wuffs/cmd/...

PKGBUILD

1 offending line(s) highlighted
1pkgbase="wuffs"
2
3pkgname=(
4 "wuffs-lib"
5 #"wuffs-examples"
6 "wuffs-fuzzers"
7 "wuffs-lang"
8 "wuffs-docs"
9 "wuffs-license"
10)
11
12pkgdesc="A memory-safe programming language, and a standard library, for Wrangling Untrusted File Formats Safely. Wrangling includes parsing, decoding and encoding. Example file formats include images, audio, video, fonts and compressed archives."
13
14pkgver=0.3.5
15pkgrel=1
16
17arch=(
18 'x86_64'
19)
20url="https://github.com/google/wuffs"
21license=(
22 "MIT"
23 "Apache-2.0"
24)
25makedepends=(
26 'gcc'
27 'gcc-libs'
28 'glibc'
29 'git'
30 'go'
31 "libxcb"
32 "lz4"
33 "sdl2"
34 "sdl2_image"
35 "xcb-util-image"
36 "xcb-util-renderutil"
37 "zlib"
38 "zstd"
39 "clang"
40)
41
42checkdepends=()
43
44source=(
45 "source::git+${url}.git#tag=v${pkgver}"
46)
47sha256sums=('b9b5e80b0cd003da7fac2fa9cb4f7bf76806f9a88f867cc9a9eb2996514fce36')
48
49build() {
50 cd source
51 export GOPATH="${srcdir}/go"
52 export GOBIN="${GOPATH}/bin"
53 export PATH="/usr/bin:${GOPATH}/bin"
54 sed -i 's|go test|#go test|g' ./build-all.sh
55 sed -i 's|wuffs bench|#wuffs bench|g' ./build-all.sh
56 #./build-all.sh
57
58 CC=${CC:-gcc}
59 CXX=${CXX:-g++}
60 go install github.com/google/wuffs/cmd/...
61 wuffs gen
62 WARNING_FLAGS="-Wall -Werror -Wpedantic -Wcast-qual -Wcast-align -Wpointer-arith -Wfloat-equal -Wundef -Wvla -Wconversion -Wshadow -Wredundant-decls -Wunused-const-variable"
63 C_WARNING_FLAGS="$WARNING_FLAGS -Wstrict-prototypes -Wold-style-definition"
64 CXX_WARNING_FLAGS="$WARNING_FLAGS"
65 wuffs genlib -skipgen
66 wuffs test -skipgen -mimic
67 ./build-fuzz.sh
68}
69
70package_wuffs-lib() {
71 cd source
72 pkgdesc='A memory-safe standard library for Wrangling Untrusted File Formats Safely. Wrangling includes parsing, decoding and encoding. Example file formats include images, audio, video, fonts and compressed archives.'
73 depends=(
74 "glibc"
75 "wuffs-license"
76 )
77 provides=(
78 "libwuffs.so"
79 "libwuffs.a"
80 )
81 optdepends=(
82 "python-pywuffs: Python bindings"
83 "wuffs-docs: Docs"
84 )
85 install -vDm644 \
86 -t "${pkgdir}/usr/include" \
87 release/c/*.c gen/c/*.c
88 install -vDm644 \
89 -t "${pkgdir}/usr/include/wuffs" \
90 release/c/*.c gen/c/*.c
91 install -vDm755 \
92 -t "${pkgdir}/usr/lib" \
93 gen/lib/c/gcc-dynamic/libwuffs.so
94 install -vDm644 -t \
95 "${pkgdir}/usr/lib" \
96 gen/lib/c/gcc-static/libwuffs.a
97 install -vDm644 -t \
98 "${pkgdir}/usr/share/doc/wuffs-lib" \
99 release/c/README.md
100 install -vdm644 "${pkgdir}/usr/share/licenses"
101 ln -srf \
102 "${pkgdir}/usr/share/licenses/wuffs" \
103 "${pkgdir}/usr/share/licenses"/wuffs-lib
104}
105
106package_wuffs-examples() {
107 pkgdesc='Example programmes for wuffs, a memory-safe programming language and standard library for Wrangling Untrusted File Formats Safely.'
108 depends=(
109 "gcc-libs"
110 "glibc"
111 "sdl2"
112 "sdl2_image"
113 "xcb-util-image"
114 "xcb-util-renderutil"
115 "wuffs-license"
116 )
117 cd source
118 declare _bins
119 _bins=`ls -1 gen/bin/example-*`
120 for _bin in ${_bins}; do
121 _name="$(basename "${_bin}" | sed -E -e 's|^example-||')"
122 install -vDm755 \
123 "${_bin}" \
124 "${pkgdir}/usr/bin"/wuffs-"${_name}"
125 done
126 install -vDm644 -t \
127 "${pkgdir}/usr/share/doc/wuffs-examples" \
128 example/README.md
129 install -vdm644 "${pkgdir}/usr/share/licenses"
130 ln -srf \
131 "${pkgdir}/usr/share/licenses/wuffs" \
132 "${pkgdir}/usr/share/licenses"/wuffs-examples
133}
134
135package_wuffs-fuzzers() {
136 pkgdesc='Fuzzer programmes for wuffs, a memory-safe programming language and standard library for Wrangling Untrusted File Formats Safely.'
137 depends=(
138 "gcc-libs"
139 "glibc"
140 "wuffs-license"
141 )
142
143 cd source
144 declare _bins
145 _bins=`ls -1 gen/bin/fuzz-*`
146 for _bin in ${_bins}; do
147 _name="$(basename "${_bin}")"
148 install -vDm755 \
149 "${_bin}" \
150 "${pkgdir}/usr/bin"/wuffs-"${_name}"
151 done
152
153 install -vDm644 \
154 -t "${pkgdir}/usr/share/doc/wuffs-fuzzers" \
155 fuzz/c/std/README.md
156
157 install -vdm644 "${pkgdir}/usr/share/licenses"
158 ln -srf \
159 "${pkgdir}/usr/share/licenses/wuffs" \
160 "${pkgdir}/usr/share/licenses"/wuffs-fuzzers
161}
162
163package_wuffs-lang() {
164 pkgdesc='A memory-safe programming language for Wrangling Untrusted File Formats Safely. Wrangling includes parsing, decoding and encoding. Example file formats include images, audio, video, fonts and compressed archives.'
165 depends=(
166 "wuffs-license"
167
168 # ractool deps
169 glibc
170 liblz4.so
171 libz.so
172 libzstd.so
173 )
174 provides=(
175 "dumbindent=${pkgver}"
176 #"handsum=${pkgver}"
177 "ractool=${pkgver}"
178 "wuffs=${pkgver}"
179 "wuffs-c=${pkgver}"
180 "wuffsfmt=${pkgver}"
181 )
182 optdepends=(
183 "wuffs-docs: Docs"
184 )
185
186 cd source
187 export GOPATH="${srcdir}/go"
188 export GOBIN="${GOPATH}/bin"
189 install -Dvm755 \
190 -t "${pkgdir}/usr/bin" \
191 "${GOBIN}"/{dumbindent,ractool,wuffs,wuffs-c,wuffsfmt}
192 install -vdm644 \
193 "${pkgdir}/usr/share/licenses"
194 ln -srf \
195 "${pkgdir}/usr/share/licenses/wuffs" \
196 "${pkgdir}/usr/share/licenses"/wuffs-lang
197}
198
199package_wuffs-docs() {
200 pkgdesc='Documentation for "Wuffs the Library" and "Wuffs the Language", as well as the corresponding example binaries.'
201 depends=("wuffs-license")
202 arch=('any')
203
204 cd source
205 install -Dvm644 \
206 -t "${pkgdir}/usr/share/doc/wuffs" \
207 AUTHORS \
208 *.md \
209 CONTRIBUTORS
210 cp -r \
211 doc \
212 "${pkgdir}/usr/share/doc/wuffs"/
213 install -vdm644 \
214 "${pkgdir}/usr/share/licenses"
215 ln -srf \
216 "${pkgdir}/usr/share/licenses/wuffs" \
217 "${pkgdir}/usr/share/licenses"/wuffs-docs
218}
219
220package_wuffs-license() {
221 pkgdesc='Common license for "Wuffs the Library" and "Wuffs the Language", as well as the corresponding example binaries.'
222 depends=()
223 arch=('any')
224 cd source
225 install -vDm644 \
226 -t "${pkgdir}/usr/share/licenses/wuffs" \
227 LICENSE*
228 ln -srf \
229 "${pkgdir}/usr/share/licenses/wuffs" \
230 "${pkgdir}/usr/share/licenses"/wuffs-license
231 ln -srf \
232 "${pkgdir}/usr/share/licenses/wuffs" \
233 "${pkgdir}/usr/share/licenses"/wuffs-license
234}
235

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 LOW 2
2026-08-02 00:16:08 LOW 2
2026-08-01 00:11:18 LOW 2
2026-07-31 00:14:10 LOW 2
2026-07-30 00:17:23 LOW 2
2026-07-29 00:25:53 LOW 2
2026-07-28 00:07:28 LOW 2
2026-07-27 00:24:32 LOW 2
2026-07-26 00:07:32 LOW 2
2026-07-25 00:13:44 LOW 2
2026-07-24 00:02:28 LOW 2
2026-07-23 00:14:47 LOW 2
2026-07-22 00:29:32 LOW 2
2026-07-21 00:24:15 LOW 2
2026-07-20 00:19:49 LOW 2
2026-07-19 00:17:08 LOW 2
2026-07-18 00:14:48 LOW 2
2026-07-17 00:06:16 LOW 2
2026-07-16 00:05:41 LOW 2
2026-07-15 00:09:25 LOW 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion