◎ AURWatch - AUR Security Monitor
scan coverage …
Last scan …
Next scan -

wuffs-lib-git

maintainer dreieck · 0 votes · base wuffs-git · scanned 2026-08-18 00:03:42.021799
LOW
View on AUR ↗
Why flagged The package builds from the official GitHub source of a legitimate project, and the 'external install via go' is part of the project's normal build process using its own tooling, posing no supply-chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from the official GitHub source of a legitimate project, and the 'external install via go' is part of the project's normal build process using its own tooling, posing no supply-chain risk.

2 higher static findings superseded - not the current verdict (shown for transparency)
MEDIUM External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

  • PKGBUILD:120 go install -v -modcacherw github.com/google/wuffs/cmd/...
MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:56 "${_gitname}::git+https://${_githost}/${_gituser}/${_gitname}.git"

PKGBUILD

2 offending line(s) highlighted
1# Maintainer: dreieck (https://aur.archlinux.org/account/dreieck)
2
3_gitname="wuffs"
4_pkgbase="${_gitname}"
5pkgbase="${_pkgbase}-git"
6
7pkgname=(
8 "${_pkgbase}-lib-git"
9 "${_pkgbase}-examples-git"
10 "${_pkgbase}-fuzzers-git"
11 "${_pkgbase}-lang-git"
12 "${_pkgbase}-docs-git"
13 "${_pkgbase}-license-git"
14)
15
16pkgdesc="A memory-safe programming language, and a standard library, for Wrangling Untrusted File Formats Safely. Wrangling includes parsing, decoding and encoding. Example file formats include images, audio, video, fonts and compressed archives."
17
18pkgver=0.3.5+11.r3999.20260721.9d8285b5
19pkgrel=2
20
21arch=(
22 'i686'
23 'x86_64'
24 'armv6h'
25 'armv7h'
26 'aarch64'
27 'pentium4'
28 'riscv64'
29)
30_githost='github.com'
31_gituser='google'
32url="https://${_githost}/${_gituser}/${_gitname}"
33license=(
34 "MIT"
35 "Apache-2.0"
36)
37makedepends=(
38 'gcc' # Yes, it needs both clang and GCC!
39 'gcc-libs'
40 'glibc'
41 'git'
42 'go'
43 "libxcb"
44 "lz4"
45 "sdl2"
46 "sdl2_image"
47 "xcb-util-image"
48 "xcb-util-renderutil"
49 "zlib"
50 "zstd"
51)
52
53checkdepends=()
54
55source=(
56 "${_gitname}::git+https://${_githost}/${_gituser}/${_gitname}.git"
57 # "wuffs-build-all_disable-tests.patch" # Not needed if we don't run build-all.sh.
58 "wuffs-test-all.sh"
59)
60sha256sums=(
61 'SKIP' # Main upstream source.
62 # '85cbe5911efa30fde54fc364aecf8f2d1e89f0cb387654127d020037caef447c' # wuffs-build-all_disable-tests.patch
63 '2cd9df1708364eb3db73c56beb5bd0400adef6d670033195c4647378ec612d29' # wuffs-test-all.sh
64)
65
66prepare() {
67 export GOPATH="${srcdir}/.go"
68 export GOBIN="${GOPATH}/bin"
69
70 cd "${srcdir}/${_gitname}"
71
72 # for _patch in "${srcdir}"/wuffs-build-all_disable-tests.patch; do # Not needed if we don't run build-all.sh.
73 # printf '%s\n' " -> Applying patch '$(basename "${_patch}")' ..."
74 # patch -Np1 --follow-symlinks -i "${_patch}"
75 # done
76
77 printf '%s\n' " --> running 'go get -v -modcacherw github.com/google/wuffs/cmd/...' ..."
78 go get -v -modcacherw github.com/google/wuffs/cmd/...
79 printf '\n'
80
81 git log > "${srcdir}/git.log"
82}
83
84pkgver() {
85 cd "${srcdir}/${_gitname}"
86
87 _ver="$(git describe --tags | sed -E -e 's|^spin-in-||' -e 's|^[vV]||' -e 's|\-g[0-9a-f]*$||' | tr '-' '+')"
88 _rev="$(git rev-list --count HEAD)"
89 _date="$(git log -1 --date=format:"%Y%m%d" --format="%ad")"
90 _hash="$(git rev-parse --short HEAD)"
91
92 if [ -z "${_ver}" ]; then
93 error "Version could not be determined."
94 return 1
95 else
96 printf '%s' "${_ver}.r${_rev}.${_date}.${_hash}"
97 fi
98}
99
100build() {
101 export GOPATH="${srcdir}/.go"
102 export GOBIN="${GOPATH}/bin"
103 export PATH="${GOBIN}:${PATH}"
104
105 local _CFLAGSADDITIONS=""
106 local _SILENCEWARNINGS=("stringop-overflow")
107 local _warning
108 for _warning in "${_SILENCEWARNINGS[@]}"; do
109 _CFLAGSADDITIONS+=" -Wno-${_warning} -Wno-error=${_warning}"
110 done
111 CFLAGS+="${_CFLAGSADDITIONS}"
112 CXXFLAGS+="${_CFLAGSADDITIONS}"
113 export CFLAGS
114 export CXXFLAGS
115
116 cd "${srcdir}/${_gitname}"
117
118 # Excerpts from build-all.sh:
119 printf '%s\n' " --> running 'go install -v -modcacherw github.com/google/wuffs/cmd/...' ..."
120 go install -v -modcacherw github.com/google/wuffs/cmd/...
121 printf '\n'
122 printf '%s\n' " --> running 'wuffs gen -langs 'c'' ..."
123 wuffs gen -langs 'c'
124 printf '\n'
125 printf '%s\n' " --> running 'wuffs genlib -ccompilers gcc -langs 'c' -skipgen' ..."
126 wuffs genlib -ccompilers gcc -langs 'c' -skipgen
127 printf '\n'
128 printf '%s\n' " --> running './build-example.sh' ..."
129 ./build-example.sh
130 printf '\n'
131 printf '%s\n' " --> running './build-fuzz.sh' ..."
132 ./build-fuzz.sh
133 printf '\n'
134}
135
136# ### 2026-08-03: `check()` Disabled, since `gen/bin/fuzz-pixel_swizzler` crashes with a segmentation fault.
137# check() {
138# cd "${srcdir}/${_gitname}"
139#
140# "${srcdir}"/wuffs-test-all.sh
141# }
142
143package_wuffs-lib-git() {
144 pkgdesc='A memory-safe standard library for Wrangling Untrusted File Formats Safely. Wrangling includes parsing, decoding and encoding. Example file formats include images, audio, video, fonts and compressed archives.'
145 depends=(
146 "glibc"
147 "wuffs-license"
148 )
149 provides=(
150 "wuffs-lib=${pkgver}"
151 "libwuffs.so"
152 "libwuffs.a"
153 )
154 conflicts=(
155 "wuffs-lib"
156 )
157 optdepends=(
158 "python-pywuffs: For python binding."
159 "wuffs-docs: For the documentation of this software."
160 )
161
162 cd "${srcdir}/${_gitname}"
163
164 install -Dvm644 -t "${pkgdir}/usr/include" release/c/*.c gen/c/*.c
165 install -Dvm755 -t "${pkgdir}/usr/lib" gen/lib/c/gcc-dynamic/libwuffs.so
166 install -Dvm644 -t "${pkgdir}/usr/lib" gen/lib/c/gcc-static/libwuffs.a
167
168 install -Dvm644 -t "${pkgdir}/usr/share/doc/wuffs-lib" release/c/README.md
169
170 install -dvm755 "${pkgdir}/usr/share/licenses"
171 ln -svr "${pkgdir}/usr/share/licenses/wuffs" "${pkgdir}/usr/share/licenses"/wuffs-lib-git
172}
173
174package_wuffs-examples-git() {
175 pkgdesc='Example programmes for wuffs, a memory-safe programming language and standard library for Wrangling Untrusted File Formats Safely.'
176 depends=(
177 "gcc-libs"
178 "glibc"
179 "sdl2"
180 "sdl2_image"
181 "xcb-util-image"
182 "xcb-util-renderutil"
183 "wuffs-license"
184 )
185 provides=(
186 "wuffs-examples=${pkgver}"
187 )
188 conflicts=(
189 "wuffs-examples"
190 )
191 optdepends=(
192 "wuffs-docs: For the documentation of this software."
193 )
194
195 cd "${srcdir}/${_gitname}"
196
197 local _bins _bin
198 _bins=`ls -1 gen/bin/example-*`
199 for _bin in ${_bins}; do
200 _name="$(basename "${_bin}" | sed -E -e 's|^example-||')"
201 install -Dvm755 "${_bin}" "${pkgdir}/usr/bin"/wuffs-"${_name}"
202 done
203
204 install -Dvm644 -t "${pkgdir}/usr/share/doc/wuffs-examples" example/README.md
205
206 install -dvm755 "${pkgdir}/usr/share/licenses"
207 ln -svr "${pkgdir}/usr/share/licenses/wuffs" "${pkgdir}/usr/share/licenses"/wuffs-examples-git
208}
209
210package_wuffs-fuzzers-git() {
211 pkgdesc='Fuzzer programmes for wuffs, a memory-safe programming language and standard library for Wrangling Untrusted File Formats Safely.'
212 depends=(
213 "gcc-libs"
214 "glibc"
215 "wuffs-license"
216 )
217 provides=(
218 "wuffs-fuzzers=${pkgver}"
219 )
220 conflicts=(
221 "wuffs-fuzzers"
222 )
223 optdepends=(
224 "wuffs-docs: For the documentation of this software."
225 )
226
227 cd "${srcdir}/${_gitname}"
228
229 local _bins _bin
230 _bins=`ls -1 gen/bin/fuzz-*`
231 for _bin in ${_bins}; do
232 _name="$(basename "${_bin}")"
233 install -Dvm755 "${_bin}" "${pkgdir}/usr/bin"/wuffs-"${_name}"
234 done
235
236 install -Dvm644 -t "${pkgdir}/usr/share/doc/wuffs-fuzzers" fuzz/c/std/README.md
237
238 install -dvm755 "${pkgdir}/usr/share/licenses"
239 ln -svr "${pkgdir}/usr/share/licenses/wuffs" "${pkgdir}/usr/share/licenses"/wuffs-fuzzers-git
240}
241
242package_wuffs-lang-git() {
243 pkgdesc='A memory-safe programming language for Wrangling Untrusted File Formats Safely. Wrangling includes parsing, decoding and encoding. Example file formats include images, audio, video, fonts and compressed archives.'
244 depends=(
245 "wuffs-license"
246 )
247 provides=(
248 "wuffs-lang=${pkgver}"
249 "dumbindent=${pkgver}"
250 "handsum=${pkgver}"
251 "ractool=${pkgver}"
252 "wuffs=${pkgver}"
253 "wuffs-c=${pkgver}"
254 "wuffsfmt=${pkgver}"
255 )
256 conflicts=(
257 "wuffs-lang"
258 "dumbindent"
259 "handsum"
260 "ractool"
261 "wuffs"
262 "wuffs-c"
263 "wuffsfmt"
264 )
265 optdepends=(
266 "glibc: For 'ractool'."
267 "liblz4.so: For 'ractool'."
268 "libz.so: For 'ractool'."
269 "libzstd.so: For 'ractool'."
270 "wuffs-docs: For the documentation of this software."
271 )
272
273 export GOPATH="${srcdir}/.go"
274 export GOBIN="${GOPATH}/bin"
275
276 cd "${srcdir}/${_gitname}"
277
278 install -Dvm755 -t "${pkgdir}/usr/bin" "${GOBIN}"/{dumbindent,handsum,ractool,wuffs,wuffs-c,wuffsfmt}
279
280 install -dvm755 "${pkgdir}/usr/share/licenses"
281 ln -svr "${pkgdir}/usr/share/licenses/wuffs" "${pkgdir}/usr/share/licenses"/wuffs-lang-git
282}
283
284package_wuffs-docs-git() {
285 pkgdesc='Documentation for "Wuffs the Library" and "Wuffs the Language", as well as the corresponding example binaries.'
286 depends=("wuffs-license")
287 provides=(
288 "wuffs-docs=${pkgver}"
289 )
290 conflicts=(
291 "wuffs-docs"
292 )
293 optdepends=(
294 "wuffs-lib: The library this documentation is for."
295 "wuffs-lang: The programming language this documentation is for."
296 "wuffs-examples: The example programmes this documentation is for."
297 "wuffs-fuzzers: The fuzzer programmes this documentation is for."
298 )
299 arch=('any')
300
301 cd "${srcdir}/${_gitname}"
302
303 install -Dvm644 -t "${pkgdir}/usr/share/doc/${_pkgbase}" "${srcdir}"/git.log AUTHORS BUILD.md CONTRIBUTING.md CONTRIBUTORS README.md
304 cp -rv doc "${pkgdir}/usr/share/doc/${_pkgbase}"/
305
306 install -dvm755 "${pkgdir}/usr/share/licenses"
307 ln -svr "${pkgdir}/usr/share/licenses/wuffs" "${pkgdir}/usr/share/licenses"/wuffs-docs-git
308}
309
310package_wuffs-license-git() {
311 pkgdesc='Common license for "Wuffs the Library" and "Wuffs the Language", as well as the corresponding example binaries.'
312 depends=()
313 provides=(
314 "wuffs-license=${pkgver}"
315 )
316 conflicts=(
317 "wuffs-license"
318 )
319 optdepends=(
320 "wuffs-lib: The library this license is for."
321 "wuffs-lang: The programming language this license is for."
322 "wuffs-examples: The example programmes this license is for."
323 "wuffs-fuzzers: The fuzzer programmes this license is for."
324 )
325 arch=('any')
326
327 cd "${srcdir}/${_gitname}"
328
329 cd "${srcdir}/${_gitname}"
330 install -Dvm644 -t "${pkgdir}/usr/share/licenses/wuffs" LICENSE LICENSE-APACHE LICENSE-MIT
331 ln -svr "${pkgdir}/usr/share/licenses/wuffs" "${pkgdir}/usr/share/licenses"/wuffs-license-git
332 ln -svr "${pkgdir}/usr/share/licenses/wuffs" "${pkgdir}/usr/share/licenses"/wuffs-license
333}
334

Changes since previous scan

--- PKGBUILD @ 2026-06-19 23:51
+++ PKGBUILD @ 2026-08-18 00:03
@@ -15,8 +15,8 @@
pkgdesc="A memory-safe programming language, and a standard library, for Wrangling Untrusted File Formats Safely. Wrangling includes parsing, decoding and encoding. Example file formats include images, audio, video, fonts and compressed archives."
-pkgver=0.4.0+alpha.9+49.r3887.20251111.072595ae
-pkgrel=1
+pkgver=0.3.5+11.r3999.20260721.9d8285b5
+pkgrel=2
arch=(
'i686'
@@ -35,7 +35,7 @@
"Apache-2.0"
)
makedepends=(
- 'gcc'
+ 'gcc' # Yes, it needs both clang and GCC!
'gcc-libs'
'glibc'
'git'
@@ -54,9 +54,13 @@
source=(
"${_gitname}::git+https://${_githost}/${_gituser}/${_gitname}.git"
+ # "wuffs-build-all_disable-tests.patch" # Not needed if we don't run build-all.sh.
+ "wuffs-test-all.sh"
)
sha256sums=(
- 'SKIP'
+ 'SKIP' # Main upstream source.
+ # '85cbe5911efa30fde54fc364aecf8f2d1e89f0cb387654127d020037caef447c' # wuffs-build-all_disable-tests.patch
+ '2cd9df1708364eb3db73c56beb5bd0400adef6d670033195c4647378ec612d29' # wuffs-test-all.sh
)
prepare() {
@@ -65,7 +69,14 @@
cd "${srcdir}/${_gitname}"
- go get -v github.com/google/wuffs/cmd/...
+ # for _patch in "${srcdir}"/wuffs-build-all_disable-tests.patch; do # Not needed if we don't run build-all.sh.
+ # printf '%s\n' " -> Applying patch '$(basename "${_patch}")' ..."
+ # patch -Np1 --follow-symlinks -i "${_patch}"
+ # done
+
+ printf '%s\n' " --> running 'go get -v -modcacherw github.com/google/wuffs/cmd/...' ..."
+ go get -v -modcacherw github.com/google/wuffs/cmd/...
+ printf '\n'
git log > "${srcdir}/git.log"
}
@@ -73,7 +84,7 @@
pkgver() {
cd "${srcdir}/${_gitname}"
- _ver="$(git describe --tags | sed -E -e 's|^[vV]||' -e 's|\-g[0-9a-f]*$||' | tr '-' '+')"
+ _ver="$(git describe --tags | sed -E -e 's|^spin-in-||' -e 's|^[vV]||' -e 's|\-g[0-9a-f]*$||' | tr '-' '+')"
_rev="$(git rev-list --count HEAD)"
_date="$(git log -1 --date=format:"%Y%m%d" --format="%ad")"
_hash="$(git rev-parse --short HEAD)"
@@ -91,15 +102,43 @@
export GOBIN="${GOPATH}/bin"
export PATH="${GOBIN}:${PATH}"
- cd "${srcdir}/${_gitname}"
- printf '%s\n' " --> building ..."
-
- ./build-all.sh
- #./build-example.sh
- #./build-fuzz.sh
- #go install -v ./cmd/wuffs*
- #wuffs gen
-}
+ local _CFLAGSADDITIONS=""
+ local _SILENCEWARNINGS=("stringop-overflow")
+ local _warning
+ for _warning in "${_SILENCEWARNINGS[@]}"; do
+ _CFLAGSADDITIONS+=" -Wno-${_warning} -Wno-error=${_warning}"
+ done
+ CFLAGS+="${_CFLAGSADDITIONS}"
+ CXXFLAGS+="${_CFLAGSADDITIONS}"
+ export CFLAGS
+ export CXXFLAGS
+
+ cd "${srcdir}/${_gitname}"
+
+ # Excerpts from build-all.sh:
+ printf '%s\n' " --> running 'go install -v -modcacherw github.com/google/wuffs/cmd/...' ..."
+ go install -v -modcacherw github.com/google/wuffs/cmd/...
+ printf '\n'
+ printf '%s\n' " --> running 'wuffs gen -langs 'c'' ..."
+ wuffs gen -langs 'c'
+ printf '\n'
+ printf '%s\n' " --> running 'wuffs genlib -ccompilers gcc -langs 'c' -skipgen' ..."
+ wuffs genlib -ccompilers gcc -langs 'c' -skipgen
+ printf '\n'
+ printf '%s\n' " --> running './build-example.sh' ..."
+ ./build-example.sh
+ printf '\n'
+ printf '%s\n' " --> running './build-fuzz.sh' ..."
+ ./build-fuzz.sh
+ printf '\n'
+}
+
+# ### 2026-08-03: `check()` Disabled, since `gen/bin/fuzz-pixel_swizzler` crashes with a segmentation fault.
+# check() {
+# cd "${srcdir}/${_gitname}"
+#
+# "${srcdir}"/wuffs-test-all.sh
+# }
package_wuffs-lib-git() {
pkgdesc='A memory-safe standard library for Wrangling Untrusted File Formats Safely. Wrangling includes parsing, decoding and encoding. Example file formats include images, audio, video, fonts and compressed archives.'
@@ -128,7 +167,7 @@
install -Dvm644 -t "${pkgdir}/usr/share/doc/wuffs-lib" release/c/README.md
- install -dvm644 "${pkgdir}/usr/share/licenses"
+ install -dvm755 "${pkgdir}/usr/share/licenses"
ln -svr "${pkgdir}/usr/share/licenses/wuffs" "${pkgdir}/usr/share/licenses"/wuffs-lib-git
}
@@ -164,7 +203,7 @@
install -Dvm644 -t "${pkgdir}/usr/share/doc/wuffs-examples" example/README.md
- install -dvm644 "${pkgdir}/usr/share/licenses"
+ install -dvm755 "${pkgdir}/usr/share/licenses"
ln -svr "${pkgdir}/usr/share/licenses/wuffs" "${pkgdir}/usr/share/licenses"/wuffs-examples-git
}
@@ -196,7 +235,7 @@
install -Dvm644 -t "${pkgdir}/usr/share/doc/wuffs-fuzzers" fuzz/c/std/README.md
- install -dvm644 "${pkgdir}/usr/share/licenses"
+ install -dvm755 "${pkgdir}/usr/share/licenses"
ln -svr "${pkgdir}/usr/share/licenses/wuffs" "${pkgdir}/usr/share/licenses"/wuffs-fuzzers-git
}
@@ -238,7 +277,7 @@
install -Dvm755 -t "${pkgdir}/usr/bin" "${GOBIN}"/{dumbindent,handsum,ractool,wuffs,wuffs-c,wuffsfmt}
- install -dvm644 "${pkgdir}/usr/share/licenses"
+ install -dvm755 "${pkgdir}/usr/share/licenses"
ln -svr "${pkgdir}/usr/share/licenses/wuffs" "${pkgdir}/usr/share/licenses"/wuffs-lang-git
}
@@ -264,7 +303,7 @@
install -Dvm644 -t "${pkgdir}/usr/share/doc/${_pkgbase}" "${srcdir}"/git.log AUTHORS BUILD.md CONTRIBUTING.md CONTRIBUTORS README.md
cp -rv doc "${pkgdir}/usr/share/doc/${_pkgbase}"/
- install -dvm644 "${pkgdir}/usr/share/licenses"
+ install -dvm755 "${pkgdir}/usr/share/licenses"
ln -svr "${pkgdir}/usr/share/licenses/wuffs" "${pkgdir}/usr/share/licenses"/wuffs-docs-git
}

Scan history

Scanned at (UTC)SeverityRules
2026-08-18 00:03:42 LOW 3
2026-08-17 00:18:29 LOW 3
2026-08-16 17:33:23 MEDIUM 2
2026-06-19 23:51:18 CLEAN 2
2026-06-19 19:07:35 MEDIUM 2
2026-06-19 18:54:17 MEDIUM 2
2026-06-18 16:11:54 MEDIUM 1

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion