xburn-gui

maintainer Neolux_Lee · 0 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The package installs a proprietary prebuilt binary from the project's own official domain (archive.d-robotics.cc) and bundles Ubuntu 22.04 runtime libraries from official Ubuntu/security.ubuntu.com mirrors with explicit sha256sums; all sources are from plausible official infrastructure, no obfuscation or exfiltration is present, though running a closed-source binary with bundled WebKit helpers carries inherent trust risk.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 75%): The package installs a proprietary prebuilt binary from the project's own official domain (archive.d-robotics.cc) and bundles Ubuntu 22.04 runtime libraries from official Ubuntu/security.ubuntu.com mirrors with explicit sha256sums; all sources are from plausible official infrastructure, no obfuscation or exfiltration is present, though running a closed-source binary with bundled WebKit helpers carries inherent trust risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:43 "xburn-gui_${pkgver}_amd64.deb::https://archive.d-robotics.cc/downloads/software_tools/download_tools/xburn-gui_${pkgver}/xburn-gui_${pkgver}_amd64.deb"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Neolux Lee
    
      2
    
      3# D-Robotics (Horizon Robotics) xburn 芯片烧录 GUI。
    
      4#
    
      5# 上游只发布 Ubuntu/Debian 的预编译二进制。主程序 xburn-gui 是一个 Tauri(Rust)
    
      6# 应用，其 Linux 后端硬链接到 libwebkit2gtk-4.0.so.37（WebKitGTK 的 4.0 API）。
    
      7# 而 Arch Linux 官方仓库已经移除了以下这些旧版 soname：
    
      8#   - libwebkit2gtk-4.0.so.37 / libjavascriptcoregtk-4.0.so.18 (WebKitGTK 4.0)
    
      9#   - libsoup-2.4.so.1        (libsoup 2.x 已移除，仅剩 libsoup3)
    
      10#   - libicu*.so.70           (ICU 70，Arch 现为 76)
    
      11# 因此本 PKGBUILD 从 Ubuntu 22.04 额外下载这 4 个包并“私有打包”，放到
    
      12# /usr/lib/xburn-gui/lib/，通过启动脚本设置 LD_LIBRARY_PATH 加载，不污染系统。
    
      13
    
      14pkgname=xburn-gui
    
      15pkgver=1.2.1
    
      16pkgrel=1
    
      17pkgdesc="D-Robotics (Horizon) xburn chip burner GUI"
    
      18arch=('x86_64')
    
      19url="https://archive.d-robotics.cc/"
    
      20license=('custom:proprietary')
    
      21options=('!debug')  # 预编译二进制，无调试符号，跳过 -debug 子包
    
      22depends=(
    
      23    # GTK 基础栈（主程序 + 私有 webkit 都需要）
    
      24    'gtk3' 'glib2' 'pango' 'cairo' 'gdk-pixbuf2' 'at-spi2-core'
    
      25    # WebKit 运行时（私有 webkit 在运行时依赖这些 Arch 包提供的库）
    
      26    'libxml2-legacy'  # libxml2.so.2（Arch 新版 libxml2 已改为 .so.16，旧 soname 由此包提供）
    
      27    'libepoxy' 'libwebp' 'libjpeg-turbo' 'libpng'
    
      28    'freetype2' 'fontconfig' 'expat' 'harfbuzz' 'harfbuzz-icu' 'woff2'
    
      29    'lcms2' 'libxslt' 'sqlite' 'libgcrypt' 'libtasn1' 'hyphen'
    
      30    'libmanette' 'enchant' 'libsecret' 'libseccomp' 'libx11' 'wayland'
    
      31    'mesa' 'libdrm' 'gstreamer' 'gst-plugins-base-libs'
    
      32    # 私有 libsoup-2.4 的依赖
    
      33    'libpsl' 'brotli' 'krb5'
    
      34    # 系统 / 其它
    
      35    'systemd-libs'   # libudev.so.1, libsystemd.so.0
    
      36    'libusb'         # tools/linux/dfu-util 需要 libusb-1.0.so.0
    
      37)
    
      38makedepends=('libarchive')  # bsdtar 用于解包 .deb
    
      39optdepends=(
    
      40    'polkit: .desktop 启动器使用 pkexec 提权运行（命令行直接运行则不需要）'
    
      41)
    
      42source=(
    
      43    "xburn-gui_${pkgver}_amd64.deb::https://archive.d-robotics.cc/downloads/software_tools/download_tools/xburn-gui_${pkgver}/xburn-gui_${pkgver}_amd64.deb"
    
      44    'libwebkit2gtk-4.0-37.deb::https://security.ubuntu.com/ubuntu/pool/main/w/webkit2gtk/libwebkit2gtk-4.0-37_2.50.4-0ubuntu0.22.04.1_amd64.deb'
    
      45    'libjavascriptcoregtk-4.0-18.deb::https://security.ubuntu.com/ubuntu/pool/main/w/webkit2gtk/libjavascriptcoregtk-4.0-18_2.50.4-0ubuntu0.22.04.1_amd64.deb'
    
      46    'libicu70.deb::https://archive.ubuntu.com/ubuntu/pool/main/i/icu/libicu70_70.1-2_amd64.deb'
    
      47    'libsoup2.4-1.deb::https://archive.ubuntu.com/ubuntu/pool/main/libs/libsoup2.4/libsoup2.4-1_2.74.2-3ubuntu0.7_amd64.deb'
    
      48)
    
      49sha256sums=(
    
      50    '34524f8c15d438d1262962d7aead621ef9f4a0dea3557d4c7cd92c4a5696d3d6'
    
      51    '121a795af0b4851eaa13b4e0cd55ba6261d7cf1578801bf39ce7c295af7d1174'
    
      52    '68aafd3f6d0a560276875e6275713dc5f55e8cda570f9e33d38d94ba4906ce5e'
    
      53    '58a154f6307289813da2276f900498ef536ae7c0522d2cf31a3c3c5cf62dfd9a'
    
      54    'e51a22c0558dc96f399c768ceeb65bee08d75912936d9de8ed3cd5858cab7f31'
    
      55)
    
      56
    
      57# 解包 .deb（自动识别 data.tar.gz / data.tar.zst 压缩方式）
    
      58_extract_deb() {
    
      59    local deb="$1" dest="$2" member
    
      60    member=$(bsdtar -tf "$deb" | grep -m1 -E '^data\.tar\.')
    
      61    install -dm755 "$dest"
    
      62    bsdtar -xf "$deb" -O "$member" | bsdtar -xf - -C "$dest"
    
      63}
    
      64
    
      65prepare() {
    
      66    _extract_deb "xburn-gui_${pkgver}_amd64.deb"  "$srcdir/xburn"
    
      67    _extract_deb 'libwebkit2gtk-4.0-37.deb'        "$srcdir/rt-webkit"
    
      68    _extract_deb 'libjavascriptcoregtk-4.0-18.deb' "$srcdir/rt-jsc"
    
      69    _extract_deb 'libicu70.deb'                    "$srcdir/rt-icu"
    
      70    _extract_deb 'libsoup2.4-1.deb'                "$srcdir/rt-soup"
    
      71}
    
      72
    
      73package() {
    
      74    # 1) 安装应用目录树（保留上游 /usr 布局：/usr/bin/xburn、
    
      75    #    /usr/lib/xburn-gui/{configs,tools}、/usr/share/...）
    
      76    cp -a "$srcdir/xburn/usr" "$pkgdir/"
    
      77
    
      78    # 2) 私有打包运行库（WebKitGTK 4.0 + ICU 70 + libsoup 2.4，来自 Ubuntu 22.04）
    
      79    local libdir="$pkgdir/usr/lib/xburn-gui/lib"
    
      80    install -dm755 "$libdir"
    
      81    cp -a "$srcdir/rt-webkit/usr/lib/x86_64-linux-gnu/libwebkit2gtk-4.0.so.37"*     "$libdir/"
    
      82    cp -a "$srcdir/rt-jsc/usr/lib/x86_64-linux-gnu/libjavascriptcoregtk-4.0.so.18"* "$libdir/"
    
      83    cp -a "$srcdir/rt-icu/usr/lib/x86_64-linux-gnu/libicudata.so.70"*               "$libdir/"
    
      84    cp -a "$srcdir/rt-icu/usr/lib/x86_64-linux-gnu/libicui18n.so.70"*               "$libdir/"
    
      85    cp -a "$srcdir/rt-icu/usr/lib/x86_64-linux-gnu/libicuuc.so.70"*                 "$libdir/"
    
      86    cp -a "$srcdir/rt-soup/usr/lib/x86_64-linux-gnu/libsoup-2.4.so.1"*              "$libdir/"
    
      87
    
      88    # 3) 将真正的 xburn-gui 移入 /usr/lib/xburn-gui/，并在 /usr/bin/ 放置
    
      89    #    一个设置 LD_LIBRARY_PATH 的启动脚本（LD_LIBRARY_PATH 可传递搜索，
    
      90    #    能同时找到私有打包的 webkit/jsc/icu/libsoup 及其它依赖）。
    
      91    mv "$pkgdir/usr/bin/xburn-gui" "$pkgdir/usr/lib/xburn-gui/xburn-gui"
    
      92    cat > "$pkgdir/usr/bin/xburn-gui" <<'EOF'
    
      93#!/bin/sh
    
      94APPDIR="/usr/lib/xburn-gui"
    
      95export LD_LIBRARY_PATH="$APPDIR/lib${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
    
      96exec "$APPDIR/xburn-gui" "$@"
    
      97EOF
    
      98    chmod 755 "$pkgdir/usr/bin/xburn-gui"
    
      99
    
      100    # 4) WebKit 辅助进程。libwebkit2gtk 会按编译期硬编码的绝对路径 spawn 这些
    
      101    #    子进程，因此必须放到 /usr/lib/x86_64-linux-gnu/webkit2gtk-4.0/ 下
    
      102    #    （它们会继承启动脚本设置的 LD_LIBRARY_PATH，从而找到私有打包的库）。
    
      103    local wkdir="$pkgdir/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0"
    
      104    install -dm755 "$wkdir/injected-bundle"
    
      105    install -m755 "$srcdir/rt-webkit/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0/WebKitNetworkProcess" "$wkdir/"
    
      106    install -m755 "$srcdir/rt-webkit/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0/WebKitWebProcess"    "$wkdir/"
    
      107    install -m755 "$srcdir/rt-webkit/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0/WebKitGPUProcess"    "$wkdir/"
    
      108    install -m755 "$srcdir/rt-webkit/usr/lib/x86_64-linux-gnu/webkit2gtk-4.0/injected-bundle/libwebkit2gtkinjectedbundle.so" "$wkdir/injected-bundle/"
    
      109
    
      110    # 5) 将上游自带的 udev 规则安装到系统 udev 目录，使 USB 烧录板可被访问。
    
      111    install -Dm644 \
    
      112        "$srcdir/xburn/usr/lib/xburn-gui/configs/udev/rules.d/51-drobotics-usb.rules" \
    
      113        "$pkgdir/usr/lib/udev/rules.d/51-drobotics-usb.rules"
    
      114}
    
      115

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	3
2026-08-17 00:18:29	LOW	3
2026-08-16 09:38:30	LOW	3
2026-08-16 09:32:18	MEDIUM	2