xtool-studio

MEDIUM

maintainer crazykay 0 votes scanned 2026-10-21 19:37:49.859018

View on AUR

Why flagged

The Windows installer is downloaded from storage.atomm.com (a non-standard CDN, not the official xtool.com domain) and a prebuilt binary 'algo-server-linux-x64' is bundled locally with no upstream URL — both are unverifiable artifacts that could be silently swapped; however checksums are provided for all sources, reducing (but not eliminating) the supply-chain risk from the unofficial CDN host.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:56 "$_installer::https://storage.atomm.com/efficacy/atomm-package/packages/109/afffecbb-38d7-40ed-8bba-7e7acee5c18c/$_installer"

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 65%): The Windows installer is downloaded from storage.atomm.com (a non-standard CDN, not the official xtool.com domain) and a prebuilt binary 'algo-server-linux-x64' is bundled locally with no upstream URL — both are unverifiable artifacts that could be silently swapped; however checksums are provided for all sources, reducing (but not eliminating) the supply-chain risk from the unofficial CDN host.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: crazykay  <mail@crazykay.dev>
    
      2#
    
      3# xTool Studio is a proprietary Electron application that upstream ships for
    
      4# Windows and macOS only. This package repacks the *official* Windows installer
    
      5# (downloaded at build time, never redistributed here) into a native Linux
    
      6# application and applies the port patches kept in build.sh / tools/:
    
      7#
    
      8#   * runs the app on the official Electron 36.2.0 Linux runtime (bundled, so
    
      9#     the exact tested combination is guaranteed)
    
      10#   * swaps the two Windows-only native modules for their published Linux
    
      11#     N-API prebuilds and replaces the private @atomm-studio/system-rs addon
    
      12#     with a pure-JS implementation of the same API
    
      13#   * makes forked service workers tolerant of stdio EPIPE
    
      14#   * fixes the vendored kill-port helper, which otherwise SIGKILLs the
    
      15#     discover worker (and with it device discovery) on Linux
    
      16#   * runs the closed-source algorithm worker (toolpath generation) under Wine,
    
      17#     bridged from the AF_UNIX socket the app expects to a Win32 named pipe
    
      18#   * pins GTK 3, because Chromium 136 initialises GTK4 next to GTK3 and aborts
    
      19#
    
      20# See README.md in the packaging repository for the full analysis.
    
      21
    
      22pkgname=xtool-studio
    
      23pkgver=1.9.11
    
      24pkgrel=1
    
      25pkgdesc='Design and control software for xTool laser machines (Linux port of the official Windows build)'
    
      26keywords=('xtool' 'xsc' 'laser' 'engraver' 'cutter')
    
      27arch=('x86_64')
    
      28url='https://www.xtool.com/pages/software'
    
      29license=('LicenseRef-proprietary')
    
      30depends=(
    
      31	# resolved from the bundled Electron binary's DT_NEEDED set
    
      32	'alsa-lib' 'at-spi2-core' 'cairo' 'dbus' 'expat' 'glib2' 'gtk3' 'libcups'
    
      33	'libx11' 'libxcb' 'libxcomposite' 'libxdamage' 'libxext' 'libxfixes'
    
      34	'libxkbcommon' 'libxrandr' 'mesa' 'nspr' 'nss' 'pango'
    
      35	# libudev for the usb prebuild (libusb itself is statically linked into it)
    
      36	'systemd-libs'
    
      37	# toolpaths are generated by the Windows-only algorithm worker under Wine
    
      38	'wine'
    
      39)
    
      40optdepends=(
    
      41	'xdg-utils: open links and reveal exported files'
    
      42	'pipewire: WebRTC desktop sharing under Wayland'
    
      43)
    
      44makedepends=('7zip' 'asar' 'nodejs' 'npm' 'mingw-w64-gcc' 'python' 'unzip' 'curl' 'imagemagick')
    
      45install="$pkgname.install"
    
      46options=('!strip' '!debug')
    
      47
    
      48_electron="electron-v36.2.0-linux-x64.zip"
    
      49_usb="usb-2.18.0.tgz"
    
      50_serialport="serialport-bindings-cpp-13.0.0.tgz"
    
      51# scoped packages: the registry tarball is named after the package, not the scope
    
      52_serialport_url="https://registry.npmjs.org/@serialport/bindings-cpp/-/bindings-cpp-13.0.0.tgz"
    
      53_installer="xTool-Studio-x64-${pkgver}.exe"
    
      54
    
      55source=(
    
      56	"$_installer::https://storage.atomm.com/efficacy/atomm-package/packages/109/afffecbb-38d7-40ed-8bba-7e7acee5c18c/$_installer"
    
      57	"$_electron::https://github.com/electron/electron/releases/download/v36.2.0/$_electron"
    
      58	"$_usb::https://registry.npmjs.org/usb/-/$_usb"
    
      59	"$_serialport::$_serialport_url"
    
      60	'build.sh'
    
      61	'algo-ipc-bridge.c'
    
      62	'algo-server-linux-x64'
    
      63	'worker-stdio-guard.js'
    
      64	'xtool-studio.desktop'
    
      65	'system-rs-index.js'
    
      66	'system-rs-index.d.ts'
    
      67	'xtool-studio.install'
    
      68)
    
      69
    
      70sha256sums=(
    
      71	'3a2436980a9a6cfea6b7c75ffb34b2f4f8b8ed1966880e8cfb0002573954ac41'
    
      72	'013dface80733221d4153aaf538e8969b93f50d68798d7de2425d5e758e6956b'
    
      73	'3c3cf0f22f33bbbb7f1a5239224c0920fadb43a05ded293c89e12c60aae437aa'
    
      74	'68bc2ce6a4b3be82d76d708d1467c6adf2be878fefe09c499017b6273c3f024d'
    
      75	'33cc8c373bf036be5cea61ee0935a0e26dda144ad43f8c571566b52e62f834c9'
    
      76	'4f1c5c9e287137d87604c69f623613f062f478030a4c24ea675cc9444904b423'
    
      77	'4f276f4873aaf83c619d1d2652d5f90c8b01e0b328c3d2e3508805a56b3b0e8a'
    
      78	'ef4cd570d5bf5b3014cf064c14bd7b2230199700c322ec7836ec34fb6d677d47'
    
      79	'54768ec658e1cc182ea0e3e4c27af2de0b0ace8d8a9da4644c88a792500f0de2'
    
      80	'5eab99f2f881d204ec8b6c2a692d133bc1a3e2614c6fa6b83938d7f13bc67e44'
    
      81	'e7874a7c1c538749c3bf73942b7f70f8a44f8abb0a1e1ae7183fd370325b4881'
    
      82	'3996455eb6d0d4de4f410aba36841dbd1c3276268e5ad2d0fa11003d580223ac'
    
      83)
    
      84
    
      85build() {
    
      86	# build.sh expects <root>/{build.sh,tools/} plus the four upstream archives.
    
      87	cd "$srcdir"
    
      88	APP_VER="$pkgver" \
    
      89		INSTALLER="$srcdir/$_installer" \
    
      90		ELECTRON_ZIP_PATH="$srcdir/$_electron" \
    
      91		USB_TGZ="$srcdir/$_usb" \
    
      92		SERIALPORT_TGZ="$srcdir/$_serialport" \
    
      93		bash "$srcdir/build.sh"
    
      94}
    
      95
    
      96package() {
    
      97	install -d "$pkgdir/usr/lib"
    
      98	cp -a "$srcdir/dist/xtool-studio" "$pkgdir/usr/lib/$pkgname"
    
      99
    
      100	# Chromium's setuid sandbox helper; the launcher only passes --no-sandbox
    
      101	# when this is not setuid root.
    
      102	chmod 4755 "$pkgdir/usr/lib/$pkgname/chrome-sandbox"
    
      103	chown root:root "$pkgdir/usr/lib/$pkgname/chrome-sandbox"
    
      104
    
      105	install -d "$pkgdir/usr/bin"
    
      106	ln -s "/usr/lib/$pkgname/xtool-studio-launcher" "$pkgdir/usr/bin/$pkgname"
    
      107
    
      108	install -Dm644 "$srcdir/xtool-studio.desktop" \
    
      109		"$pkgdir/usr/share/applications/$pkgname.desktop"
    
      110	install -Dm644 "$srcdir/dist/xtool-studio/xtool-studio.png" \
    
      111		"$pkgdir/usr/share/pixmaps/$pkgname.png"
    
      112
    
      113	install -d "$pkgdir/usr/share/licenses/$pkgname"
    
      114	install -m644 "$srcdir/dist/xtool-studio/LICENSE" \
    
      115		"$srcdir/dist/xtool-studio/LICENSES.chromium.html" \
    
      116		"$pkgdir/usr/share/licenses/$pkgname/"
    
      117}
    
      118

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-21 19:37:49	Medium	3
2026-10-21 19:33:05	Medium	3