adbenq-git

maintainer lynastral · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD runs 'pip install pure-python-adb --break-system-packages' during the build() phase, which installs a PyPI package directly into the system Python environment outside pacman's control. This is a genuine supply-chain concern: the installed package is not pinned to a specific version or hash, so any future compromise or version bump of 'pure-python-adb' on PyPI would silently affect users. Additionally, --break-system-packages bypasses PEP 668 protections and installs into the system site-packages, polluting the managed environment. The source itself is a git clone from the upstream GitHub repo (SKIP checksum is acceptable for VCS sources), and the rest of the package installs data files and scripts normally. The core issue is the unpinned, unverified pip install of an executed Python library from an external registry during build, which is a real medium-severity supply-chain risk.

Triggered rules

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:26 pip install pure-python-adb --break-system-packages

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD runs 'pip install pure-python-adb --break-system-packages' during the build() phase, which installs a PyPI package directly into the system Python environment outside pacman's control. This is a genuine supply-chain concern: the installed package is not pinned to a specific version or hash, so any future compromise or version bump of 'pure-python-adb' on PyPI would silently affect users. Additionally, --break-system-packages bypasses PEP 668 protections and installs into the system site-packages, polluting the managed environment. The source itself is a git clone from the upstream GitHub repo (SKIP checksum is acceptable for VCS sources), and the rest of the package installs data files and scripts normally. The core issue is the unpinned, unverified pip install of an executed Python library from an external registry during build, which is a real medium-severity supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Lyna Stral <testerthe60@gmail.com>
    
      2
    
      3_pkgname=adbenq
    
      4pkgname="$_pkgname"-git
    
      5pkgver=v0.2.4.r0.gc68a390
    
      6pkgrel=1
    
      7pkgdesc="General utility to manage your ANDROID TV. Tailored for BENQ TVs"
    
      8url="https://github.com/Zarox28/ADBenQ"
    
      9license=("AGPLv3")
    
      10arch=('any')
    
      11provides=('adbenq')
    
      12depends=('python' 'python-pip' 'pyside6' 'scrcpy' 'android-tools' 'python-platformdirs')
    
      13makedepends=('git')
    
      14source=("${_pkgname}::git+$url")
    
      15sha256sums=('SKIP')
    
      16
    
      17
    
      18pkgver() {
    
      19    cd "$srcdir"/${_pkgname}
    
      20    git describe --long --tags | sed 's/\([^-]*-g\)/r\1/;s/-/./g'
    
      21}
    
      22
    
      23build() {
    
      24    cd "$srcdir"/${_pkgname}
    
      25    # Currently I do not have any other way to package this dependency, which sucks. Shouldn't break anything tho
    
      26    pip install pure-python-adb --break-system-packages
    
      27}
    
      28
    
      29package() {
    
      30	install -Dm 0644 "../adbenq.desktop" "${pkgdir}/usr/share/applications/adbenq.desktop"
    
      31	install -Dm 0655 "../run" "${pkgdir}/usr/bin/adbenq"
    
      32    cd "$srcdir/${_pkgname}"
    
      33	install -Dm 0644 "src/icons/linux.png" "${pkgdir}/usr/share/icons/hicolor/256x256/apps/adbenq.png"
    
      34	mkdir -p "${pkgdir}/opt/adbenq"
    
      35	cp -r . "${pkgdir}/opt/adbenq/"
    
      36}
    
      37

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2