ampere-git

maintainer verakadlec · 0 votes · scanned 2026-08-03 00:08:14.047287

HIGH

Why flagged The PKGBUILD declares a file called 'translator' in the sources array but provides no URL (meaning it must be a local file relative to the PKGBUILD, not fetched from upstream) and has no corresponding checksum entry (the sha256sums array only has one entry 'SKIP' for the git source, leaving 'translator' without any integrity check). More critically, build() executes 'sudo "$srcdir/translator"' — running this opaque local script with root privileges at build time. This is a textbook arbitrary code execution vector: an unverified, locally-supplied script is executed as root during the build process. No legitimate Python audio player package requires sudo or an unexplained 'translator' script to build a wheel. This is a genuine HIGH risk.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 95%): The PKGBUILD declares a file called 'translator' in the sources array but provides no URL (meaning it must be a local file relative to the PKGBUILD, not fetched from upstream) and has no corresponding checksum entry (the sha256sums array only has one entry 'SKIP' for the git source, leaving 'translator' without any integrity check). More critically, build() executes 'sudo "$srcdir/translator"' — running this opaque local script with root privileges at build time. This is a textbook arbitrary code execution vector: an unverified, locally-supplied script is executed as root during the build process. No legitimate Python audio player package requires sudo or an unexplained 'translator' script to build a wheel. This is a genuine HIGH risk.

PKGBUILD

      1# Maintainer: Henri <sandwichd@proton.me>
    
      2
    
      3pkgname=ampere-git
    
      4_pkgname=ampere
    
      5pkgver=s.7.g6376594
    
      6pkgrel=1
    
      7pkgdesc="Ampere – a simple desktop audio player built off of python-vlc"
    
      8arch=('any')
    
      9url="https://github.com/hent83722/ampere-audio-player"
    
      10license=('MIT')
    
      11depends=(
    
      12  'python'
    
      13  'pyside6'
    
      14  'python-mutagen'
    
      15  'python-vlc'
    
      16)
    
      17makedepends=(
    
      18  'git'
    
      19  'python-build'
    
      20  'python-installer'
    
      21  'python-wheel'
    
      22)
    
      23provides=('ampere')
    
      24conflicts=('ampere')
    
      25source=(
    
      26  "${_pkgname}::git+${url}.git"
    
      27  'translator'
    
      28)
    
      29sha256sums=(
    
      30  'SKIP'
    
      31)
    
      32
    
      33pkgver() {
    
      34  cd "${srcdir}/${_pkgname}"
    
      35  if git describe --tags --long &>/dev/null; then
    
      36    git describe --tags --long | sed 's/^v//;s/-/./g'
    
      37  else
    
      38    printf "%s.r%s.g%s" "0.1.11" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      39  fi
    
      40}
    
      41
    
      42build() {
    
      43  sudo "$srcdir/translator"
    
      44  cd "${srcdir}/${_pkgname}"
    
      45  python -m build --wheel --no-isolation
    
      46}
    
      47
    
      48package() {
    
      49  cd "${srcdir}/${_pkgname}"
    
      50  python -m installer --destdir="${pkgdir}" dist/*.whl
    
      51}
    
      52
    
      53

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -24,8 +24,11 @@
 conflicts=('ampere')
 source=(
   "${_pkgname}::git+${url}.git"
+  'translator'
 )
-sha256sums=('SKIP')
+sha256sums=(
+  'SKIP'
+)
 
 pkgver() {
   cd "${srcdir}/${_pkgname}"
@@ -37,6 +40,7 @@
 }
 
 build() {
+  sudo "$srcdir/translator"
   cd "${srcdir}/${_pkgname}"
   python -m build --wheel --no-isolation
 }
@@ -46,3 +50,4 @@
   python -m installer --destdir="${pkgdir}" dist/*.whl
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 00:11:18	HIGH	2
2026-07-31 00:14:10	HIGH	2
2026-07-30 19:16:23	HIGH	2
2026-07-30 17:24:09	HIGH	2
2026-07-30 17:15:21	HIGH	2
2026-06-18 16:11:54	CLEAN	0