arch-script-gen

maintainer chitransh4174 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD runs `pip install groq` twice at package() time, pulling the 'groq' Python library directly from PyPI with no pinned version and no checksum verification. This is a genuine supply-chain concern: the groq package on PyPI is not under Arch's control, its version is not locked, and it is fetched and installed into the package tree at build time rather than declared as a proper AUR/pacman dependency. If the PyPI package were compromised or typosquatted, the installed package would silently contain malicious code. The double pip invocation (first with --no-deps, then without) is also unusual and suggests the maintainer is not fully in control of the dependency resolution. The main source tarball is from the official GitHub release with a sha256sum, which is fine, but the unverified pip install of an external library into pkgdir is a real medium-severity supply-chain risk consistent with AUR packaging guidelines violations.

Triggered rules

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:25 pip install groq --target="$pkgdir/usr/lib/$pkgname/lib" --no-deps 2>/dev/null || true
PKGBUILD:26 pip install groq --target="$pkgdir/usr/lib/$pkgname/lib" 2>/dev/null || true

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD runs `pip install groq` twice at package() time, pulling the 'groq' Python library directly from PyPI with no pinned version and no checksum verification. This is a genuine supply-chain concern: the groq package on PyPI is not under Arch's control, its version is not locked, and it is fetched and installed into the package tree at build time rather than declared as a proper AUR/pacman dependency. If the PyPI package were compromised or typosquatted, the installed package would silently contain malicious code. The double pip invocation (first with --no-deps, then without) is also unusual and suggests the maintainer is not fully in control of the dependency resolution. The main source tarball is from the official GitHub release with a sha256sum, which is fine, but the unverified pip install of an external library into pkgdir is a real medium-severity supply-chain risk consistent with AUR packaging guidelines violations.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Chitransh <chitranshSingh4174@gmail.com>
    
      2
    
      3pkgname=arch-script-gen
    
      4pkgver=1.1.1
    
      5pkgrel=1
    
      6pkgdesc="A PyQt6 GUI app that generates Arch Linux configuration bash scripts using the Groq API"
    
      7arch=('any')
    
      8url="https://github.com/ChitranshSingh-ind/ArchScriptGen"
    
      9license=('MIT')
    
      10depends=(
    
      11    'python'
    
      12    'python-pyqt6'
    
      13    'python-requests'
    
      14    'qt6-base'
    
      15)
    
      16makedepends=('python-pip')
    
      17optdepends=()
    
      18source=("$pkgname-$pkgver.tar.gz::https://github.com/ChitranshSingh-ind/ArchScriptGen/archive/refs/tags/v1.1.1.tar.gz")
    
      19sha256sums=('f4c1a9a76848d09ec04815cd2b2a1c468be7fd256d9e8ff99aa8fc9cd9dcfb13')
    
      20
    
      21package() {
    
      22    cd "$srcdir/ArchScriptGen-1.1.1"
    
      23
    
      24    # Install python-groq (not in official repos)
    
      25    pip install groq --target="$pkgdir/usr/lib/$pkgname/lib" --no-deps 2>/dev/null || true
    
      26    pip install groq --target="$pkgdir/usr/lib/$pkgname/lib" 2>/dev/null || true
    
      27
    
      28    # Create app directory
    
      29    install -dm755 "$pkgdir/usr/lib/$pkgname"
    
      30
    
      31    # Install main script
    
      32    install -Dm755 main.py "$pkgdir/usr/lib/$pkgname/main.py"
    
      33
    
      34    # Install assets
    
      35    cp -r themes             "$pkgdir/usr/lib/$pkgname/"
    
      36    cp -r cursors            "$pkgdir/usr/lib/$pkgname/"
    
      37    cp -r DesktopEnvironment "$pkgdir/usr/lib/$pkgname/"
    
      38
    
      39    # Install icon
    
      40    install -Dm644 logo.ico "$pkgdir/usr/share/pixmaps/$pkgname.ico"
    
      41
    
      42    # Create launcher script
    
      43    install -dm755 "$pkgdir/usr/bin"
    
      44    cat > "$pkgdir/usr/bin/$pkgname" << EOF
    
      45#!/bin/bash
    
      46export PYTHONPATH="/usr/lib/$pkgname/lib:\$PYTHONPATH"
    
      47cd /usr/lib/$pkgname
    
      48exec python main.py "\$@"
    
      49EOF
    
      50    chmod +x "$pkgdir/usr/bin/$pkgname"
    
      51
    
      52    # Install desktop entry
    
      53    install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/$pkgname.desktop" << EOF
    
      54[Desktop Entry]
    
      55Name=Arch Script Generator
    
      56Comment=Generate Arch Linux configuration scripts
    
      57Exec=$pkgname
    
      58Icon=$pkgname
    
      59Terminal=false
    
      60Type=Application
    
      61Categories=System;Utility;
    
      62Keywords=arch;linux;bash;script;
    
      63EOF
    
      64}
    
      65

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2