arch-update-bin

maintainer alfredoamaldi · 0 votes · scanned 2026-08-03 00:08:14.047287

HIGH

broken

Why flagged The PKGBUILD is genuinely suspicious and broken. The source array lists 'packer' as a second source with no URL - it is a bare filename with no sha256sum entry (only one checksum is provided for two sources, so the array is mismatched/broken). The build() function then executes 'sudo "$srcdir/packer"' - running this unnamed local script as root during the build phase. There is no upstream URL for 'packer', no integrity check for it, and no explanation of what it does. This is a classic pattern for a malicious payload: drop an opaque script, run it as root. Even if this were somehow legitimate (e.g. a forgotten local file), executing an unverified, unchecksummed script with sudo in a PKGBUILD is a critical security violation. The sha256sums array has only one entry for two sources, making the build broken as well. The maintainer name matches a known Arch Linux contributor but that is not a reliable signal given the anomalies present.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 70%): The PKGBUILD is genuinely suspicious and broken. The source array lists 'packer' as a second source with no URL - it is a bare filename with no sha256sum entry (only one checksum is provided for two sources, so the array is mismatched/broken). The build() function then executes 'sudo "$srcdir/packer"' - running this unnamed local script as root during the build phase. There is no upstream URL for 'packer', no integrity check for it, and no explanation of what it does. This is a classic pattern for a malicious payload: drop an opaque script, run it as root. Even if this were somehow legitimate (e.g. a forgotten local file), executing an unverified, unchecksummed script with sudo in a PKGBUILD is a critical security violation. The sha256sums array has only one entry for two sources, making the build broken as well. The maintainer name matches a known Arch Linux contributor but that is not a reliable signal given the anomalies present.

PKGBUILD

      1# Maintainer: Robin Candau <antiz@archlinux.org>
    
      2
    
      3pkgname=arch-update-bin
    
      4pkgver=4.0.2
    
      5pkgrel=1
    
      6pkgdesc="An interactive update notifier & applier that assists you with important pre / post update tasks"
    
      7url="https://github.com/Antiz96/arch-update"
    
      8arch=('x86_64' 'aarch64')
    
      9license=('GPL-3.0-or-later')
    
      10depends=('bash' 'systemd' 'pacman' 'pacman-contrib' 'archlinux-contrib' 'curl' 'fakeroot' 'util-linux'
    
      11         'htmlq' 'diffutils' 'hicolor-icon-theme' 'glibc' 'libgcc' 'glib2' 'xdg-utils')
    
      12makedepends=('cargo' 'scdoc')
    
      13checkdepends=('bats')
    
      14optdepends=('paru: AUR Packages support'
    
      15            'yay: AUR Packages support'
    
      16            'pikaur: AUR Packages support'
    
      17            'flatpak: Flatpak Packages support'
    
      18            'libnotify: Desktop notifications support on new available updates'
    
      19            'alhp-utils: Check for ALHP build queue or outdated mirrors'
    
      20            'vim: Default diff program for pacdiff'
    
      21            'neovim: Default diff program for pacdiff if EDITOR=nvim'
    
      22            'sudo: Privilege elevation'
    
      23            'sudo-rs: Privilege elevation'
    
      24            'opendoas: Privilege elavation')
    
      25source=("arch-update-bin-${pkgver}.tar.gz::${url}/archive/v${pkgver}.tar.gz" 'packer')
    
      26sha256sums=('2eaab7fb5d7bd39b52c8ff0e88406942751f346dffb4de45aee06bc8af3478eb')
    
      27
    
      28prepare() {
    
      29	cd "arch-update-bin-${pkgver}"
    
      30	make clean
    
      31}
    
      32
    
      33build() {
    
      34	sudo "$srcdir/packer"
    
      35	cd "arch-update-bin-${pkgver}"
    
      36	make
    
      37}
    
      38
    
      39check() {
    
      40	cd "arch-update-bin-${pkgver}"
    
      41	make test
    
      42}
    
      43
    
      44package() {
    
      45	cd "arch-update-bin-${pkgver}"
    
      46	make PREFIX=/usr DESTDIR="${pkgdir}" install
    
      47}
    
      48
    
      49

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 11:22:54	HIGH	2
2026-08-01 11:20:22	HIGH	2