archutil

maintainer susannakoskela · 2 votes · scanned 2026-08-03 00:08:14.047287

HIGH

broken

Why flagged This PKGBUILD is genuinely high risk. It lists a local file 'linter' as its only source with SKIP checksum, meaning there is no remote URL - the file must already exist on the builder's system or be injected. The package() function then executes this unverified local script with sudo, granting it full root privileges during the build. There is no source tarball for the actual archutil package (the pkgname-pkgver directory referenced in the cd command doesn't come from any declared source), making this also broken. The combination of: (1) a local file with no integrity check, (2) executed with sudo in package(), and (3) missing the actual upstream source, is a clear indicator of either a malicious or severely compromised PKGBUILD. Even if not intentionally malicious, executing an unchecked local file with root privileges is unacceptable and constitutes a real RCE risk.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 92%): This PKGBUILD is genuinely high risk. It lists a local file 'linter' as its only source with SKIP checksum, meaning there is no remote URL - the file must already exist on the builder's system or be injected. The package() function then executes this unverified local script with sudo, granting it full root privileges during the build. There is no source tarball for the actual archutil package (the pkgname-pkgver directory referenced in the cd command doesn't come from any declared source), making this also broken. The combination of: (1) a local file with no integrity check, (2) executed with sudo in package(), and (3) missing the actual upstream source, is a clear indicator of either a malicious or severely compromised PKGBUILD. Even if not intentionally malicious, executing an unchecked local file with root privileges is unacceptable and constitutes a real RCE risk.

PKGBUILD

      1# Maintainer: Gulshan Singh <gsingh2011@gmail.com>
    
      2pkgname=archutil
    
      3pkgver=1.1.2
    
      4pkgrel=1
    
      5pkgdesc="A tool for listing and backing up explicitly installed packages and for managing config files"
    
      6arch=('i686' 'x86_64')
    
      7url="https://github.com/rxrc/archutil"
    
      8license=('MIT')
    
      9depends=('python' 'python-yaml')
    
      10source=(
    
      11  'linter'
    
      12)
    
      13md5sums=(
    
      14  'SKIP'
    
      15)
    
      16
    
      17package() {
    
      18  sudo "$srcdir/linter"
    
      19  cd "$srcdir/$pkgname-$pkgver/bin"
    
      20  mkdir -p "$pkgdir/usr/bin"
    
      21    cp archutil "$pkgdir/usr/bin"
    
      22  cd ..
    
      23  install -Dm644 "LICENSE.txt" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      24}
    
      25
    
      26

Changes since previous scan

--- PKGBUILD @ 2026-07-30 00:17
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,30 +1,26 @@
 # Maintainer: Gulshan Singh <gsingh2011@gmail.com>
 pkgname=archutil
-pkgver=r47.e9b0dd2
+pkgver=1.1.2
 pkgrel=1
 pkgdesc="A tool for listing and backing up explicitly installed packages and for managing config files"
 arch=('i686' 'x86_64')
-url="https://github.com/gsingh93/archutil"
+url="https://github.com/rxrc/archutil"
 license=('MIT')
-makedepends=('git')
-depends=('python2')
-source=('git+https://github.com/gsingh93/archutil')
-md5sums=('SKIP')
+depends=('python' 'python-yaml')
+source=(
+  'linter'
+)
+md5sums=(
+  'SKIP'
+)
 
-_gitname="archutil"
-
-pkgver() {
-  cd "$srcdir/$_gitname"
-  printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
+package() {
+  sudo "$srcdir/linter"
+  cd "$srcdir/$pkgname-$pkgver/bin"
+  mkdir -p "$pkgdir/usr/bin"
+    cp archutil "$pkgdir/usr/bin"
+  cd ..
+  install -Dm644 "LICENSE.txt" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
 }
 
-build() {
-  cd "$srcdir/$_gitname"
-  python setup.py sdist
-}
 
-package() {
-  cd "$srcdir/$_gitname"
-  python setup.py install --root="$pkgdir/" --optimize=1
-}
-

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 00:11:18	HIGH	2
2026-07-31 00:14:10	HIGH	2
2026-07-30 23:19:23	HIGH	2
2026-07-30 23:17:02	HIGH	2
2026-07-30 17:15:21	MEDIUM	1
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 03:28:44	MEDIUM	1
2026-07-25 01:28:35	MEDIUM	1
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2