bakajiten-git

MEDIUM

maintainer bakatrouble 0 votes scanned 2026-10-18 21:24:45.186703

View on AUR

Why flagged

The build() function runs 'cargo install' from a GitHub repository (NordSecurity/uniffi-bindgen-cpp) at build time, downloading and compiling unreviewed external Rust code; while the source is a plausible legitimate project (NordSecurity is a known vendor), this pattern of fetching and executing external code during the build introduces supply-chain risk if that repo or tag were compromised, and the checksum is SKIP'd for the main source.

Triggered rules

Medium External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:28 cargo install uniffi-bindgen-cpp \

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): The build() function runs 'cargo install' from a GitHub repository (NordSecurity/uniffi-bindgen-cpp) at build time, downloading and compiling unreviewed external Rust code; while the source is a plausible legitimate project (NordSecurity is a known vendor), this pattern of fetching and executing external code during the build introduces supply-chain risk if that repo or tag were compromised, and the checksum is SKIP'd for the main source.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: bakatrouble <bakatrouble@gmail.com>
    
      2pkgname=bakajiten-git
    
      3_pkgname=bakajiten
    
      4pkgver=0.1.0.r1.g402b4bc
    
      5pkgrel=1
    
      6pkgdesc='Japanese dictionary with handwriting recognition'
    
      7arch=('x86_64')
    
      8url='https://github.com/bakatrouble/bakajiten'
    
      9license=('MIT')
    
      10depends=('qt6-base' 'qt6-svg' 'yaml-cpp' 'hicolor-icon-theme' 'noto-fonts-cjk')
    
      11makedepends=('git' 'cmake' 'ninja' 'rust')
    
      12provides=("$_pkgname")
    
      13conflicts=("$_pkgname")
    
      14source=("git+$url.git")
    
      15sha256sums=('SKIP')
    
      16
    
      17pkgver() {
    
      18  cd "$_pkgname"
    
      19  git describe --long --tags | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
    
      20}
    
      21
    
      22build() {
    
      23  # UniFFI C++ generator, pinned like CI (uniffi-bindgen-cpp
    
      24  # v0.10.0+v0.31.0 for the workspace's uniffi 0.31). Isolated
    
      25  # cargo home so the builder's own registry stays untouched.
    
      26  export CARGO_HOME="$srcdir/cargo-home"
    
      27  export PATH="$CARGO_HOME/bin:$PATH"
    
      28  cargo install uniffi-bindgen-cpp \
    
      29    --git https://github.com/NordSecurity/uniffi-bindgen-cpp \
    
      30    --tag v0.10.0+v0.31.0
    
      31
    
      32  cmake -S "$_pkgname/frontends/frontend_qt" -B build -G Ninja \
    
      33    -DCMAKE_BUILD_TYPE=Release \
    
      34    -DBUILD_QT_TESTS=OFF \
    
      35    -DDEV_UILOADER=OFF
    
      36  cmake --build build
    
      37}
    
      38
    
      39package() {
    
      40  DESTDIR="$pkgdir" cmake --install build --prefix /usr
    
      41}
    
      42

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-18 21:24:45	Medium	3
2026-10-18 21:23:05	Medium	2