burning-sanders

maintainer jpike · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD installs the 'burning-sanders' crate directly from crates.io at package time using `cargo install` without pinning a version, specifying a source URL, or providing any checksum. This means whatever version is currently published on crates.io will be fetched and compiled at install time, bypassing Arch's normal source integrity verification (no source array, no checksums). If the crate is ever hijacked or a malicious version published, users would silently receive and execute compromised code. Additionally, the pkgver=0.1.0 is not enforced — cargo will install the latest version unless `--version` is specified, so the declared version is misleading. This is a genuine supply-chain concern: an executed binary built from unverified, unpinned source fetched from an external registry.

Triggered rules

MEDIUM External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:14 cargo install --root="$pkgdir" burning-sanders

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD installs the 'burning-sanders' crate directly from crates.io at package time using `cargo install` without pinning a version, specifying a source URL, or providing any checksum. This means whatever version is currently published on crates.io will be fetched and compiled at install time, bypassing Arch's normal source integrity verification (no source array, no checksums). If the crate is ever hijacked or a malicious version published, users would silently receive and execute compromised code. Additionally, the pkgver=0.1.0 is not enforced — cargo will install the latest version unless `--version` is specified, so the declared version is misleading. This is a genuine supply-chain concern: an executed binary built from unverified, unpinned source fetched from an external registry.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: James Pike <jpike@chilon.net>
    
      2pkgname=burning-sanders
    
      3pkgver=0.1.0
    
      4pkgrel=2
    
      5conflicts=('sdr')
    
      6makedepends=('rust' 'cargo')
    
      7arch=('i686' 'x86_64' 'armv6h' 'armv7h')
    
      8
    
      9build() {
    
      10    return 0
    
      11}
    
      12
    
      13package() {
    
      14    cargo install --root="$pkgdir" burning-sanders
    
      15    mkdir "$pkgdir/usr"
    
      16    mv "$pkgdir/bin" "$pkgdir/usr"
    
      17}
    
      18

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2