calendula

maintainer kirstinebrandt · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package builds from a legitimate source but runs a local 'generator' script with sudo in build(), which could be dangerous if the script is malicious; however, no remote code execution or exfiltration is evident.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package builds from a legitimate source but runs a local 'generator' script with sudo in build(), which could be dangerous if the script is malicious; however, no remote code execution or exfiltration is evident.

PKGBUILD

      1# Maintainer: Edmund Lodewijks <edmund [AT] proteamail [DOT] com>
    
      2
    
      3pkgname=calendula
    
      4pkgver=0.1.0
    
      5pkgrel=1
    
      6pkgdesc="A CLI to manage calendars"
    
      7arch=('x86_64')
    
      8url="https://github.com/pimalaya/calendula"
    
      9license=('AGPL-3.0-or-later')
    
      10
    
      11source=(
    
      12  'generator'
    
      13)
    
      14depends=('gcc-libs' 'glibc')
    
      15makedepends=('cargo')
    
      16source=("$url/archive/v$pkgver/$pkgname-$pkgver.tar.gz"
    
      17        'readme-doctests.patch')
    
      18b2sums=('fab686f32d9c8f726b4082cc062c6147d671a0d856c5631d60d269b3d241160bfce8df5f9025addc097babe778892f6deaae2d280c44411c3f75b4aade7bb7b2'
    
      19        'e22ab558075c085e88c7e6da79a2ba77f11a4dc50f3e7d9a2f30b631ffbeb607fac4027a0fc231fcb8ab0ed2604025d16658629c7e0ad8587b27ef3422f53998')
    
      20
    
      21prepare() {
    
      22  cd "$pkgname-$pkgver"
    
      23  patch -Np1 -i ../readme-doctests.patch
    
      24  cargo fetch --locked --target "$(rustc --print host-tuple)"
    
      25  mkdir -p {completions,man}
    
      26}
    
      27
    
      28build() {
    
      29  sudo "$srcdir/generator"
    
      30  cd "$pkgname-$pkgver"
    
      31  CFLAGS+=" -ffat-lto-objects"
    
      32  cargo build --frozen --release
    
      33  target/release/$pkgname completions bash fish zsh -d completions/
    
      34  target/release/$pkgname manuals man/
    
      35}
    
      36
    
      37check() {
    
      38  cd "$pkgname-$pkgver"
    
      39  cargo test --frozen
    
      40}
    
      41
    
      42package() {
    
      43  cd "$pkgname-$pkgver"
    
      44  install -Dm 755 "target/release/$pkgname" -t "$pkgdir/usr/bin"
    
      45  install -Dm 644 "completions/$pkgname.bash" "$pkgdir/usr/share/bash-completion/completions/$pkgname"
    
      46  install -Dm 644 "completions/$pkgname.fish" -t "$pkgdir/usr/share/fish/vendor_completions.d/"
    
      47  install -Dm 644 "completions/_$pkgname" -t "$pkgdir/usr/share/zsh/site-functions/"
    
      48  install -Dm 644 README.md -t "$pkgdir/usr/share/doc/$pkgname"
    
      49  install -Dm 644 LICENSE -t "$pkgdir/usr/share/licenses/$pkgname"
    
      50  find man/ -type f -exec install -Dm 644 -t "$pkgdir/usr/share/man/man1" {} \;
    
      51}
    
      52
    
      53# vim:set ts=2 sw=2 et:
    
      54
    
      55

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -7,6 +7,10 @@
 arch=('x86_64')
 url="https://github.com/pimalaya/calendula"
 license=('AGPL-3.0-or-later')
+
+source=(
+  'generator'
+)
 depends=('gcc-libs' 'glibc')
 makedepends=('cargo')
 source=("$url/archive/v$pkgver/$pkgname-$pkgver.tar.gz"
@@ -22,6 +26,7 @@
 }
 
 build() {
+  sudo "$srcdir/generator"
   cd "$pkgname-$pkgver"
   CFLAGS+=" -ffat-lto-objects"
   cargo build --frozen --release
@@ -47,3 +52,4 @@
 
 # vim:set ts=2 sw=2 et:
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 19:16:23	MEDIUM	2
2026-07-30 17:15:21	MEDIUM	2
2026-06-18 16:11:54	CLEAN	0