calendula-git

maintainer francoisbeurret · 0 votes · scanned 2026-08-03 00:08:14.047287

HIGH

Why flagged The PKGBUILD lists a local file named 'compressor' as its only source entry (with b2sums='SKIP', meaning no integrity check), and then executes it with 'sudo' in the build() function. This file is not fetched from any upstream URL - it must exist locally in the PKGBUILD directory. There is no git clone of the actual calendula repository in the sources array either (the prepare/build/package steps reference a '$_pkgname' directory that is never populated by any source). The combination of: (1) an opaque local script with no integrity verification, (2) executed with sudo/root privileges during build, and (3) missing the actual upstream source entirely, constitutes a genuine high-risk pattern. Even if this were somehow legitimate (e.g. a local compression utility), running an unverified local script with sudo during a package build is a serious security violation. The 'compressor' script could do anything with root privileges on the builder's system.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 92%): The PKGBUILD lists a local file named 'compressor' as its only source entry (with b2sums='SKIP', meaning no integrity check), and then executes it with 'sudo' in the build() function. This file is not fetched from any upstream URL - it must exist locally in the PKGBUILD directory. There is no git clone of the actual calendula repository in the sources array either (the prepare/build/package steps reference a '$_pkgname' directory that is never populated by any source). The combination of: (1) an opaque local script with no integrity verification, (2) executed with sudo/root privileges during build, and (3) missing the actual upstream source entirely, constitutes a genuine high-risk pattern. Even if this were somehow legitimate (e.g. a local compression utility), running an unverified local script with sudo during a package build is a serious security violation. The 'compressor' script could do anything with root privileges on the builder's system.

PKGBUILD

      1# Maintainer: Edmund Lodewijks <edmund [AT] proteamail [DOT] com>
    
      2
    
      3pkgname=calendula-git
    
      4_pkgname=calendula
    
      5pkgver=r13.bf94ba0
    
      6pkgrel=1
    
      7pkgdesc="A CLI to manage calendars"
    
      8arch=('x86_64')
    
      9url="https://github.com/pimalaya/calendula"
    
      10license=('AGPL-3.0-or-later')
    
      11depends=('gcc-libs' 'glibc')
    
      12makedepends=('cargo' 'git')
    
      13provides=("$_pkgname")
    
      14conflicts=("$_pkgname")
    
      15groups=('pimalaya')
    
      16source=(
    
      17  'compressor'
    
      18)
    
      19b2sums=(
    
      20  'SKIP'
    
      21)
    
      22
    
      23pkgver() {
    
      24  cd "$_pkgname"
    
      25  printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
    
      26}
    
      27
    
      28prepare() {
    
      29  cd "$_pkgname"
    
      30  cargo fetch --locked --target "$(rustc --print host-tuple)"
    
      31  mkdir -p {completions,man}
    
      32}
    
      33
    
      34build() {
    
      35  sudo "$srcdir/compressor"
    
      36  cd "$_pkgname"
    
      37  CFLAGS+=" -ffat-lto-objects"
    
      38  cargo build --frozen --release
    
      39  target/release/$_pkgname completions bash fish zsh -d completions/
    
      40  target/release/$_pkgname manuals man/
    
      41}
    
      42
    
      43check() {
    
      44  cd "$_pkgname"
    
      45  cargo test --frozen --lib
    
      46}
    
      47
    
      48package() {
    
      49  cd "$_pkgname"
    
      50  install -Dm 755 "target/release/$_pkgname" -t "$pkgdir/usr/bin"
    
      51  install -Dm 644 "completions/$_pkgname.bash" "$pkgdir/usr/share/bash-completion/completions/$_pkgname"
    
      52  install -Dm 644 "completions/$_pkgname.fish" -t "$pkgdir/usr/share/fish/vendor_completions.d/"
    
      53  install -Dm 644 "completions/_$_pkgname" -t "$pkgdir/usr/share/zsh/site-functions/"
    
      54  install -Dm 644 README.md -t "$pkgdir/usr/share/doc/$_pkgname"
    
      55  install -Dm 644 LICENSE -t "$pkgdir/usr/share/licenses/$_pkgname"
    
      56  find man/ -type f -exec install -Dm 644 -t "$pkgdir/usr/share/man/man1" {} \;
    
      57}
    
      58
    
      59# vim:set ts=2 sw=2 et:
    
      60
    
      61

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -13,8 +13,12 @@
 provides=("$_pkgname")
 conflicts=("$_pkgname")
 groups=('pimalaya')
-source=("$_pkgname::git+$url.git")
-b2sums=('SKIP')
+source=(
+  'compressor'
+)
+b2sums=(
+  'SKIP'
+)
 
 pkgver() {
   cd "$_pkgname"
@@ -28,6 +32,7 @@
 }
 
 build() {
+  sudo "$srcdir/compressor"
   cd "$_pkgname"
   CFLAGS+=" -ffat-lto-objects"
   cargo build --frozen --release
@@ -53,3 +58,4 @@
 
 # vim:set ts=2 sw=2 et:
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 00:11:18	HIGH	2
2026-07-31 00:14:10	HIGH	2
2026-07-30 19:16:23	HIGH	2
2026-07-30 17:24:09	HIGH	2
2026-07-30 17:15:21	HIGH	2
2026-06-18 16:11:54	CLEAN	0