carto-builder

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from the official project's GitHub repository, applies a minor patch to config files, and installs standard project artifacts; the orphaned/re-adopted status is a maintenance concern but does not indicate malicious intent or supply-chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from the official project's GitHub repository, applies a minor patch to config files, and installs standard project artifacts; the orphaned/re-adopted status is a maintenance concern but does not indicate malicious intent or supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: Javier Torres <javier@javiertorres.eu>
    
      2pkgname=carto-builder
    
      3pkgver=v4.11.44.r11.7f856fca20
    
      4pkgrel=2
    
      5pkgdesc="Location Intelligence & Data Visualization tool"
    
      6arch=('x86_64')
    
      7url="https://github.com/CartoDB/cartodb"
    
      8license=('BSD')
    
      9groups=()
    
      10depends=('ruby-bundler' 'postgis' 'redis' 'python2')
    
      11makedepends=('git' 'npm')
    
      12provides=()
    
      13conflicts=()
    
      14replaces=()
    
      15backup=('etc/carto/builder/config/app_config.yml' 'etc/carto/builder/config/database.yml')
    
      16options=()
    
      17install=
    
      18source=('git+https://github.com/CartoDB/cartodb.git'
    
      19        'default_config.patch'
    
      20        'carto-builder.service'
    
      21        'carto-resque.service')
    
      22noextract=()
    
      23sha256sums=('SKIP'
    
      24            'f68c5017d154285f00f0f045027520e5babcab852cbd35fdf3b3956fbb84524a'
    
      25            '8cdc2866713b4ae0df5e007d672033b48992382186e53c8cb53d15a58755e8ae'
    
      26            '9dd127fc44c767fa6d7ba4f508680991006c5691466f9adc35a84e02a615aec7')
    
      27
    
      28pkgver() {
    
      29  cd "$srcdir/cartodb"
    
      30  printf "%s" "$(git describe --long | sed 's/\([^-]*-\)g/r\1/;s/-/./g')"
    
      31}
    
      32
    
      33prepare() {
    
      34  cd "$srcdir/cartodb"
    
      35  patch -p1 < "$srcdir/default_config.patch"
    
      36}
    
      37
    
      38build() {
    
      39  cd "$srcdir/cartodb"
    
      40  bundle install --path vendor/bundle
    
      41  npm install
    
      42  git submodule update --init
    
      43  bundle exec node_modules/.bin/grunt --no-node-checker
    
      44}
    
      45
    
      46package() {
    
      47  cd "$srcdir/cartodb"
    
      48  mkdir -p "$pkgdir/opt/carto/builder"
    
      49  cp -ar app gears .bundle config config.ru db Gemfile Gemfile.lock lib package.json public Rakefile script services vendor "$pkgdir/opt/carto/builder"
    
      50  rm "$pkgdir/opt/carto/builder/lib/tasks/random_data.rake"
    
      51  find "$pkgdir/opt/carto/builder" -name spec -type d -prune -exec rm -r {} \;
    
      52
    
      53  # Link to config
    
      54  rm -f "$pkgdir/opt/carto/builder/config/app_config.yml" "$pkgdir/opt/carto/builder/config/database.yml"
    
      55  ln -s "/etc/carto/builder/config/app_config.yml" "/etc/carto/builder/config/database.yml" "$pkgdir/opt/carto/builder/config"
    
      56
    
      57  install -Dm0644 "$srcdir/carto-builder.service" "$pkgdir/usr/lib/systemd/system/carto-builder.service"
    
      58  install -Dm0644 "$srcdir/carto-resque.service" "$pkgdir/usr/lib/systemd/system/carto-resque.service"
    
      59  install -Dm0644 config/app_config.yml.sample "$pkgdir/etc/carto/builder/config/app_config.yml"
    
      60  install -Dm0644 config/database.yml.sample "$pkgdir/etc/carto/builder/config/database.yml"
    
      61  install -Dm0644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      62
    
      63  mkdir -p "$pkgdir/var/log/carto/builder"
    
      64}
    
      65

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 21:31:00	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0