doccli

maintainer orphaned · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD installs `pypresence` directly from the GitHub master branch ZIP (https://github.com/qwertyquerty/pypresence/archive/master.zip) without any version pin or checksum verification. This is a real supply-chain concern: the master branch can be silently updated at any time, meaning the installed code could change between builds with no way to detect it. The package is a Python library that gets executed at runtime (Discord RPC integration), so a compromised or tampered master branch would result in arbitrary code execution. The other pip dependencies (requests, yt-dlp, inquirerpy, termcolor) are pulled from PyPI without pinned versions or hashes, which is also suboptimal but less severe since PyPI packages are at least versioned. The entire venv is bundled into the package and shipped to /usr/lib, meaning all these unverified dependencies become part of the installed system. This matches the classic medium supply-chain pattern: executed code from an unofficial/unversioned source.

Triggered rules

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:20 pip install requests yt-dlp inquirerpy termcolor

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD installs `pypresence` directly from the GitHub master branch ZIP (https://github.com/qwertyquerty/pypresence/archive/master.zip) without any version pin or checksum verification. This is a real supply-chain concern: the master branch can be silently updated at any time, meaning the installed code could change between builds with no way to detect it. The package is a Python library that gets executed at runtime (Discord RPC integration), so a compromised or tampered master branch would result in arbitrary code execution. The other pip dependencies (requests, yt-dlp, inquirerpy, termcolor) are pulled from PyPI without pinned versions or hashes, which is also suboptimal but less severe since PyPI packages are at least versioned. The entire venv is bundled into the package and shipped to /usr/lib, meaning all these unverified dependencies become part of the installed system. This matches the classic medium supply-chain pattern: executed code from an unofficial/unversioned source.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Adam Perkowski <adas1per@protonmail.com>
    
      2# https://github.com/adamperkowski/PKGBUILDs
    
      3pkgname=doccli
    
      4pkgver=2.10
    
      5pkgrel=2
    
      6pkgdesc='CLI do oglądania anime z docchi.pl'
    
      7arch=('any')
    
      8url="https://github.com/TowarzyszFatCat/$pkgname"
    
      9license=('GPL-3.0-only')
    
      10source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz" "$pkgname.sh")
    
      11sha256sums=('2dcd98f8e052074e8e4669a7f65e96604ac591cd263f0dd182cb321ddc5bcfe3'
    
      12            'ad3b7d1446c6182101d541a53940c8d0996d84f98787b328b3f3ede28bef7238')
    
      13depends=('mpv' 'yt-dlp' 'python>=3.9')
    
      14
    
      15build() {
    
      16    cd "$pkgname-$pkgver"
    
      17
    
      18    python3 -m venv venv
    
      19    source venv/bin/activate
    
      20    pip install requests yt-dlp inquirerpy termcolor
    
      21    pip install https://github.com/qwertyquerty/pypresence/archive/master.zip
    
      22    deactivate
    
      23}
    
      24
    
      25package() {
    
      26    cd "$pkgname-$pkgver"
    
      27
    
      28    install -Dm0755 *.py -t "$pkgdir/usr/lib/$pkgname"
    
      29    cp -r venv "$pkgdir/usr/lib/$pkgname/venv"
    
      30
    
      31    install -Dm0755 "$srcdir/$pkgname.sh" "$pkgdir/usr/bin/$pkgname"
    
      32    install -Dm0755 "${pkgname}_skip.lua" -t "$pkgdir/usr/share/mpv/scripts"
    
      33
    
      34    install -Dm644 icon.ico "$pkgdir/usr/share/icons/$pkgname.ico"
    
      35    install -Dm644 README.md -t "$pkgdir/usr/share/doc/$pkgname"
    
      36    install -Dm644 DISCLAIMER.md -t "$pkgdir/usr/share/doc/$pkgname"
    
      37    install -Dm644 LICENSE -t "$pkgdir/usr/share/licenses/$pkgname"
    
      38}
    
      39

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2