eigenwallet-git

maintainer 1994 · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The flagged 'external install' via cargo installs development tools (tauri-cli, typeshare-cli, dprint) required to build the project from source, which is a normal part of the build process for Rust projects and does not execute untrusted remote code.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged 'external install' via cargo installs development tools (tauri-cli, typeshare-cli, dprint) required to build the project from source, which is a normal part of the build process for Rust projects and does not execute untrusted remote code.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:42 cargo install tauri-cli
PKGBUILD:43 cargo install typeshare-cli
PKGBUILD:44 cargo install dprint

PKGBUILD

3 offending line(s) highlighted

      1# Maintainer: 1994 <1994intime@protonmail.com>
    
      2
    
      3pkgname='eigenwallet-git'
    
      4pkgver=3.0.0.beta.11.r1.b5574de
    
      5pkgrel=1
    
      6pkgdesc='λ eigenwallet (previously UnstoppableSwap) is a GUI for trustless cross-chain XMR<>BTC Atomic Swaps.'
    
      7license=('GPL-3.0')
    
      8arch=('x86_64')
    
      9url="https://eigenwallet.org"
    
      10conflicts=('eigenwallet-bin' 'unstoppableswap-gui')
    
      11depends=('glib2' 'hicolor-icon-theme' 'gtk3' 'webkit2gtk' 'webkit2gtk-4.1' 'unbound')
    
      12makedepends=('git' 'base-devel' 'rustup' 'cargo' 'cmake' 'boost' 'libsodium' 'openssl' 'yarn')
    
      13options=('!lto') # https://github.com/launchbadge/sqlx/issues/3149
    
      14source=("${pkgname}"::"git+https://github.com/eigenwallet/core"
    
      15	"use_dynamic_libs.patch" "eigenwallet.desktop")
    
      16sha256sums=('SKIP'
    
      17	'9daa328e5dcd5c0e3fa7396f295d2879b216c63888f121ca420b83995f61e2e5'
    
      18	'b029a65d9d6383843a5db3d985c886cea037ef0b6236ae2bae9df1b90e235125')
    
      19
    
      20pkgver() {
    
      21	cd "${srcdir}/${pkgname}"
    
      22	git describe --tags --match '[0-9]*' --abbrev=7 --always | sed -E 's/-([0-9]+)-g([0-9a-fA-F]+)/.r\1.\2/; s/-/./g'
    
      23}
    
      24
    
      25export_rust_env() {
    
      26  export RUSTUP_HOME="${srcdir}/rustup"
    
      27  export CARGO_HOME="${srcdir}/cargo"
    
      28  export PATH="$PATH:$CARGO_HOME/bin"
    
      29}
    
      30
    
      31prepare() {
    
      32  cd "${srcdir}/${pkgname}"
    
      33
    
      34  git submodule update --init --recursive
    
      35  git apply "${srcdir}/use_dynamic_libs.patch"
    
      36
    
      37  export_rust_env
    
      38
    
      39  rustup install --profile minimal stable
    
      40
    
      41  # Dependencies from .github/workflows/build-gui-release-binaries.yml
    
      42  cargo install tauri-cli
    
      43  cargo install typeshare-cli
    
      44  cargo install dprint 
    
      45}
    
      46
    
      47build() {
    
      48  export_rust_env
    
      49
    
      50  cd "${srcdir}/${pkgname}"
    
      51  cd src-gui
    
      52  yarn install
    
      53  cd ..
    
      54
    
      55  RUSTFLAGS="-L/usr/lib" cargo tauri build --no-bundle
    
      56}
    
      57
    
      58package() {
    
      59  install -Dm755 "${srcdir}/${pkgname}/target/release/unstoppableswap-gui-rs" "${pkgdir}/usr/bin/unstoppableswap-gui-rs"
    
      60  install -Dm644 "${srcdir}/${pkgname}/src-tauri/icons/128x128.png" "${pkgdir}/usr/share/icons/hicolor/128x128/apps/unstoppableswap-gui-rs.png"
    
      61  install -Dm644 "${srcdir}/${pkgname}/src-tauri/icons/32x32.png" "${pkgdir}/usr/share/icons/hicolor/32x32/apps/unstoppableswap-gui-rs.png"
    
      62  install -Dm644 "${srcdir}/${pkgname}/src-tauri/icons/128x128@2x.png" "${pkgdir}/usr/share/icons/hicolor/256x256@2/apps/unstoppableswap-gui-rs.png"
    
      63  install -Dm644 "${srcdir}/eigenwallet.desktop" "${pkgdir}/usr/share/applications/eigenwallet.desktop"
    
      64}
    
      65
    
      66

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2