faur

maintainer jadonus · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD runs 'pip install colorama' and 'pip install pkgbuilder' directly during the build() phase without any version pinning, checksums, or integrity verification. These packages are pulled from PyPI at build time and installed system-wide (not into a virtualenv or the package directory). This bypasses pacman's dependency tracking and integrity model entirely. While colorama and pkgbuilder are legitimate PyPI packages, installing arbitrary PyPI packages via pip during an AUR build is a genuine supply-chain concern: there is no hash verification, no version lock, and the packages are executed code rather than pure data. Additionally, the package itself is a personal AUR helper script copied directly to /usr/bin without any checksum on the git source. The combination of unverified pip-installed executed code constitutes a real medium-severity supply-chain risk, consistent with the cheaper model's assessment.

Triggered rules

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:33 pip install colorama
PKGBUILD:34 pip install pkgbuilder

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 75%): The PKGBUILD runs 'pip install colorama' and 'pip install pkgbuilder' directly during the build() phase without any version pinning, checksums, or integrity verification. These packages are pulled from PyPI at build time and installed system-wide (not into a virtualenv or the package directory). This bypasses pacman's dependency tracking and integrity model entirely. While colorama and pkgbuilder are legitimate PyPI packages, installing arbitrary PyPI packages via pip during an AUR build is a genuine supply-chain concern: there is no hash verification, no version lock, and the packages are executed code rather than pure data. Additionally, the package itself is a personal AUR helper script copied directly to /usr/bin without any checksum on the git source. The combination of unverified pip-installed executed code constitutes a real medium-severity supply-chain risk, consistent with the cheaper model's assessment.

PKGBUILD

2 offending line(s) highlighted

      1# This is an example PKGBUILD file. Use this as a start to creating your own,
    
      2# and remove these comments. For more information, see 'man PKGBUILD'.
    
      3# NOTE: Please fill out the license field for your package! If it is unknown,
    
      4# then please put 'unknown'.
    
      5
    
      6# Maintainer: Jadon Gearhart <jadongearhart@gmail.com>
    
      7pkgname=faur
    
      8pkgver=1.00
    
      9pkgrel=1
    
      10epoch=
    
      11pkgdesc="The Fancy aur helper. Based off of the awesome PKGBUILDer library. Built for ricers."
    
      12arch=(x86_64)
    
      13url="https://github.com/jadonus/faur.git"
    
      14license=('GPL')
    
      15groups=()
    
      16depends=(noto-fonts-emoji python python-setuptools python-pip)
    
      17makedepends=(git)
    
      18checkdepends=()
    
      19optdepends=()
    
      20provides=()
    
      21conflicts=()
    
      22replaces=()
    
      23backup=()
    
      24options=()
    
      25install=
    
      26changelog=
    
      27source=("git+$url")
    
      28noextract=()
    
      29md5sums=(SKIP)
    
      30validpgpkeys=()
    
      31
    
      32build() {
    
      33	pip install colorama
    
      34	pip install pkgbuilder
    
      35}
    
      36
    
      37package() {
    
      38	cd faur
    
      39	chmod +x faur
    
      40	cp faur /usr/bin/
    
      41}
    
      42

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2