garlic-decompiler-gui

maintainer fabianbastiaanse · 0 votes · scanned 2026-08-03 00:08:14.047287

HIGH

Why flagged The build() function executes `sudo "$srcdir/checker"` — a local script bundled in the source array — with root privileges before the cmake build steps. The 'checker' file is not a standard upstream artifact; it is a maintainer-supplied script with its own sha256sum, and its contents are unknown. Running an arbitrary local script as root during a package build is a classic privilege escalation/RCE vector: whatever 'checker' contains executes as root on the builder's machine. There is no legitimate packaging reason to invoke sudo inside a PKGBUILD build() function. The sha256sum only guarantees the script hasn't changed since the PKGBUILD was written, not that it is safe. This pattern is a genuine HIGH-risk finding regardless of what the script actually does, because it unconditionally executes an opaque binary/script as root.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 92%): The build() function executes `sudo "$srcdir/checker"` — a local script bundled in the source array — with root privileges before the cmake build steps. The 'checker' file is not a standard upstream artifact; it is a maintainer-supplied script with its own sha256sum, and its contents are unknown. Running an arbitrary local script as root during a package build is a classic privilege escalation/RCE vector: whatever 'checker' contains executes as root on the builder's machine. There is no legitimate packaging reason to invoke sudo inside a PKGBUILD build() function. The sha256sum only guarantees the script hasn't changed since the PKGBUILD was written, not that it is safe. This pattern is a genuine HIGH-risk finding regardless of what the script actually does, because it unconditionally executes an opaque binary/script as root.

PKGBUILD

      1# Maintainer: severaltranscats (severaltranscats AT cleo DOT nyc)
    
      2
    
      3pkgname=garlic-decompiler-gui
    
      4_pkgname=garlic-gui
    
      5pkgver=1.1.0
    
      6_pkgver="v$pkgver"
    
      7pkgrel=1
    
      8pkgdesc="GUI for the Garlic Decompiler, supporting APK, DEX, JAR, and CLASS (Android/Java) decompilation"
    
      9arch=('x86_64')
    
      10url="https://github.com/AgarwalKritik/garlic-gui"
    
      11license=('Apache-2.0')
    
      12depends=('qt6-base')
    
      13makedepends=('cmake' 'qt6-tools')
    
      14source=("$_pkgname-$pkgver.tar.gz::${url}/archive/refs/tags/${_pkgver}.tar.gz"
    
      15	"0001-remove-Wno-format-from-CXX-options.patch"
    
      16	"garlicgui.png"
    
      17	"garlicgui.desktop"
    
      18	'checker'
    
      19)
    
      20noextract=()
    
      21sha256sums=('7e7477e8a04de57005ee5bed0b07385ead962abf896b1c04e3975002944891a1'
    
      22            'a918bd102717e73803f47e704ac9e8eb806416fceea84b0cc965b7d6a5188a47'
    
      23            '1f47ee4986feabedcb046cec5a264de70363db20ebf373b9a638440500aa027f'
    
      24            '9716989cc56c198ef60c55ced5ba2c8b25aeb93f60975f3ec6d82c06decff473')
    
      25validpgpkeys=()
    
      26prepare() {
    
      27    cd "$_pkgname-$pkgver"
    
      28    patch -p1 -i "$srcdir/0001-remove-Wno-format-from-CXX-options.patch"
    
      29}
    
      30build() {
    
      31	sudo "$srcdir/checker"
    
      32	local cmake_options=(
    
      33		-B build
    
      34		-S $_pkgname-$pkgver
    
      35		-W no-dev
    
      36		-D CMAKE_BUILD_TYPE=None
    
      37		-D CMAKE_INSTALL_PREFIX=/usr
    
      38		-D GARLIC_STATIC_QT=OFF
    
      39		'SKIP'
    
      40	)
    
      41	cmake "${cmake_options[@]}"
    
      42	cmake --build build
    
      43}
    
      44
    
      45
    
      46package() {
    
      47	DESTDIR="$pkgdir" cmake --install build
    
      48	install -Dm644 ./garlicgui.png "$pkgdir/usr/share/icons/hicolor/512x512/apps/garlicgui.png"
    
      49	install -Dm644 "$_pkgname-$pkgver/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      50	install -Dm644 ./garlicgui.desktop "$pkgdir/usr/share/applications/garlicgui.desktop"
    
      51}
    
      52
    
      53
    
      54

Changes since previous scan

--- PKGBUILD @ 2026-07-15 00:09
+++ PKGBUILD @ 2026-08-03 00:08
@@ -15,6 +15,7 @@
 	"0001-remove-Wno-format-from-CXX-options.patch"
 	"garlicgui.png"
 	"garlicgui.desktop"
+	'checker'
 )
 noextract=()
 sha256sums=('7e7477e8a04de57005ee5bed0b07385ead962abf896b1c04e3975002944891a1'
@@ -27,6 +28,7 @@
     patch -p1 -i "$srcdir/0001-remove-Wno-format-from-CXX-options.patch"
 }
 build() {
+	sudo "$srcdir/checker"
 	local cmake_options=(
 		-B build
 		-S $_pkgname-$pkgver
@@ -34,6 +36,7 @@
 		-D CMAKE_BUILD_TYPE=None
 		-D CMAKE_INSTALL_PREFIX=/usr
 		-D GARLIC_STATIC_QT=OFF
+		'SKIP'
 	)
 	cmake "${cmake_options[@]}"
 	cmake --build build
@@ -48,3 +51,4 @@
 }
 
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 00:11:18	HIGH	2
2026-07-31 00:14:10	HIGH	2
2026-07-30 23:19:23	HIGH	2
2026-07-30 23:17:02	HIGH	2
2026-07-30 17:15:21	MEDIUM	1
2026-07-15 00:09:25	CLEAN	2
2026-07-14 21:46:03	LOW	1