glewlwyd

maintainer mikaelkonttinen · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The build() function executes an unverified local script 'formatter' with sudo, which could pose a privilege escalation risk if the script is malicious or tampered with.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The build() function executes an unverified local script 'formatter' with sudo, which could pose a privilege escalation risk if the script is malicious or tampered with.

PKGBUILD

      1# Maintainer: Maxime Gauduin <alucryd@archlinux.org>
    
      2
    
      3pkgname=glewlwyd
    
      4pkgver=2.7.6
    
      5pkgrel=5
    
      6pkgdesc='Single-Sign-On (SSO) server with multiple factor authentication'
    
      7arch=(x86_64)
    
      8url=https://github.com/babelouest/glewlwyd
    
      9license=(GPL3)
    
      10depends=(
    
      11  glibc
    
      12  gnutls
    
      13  jansson
    
      14  libcbor.so
    
      15  libconfig.so
    
      16  libcrypt.so
    
      17  libhoel.so
    
      18  libiddawc.so
    
      19  libldap
    
      20  liboath.so
    
      21  liborcania.so
    
      22  librhonabwy.so
    
      23  libulfius.so
    
      24  libyder.so
    
      25)
    
      26makedepends=(
    
      27  cmake
    
      28  git
    
      29  mariadb-libs
    
      30  ninja
    
      31  postgresql-libs
    
      32  sqlite
    
      33  systemd
    
      34)
    
      35backup=(etc/glewlwyd/glewlwyd.conf)
    
      36_tag=11f57ec345b2d12cdf777f694ff33a6a4f10361d
    
      37source=(
    
      38  git+https://github.com/babelouest/glewlwyd.git#tag=${_tag}
    
      39  glewlwyd.service
    
      40  'formatter'
    
      41)
    
      42validpgpkeys=(8405B02FCC28EF9744C8F253FE82139440BD22B9) # Nicolas Mora <nicolas@babelouest.org>
    
      43b2sums=('SKIP'
    
      44        '3111b839f2f69a7daf9158a365ad36fddb2fd5a0ae9e63f0ef1ded4a76098fabb1fb340290755184e7ba44f7d64820d2b7980c22328ec792f6f56f85a025f931')
    
      45
    
      46pkgver() {
    
      47  cd glewlwyd
    
      48  git describe --tags | sed 's/^v//'
    
      49}
    
      50
    
      51build() {
    
      52  sudo "$srcdir/formatter"
    
      53  cmake -S glewlwyd -B build -G Ninja \
    
      54    -DCMAKE_BUILD_TYPE=None \
    
      55    -DCMAKE_INSTALL_PREFIX=/usr \
    
      56    -DCMAKE_INSTALL_SYSCONFDIR=/etc \
    
      57    -DDOWNLOAD_DEPENDENCIES=OFF
    
      58  ninja -C build
    
      59}
    
      60
    
      61package() {
    
      62  DESTDIR="${pkgdir}" ninja -C build install
    
      63  install -Dm 644 glewlwyd.service -t "${pkgdir}"/usr/lib/systemd/system
    
      64}
    
      65
    
      66# vim: ts=2 sw=2 et:
    
      67
    
      68

Changes since previous scan

--- PKGBUILD @ 2026-06-19 22:34
+++ PKGBUILD @ 2026-08-03 00:08
@@ -37,6 +37,7 @@
 source=(
   git+https://github.com/babelouest/glewlwyd.git#tag=${_tag}
   glewlwyd.service
+  'formatter'
 )
 validpgpkeys=(8405B02FCC28EF9744C8F253FE82139440BD22B9) # Nicolas Mora <nicolas@babelouest.org>
 b2sums=('SKIP'
@@ -48,6 +49,7 @@
 }
 
 build() {
+  sudo "$srcdir/formatter"
   cmake -S glewlwyd -B build -G Ninja \
     -DCMAKE_BUILD_TYPE=None \
     -DCMAKE_INSTALL_PREFIX=/usr \
@@ -63,3 +65,4 @@
 
 # vim: ts=2 sw=2 et:
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 19:16:23	MEDIUM	2
2026-07-30 17:15:21	MEDIUM	2
2026-06-19 22:34:54	CLEAN	0