gotohp-git

maintainer krishn · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD runs `go install github.com/wailsapp/wails/v3/cmd/wails3@latest` at build time, fetching and executing an unpinned (`@latest`) version of the Wails build tool from the internet with no checksum verification. While wailsapp/wails is a legitimate, well-known open-source project, using `@latest` means any future compromise or version bump of that module (or its transitive dependencies resolved at build time) would silently execute arbitrary code during the build. This is a genuine supply-chain concern: an executed build tool pulled at an unversioned, unverified reference. The main application source itself is cloned from the official GitHub repo (git+https, SKIP checksum is acceptable for -git packages), but the unbounded `@latest` go install is the real issue. This is a real medium-severity concern, not a false positive.

Triggered rules

MEDIUM External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:37 go install github.com/wailsapp/wails/v3/cmd/wails3@latest

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD runs `go install github.com/wailsapp/wails/v3/cmd/wails3@latest` at build time, fetching and executing an unpinned (`@latest`) version of the Wails build tool from the internet with no checksum verification. While wailsapp/wails is a legitimate, well-known open-source project, using `@latest` means any future compromise or version bump of that module (or its transitive dependencies resolved at build time) would silently execute arbitrary code during the build. This is a genuine supply-chain concern: an executed build tool pulled at an unversioned, unverified reference. The main application source itself is cloned from the official GitHub repo (git+https, SKIP checksum is acceptable for -git packages), but the unbounded `@latest` go install is the real issue. This is a real medium-severity concern, not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Omansh Krishn <omansh@duck.com>
    
      2
    
      3_pkgname=gotohp
    
      4pkgname=${_pkgname}-git
    
      5pkgver=0.7.0.r1.g5c26b8c
    
      6pkgrel=1
    
      7pkgdesc='Unofficial Google Photos Desktop GUI Client - git version'
    
      8arch=('x86_64')
    
      9url='https://github.com/xob0t/gotohp'
    
      10license=('MIT')
    
      11makedepends=(
    
      12  git
    
      13  go
    
      14  nodejs
    
      15  npm
    
      16  pkgconf
    
      17)
    
      18depends=(
    
      19  webkit2gtk-4.1
    
      20  gtk3
    
      21)
    
      22provides=("${_pkgname}" "${_pkgname}=${pkgver}")
    
      23conflicts=("${_pkgname}" "${_pkgname}-bin")
    
      24options=(!debug)
    
      25
    
      26source=("${_pkgname}"::"git+${url}.git")
    
      27sha256sums=('SKIP')
    
      28
    
      29pkgver() {
    
      30    git -C "${srcdir}/${_pkgname}" describe --long --tags | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
    
      31}
    
      32
    
      33build() {
    
      34  cd "${srcdir}/${_pkgname}"
    
      35  export GOPATH="${srcdir}/go"
    
      36  export PATH="${GOPATH}/bin:${PATH}"
    
      37  go install github.com/wailsapp/wails/v3/cmd/wails3@latest
    
      38  # go build -tags production -trimpath -buildvcs=false -ldflags="-w -s" -o bin/gotohp
    
      39  wails3 task linux:build -- PRODUCTION=true
    
      40}
    
      41
    
      42package() {
    
      43  install -dm755 "${pkgdir}/usr/bin"
    
      44  install -m755 "${srcdir}/${_pkgname}/bin/${_pkgname}" "${pkgdir}/usr/bin/${_pkgname}"
    
      45
    
      46  install -dm755 "${pkgdir}/usr/share/icons/hicolor/128x128/apps"
    
      47  install -m644 "${srcdir}/${_pkgname}/build/appicon.png" "${pkgdir}/usr/share/icons/hicolor/128x128/apps/${_pkgname}.png"
    
      48
    
      49  install -dm755 "${pkgdir}/usr/share/applications"
    
      50  sed -i "s|^Exec=.*|Exec=${_pkgname}|" "${srcdir}/${_pkgname}/build/linux/desktop"
    
      51  install -Dm644 "${srcdir}/${_pkgname}/build/linux/desktop" "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      52}
    
      53

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2