gourmand-git

maintainer fridge · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package uses pip to install a Python wheel built from the local source, but the command `venv/bin/pip install --isolated "$wheel[$extras]" "setuptools"` involves a variable expansion `$extras` derived from an external script `get-extras.py` that could influence what is installed, creating a potential supply-chain risk if the script is tampered with or returns unexpected input.

Triggered rules

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:37 venv/bin/pip install --isolated "$wheel[$extras]" "setuptools"

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is MEDIUM (confidence 90%): The package uses pip to install a Python wheel built from the local source, but the command `venv/bin/pip install --isolated "$wheel[$extras]" "setuptools"` involves a variable expansion `$extras` derived from an external script `get-extras.py` that could influence what is installed, creating a potential supply-chain risk if the script is tampered with or returns unexpected input.

PKGBUILD:37 venv/bin/pip install --isolated "$wheel[$extras]" "setuptools"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: fridge <echo dW5sb3ZhYmxlX2ZyaWRnZTM1NkBhbGVlYXMuY29tCg== | base64 -d>
    
      2pkgname="gourmand-git"
    
      3pkgver="1.2.0.r20.be6261df"
    
      4pkgrel="2"
    
      5pkgdesc="A manager, editor, and organizer for recipes."
    
      6url="https://github.com/GourmandRecipeManager/${pkgname%-git}"
    
      7license=("GPL-2.0-only")
    
      8source=("$pkgname::git+$url.git" "get-extras.py")
    
      9b2sums=("SKIP" "d31820469d0cc07c6c53f7ef2bcf59dd153c82b5fc44347bf78d32797f43dbae2ac0a158ed2aba4dc4a2a74cb54539fb5fe1e6148c81e544503da054d992fcbc")
    
      10arch=("x86_64")
    
      11makedepends=("gendesk" "coreutils" "python-virtualenv" "python-pip" "python-setuptools" "git" "intltool")
    
      12depends=("bash")
    
      13conflicts=("${pkgname%-git}")
    
      14provides=("${pkgname%-git}=$pkgver")
    
      15
    
      16pkgver()
    
      17{
    
      18    cd "$pkgname" || exit
    
      19    local currentCommit; currentCommit="$(git rev-parse HEAD)"
    
      20    local latestReleaseWithoutPreReleases; latestReleaseWithoutPreReleases="$(git describe --tags --abbrev=0 --exclude "*rc*")"
    
      21    git describe --long --tags --match "$latestReleaseWithoutPreReleases" "$currentCommit" | sed -r "s/-([0-9]+)-/.r\1./; s/\.g/./"
    
      22}
    
      23
    
      24build()
    
      25{
    
      26    gendesk -f -n --categories="Utility" --startupnotify="true"
    
      27    echo "creating start script"
    
      28    echo -e '#!/bin/bash\ncd "/opt/'"${pkgname%-git}"'/bin"\n"./'"${pkgname%-git}"'" -q "$@"' > "${pkgname%-git}"
    
      29    cd "$pkgname" || exit
    
      30    echo "creating virtual environment"
    
      31    python -m venv --clear --copies venv
    
      32    echo "building Gourmand wheel"
    
      33    python setup.py bdist_wheel
    
      34    echo "installing into virtual environment"
    
      35    local wheel; wheel="$(ls dist/*.whl)"
    
      36    local extras; extras="$($srcdir/get-extras.py)"
    
      37    venv/bin/pip install --isolated "$wheel[$extras]" "setuptools"
    
      38    echo "removing unnecessary packages from virtual environment"
    
      39    venv/bin/pip uninstall --isolated -y pip
    
      40    echo "making virtual environment portable"
    
      41    sed -i '1s|.*|#!/usr/bin/env -S /bin/sh -c '"'"'"\$(dirname "\$0")/python" "\$0" "\$@"'"'"'|' "venv/bin/${pkgname%-git}"
    
      42}
    
      43
    
      44package()
    
      45{
    
      46    install -dv "$pkgdir/opt/${pkgname%-git}"
    
      47    cp -afLv "$pkgname/venv/"* "$pkgdir/opt/${pkgname%-git}"
    
      48    install -Dvm755 "${pkgname%-git}" "$pkgdir/usr/bin/${pkgname%-git}"
    
      49    install -Dvm644 "${pkgname%-git}.desktop" "$pkgdir/usr/share/applications/${pkgname%-git}.desktop"
    
      50    install -Dvm644 "$pkgname/src/${pkgname%-git}/data/images/${pkgname%-git}.svg" "$pkgdir/usr/share/icons/${pkgname%-git}.svg"
    
      51}
    
      52

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2