groonga

maintainer cosmo0920 · 4 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from official source tarball, and the flagged 'gem install' in check() is part of the project's own test suite, not an external payload installation; no untrusted remote code execution occurs.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from official source tarball, and the flagged 'gem install' in check() is part of the project's own test suite, not an external payload installation; no untrusted remote code execution occurs.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:74 MAKEFLAGS="-j$(nproc)" gem install --no-user-install grntest

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Hiroshi Hatake <cosmo0920.wp[at]gmail.com>
    
      2
    
      3pkgname=groonga
    
      4pkgdesc="An open-source fulltext search engine and column store."
    
      5pkgver=16.0.4
    
      6pkgrel=1
    
      7arch=('i686' 'x86_64')
    
      8url="https://groonga.org/"
    
      9license=('LGPL2.1-or-later')
    
      10depends=(
    
      11  arrow
    
      12  blas
    
      13  blosc2
    
      14  gcc
    
      15  lapack
    
      16  libedit
    
      17  libevent
    
      18  libstemmer
    
      19  lz4
    
      20  mecab-git
    
      21  mecab-ipadic
    
      22  msgpack-c
    
      23  simdjson
    
      24  xsimd
    
      25  xxhash
    
      26  zeromq
    
      27)
    
      28makedepends=(
    
      29  cmake
    
      30  ninja
    
      31  pkgconf
    
      32  ruby
    
      33  ruby-rake
    
      34)
    
      35checkdepends=(
    
      36  git
    
      37  make
    
      38  ruby-bundler
    
      39  ruby-erb
    
      40)
    
      41source=(
    
      42  "https://github.com/groonga/groonga/releases/download/v${pkgver}/${pkgname}-${pkgver}.tar.gz"
    
      43  "https://github.com/groonga/groonga/releases/download/v${pkgver}/${pkgname}-${pkgver}.tar.gz.asc"
    
      44)
    
      45sha512sums=(
    
      46  "f99af9c3e826f86588f83f117f0af17b25b1fcfab9934b5f4424f4fda70bba180f66afa57377107cc69554a50e6024f13d6bea7c67935175a7770d8744ab2506"
    
      47  "SKIP"
    
      48)
    
      49validpgpkeys=(2701F317CFCCCB975CADE9C2624CF77434839225)
    
      50
    
      51# See also: https://wiki.archlinux.org/title/CMake_package_guidelines
    
      52build() {
    
      53  rm -rf build
    
      54  local cmake_options=(
    
      55    -B build
    
      56    -S "${pkgname}-${pkgver}"
    
      57    -G Ninja
    
      58    -W no-dev
    
      59    -D CMAKE_BUILD_TYPE=None
    
      60    -D CMAKE_INSTALL_PREFIX=/usr
    
      61    -D CMAKE_SKIP_RPATH=ON
    
      62    -D GRN_WITH_APACHE_ARROW=ON
    
      63    -D GRN_WITH_BLOSC=system
    
      64    -D GRN_WITH_MRUBY=ON
    
      65  )
    
      66  cmake "${cmake_options[@]}"
    
      67  cmake --build build
    
      68}
    
      69
    
      70check() {
    
      71  cd build
    
      72  export GEM_HOME="${PWD}/gem"
    
      73  PATH="${GEM_HOME}/bin:${PATH}"
    
      74  MAKEFLAGS="-j$(nproc)" gem install --no-user-install grntest
    
      75  BUILD_DIR="${PWD}/test/command" \
    
      76    "../${pkgname}-${pkgver}/test/command/run-test.sh" \
    
      77    --n-retries=2 \
    
      78    --read-timeout=30 \
    
      79    --reporter=mark
    
      80}
    
      81
    
      82package() {
    
      83  DESTDIR="${pkgdir}" cmake --install build
    
      84}
    
      85

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2