groonga

LOW

maintainer cosmo0920 4 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The flagged pattern involves installing 'grntest' via gem during check(), which is a test dependency pulled from RubyGems; this is part of the project's own testing infrastructure, not a malicious payload, and does not affect the final package, so the risk is low.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The flagged pattern involves installing 'grntest' via gem during check(), which is a test dependency pulled from RubyGems; this is part of the project's own testing infrastructure, not a malicious payload, and does not affect the final package, so the risk is low.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:83 MAKEFLAGS="-j$(nproc)" gem install --no-user-install grntest

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Hiroshi Hatake <cosmo0920.wp[at]gmail.com>
    
      2
    
      3pkgname=groonga
    
      4pkgdesc="An open-source fulltext search engine and column store."
    
      5pkgver=16.1.4
    
      6pkgrel=1
    
      7arch=('i686' 'x86_64')
    
      8url="https://groonga.org/"
    
      9license=('LGPL2.1-or-later')
    
      10depends=(
    
      11  arrow
    
      12  blas
    
      13  blosc2
    
      14  gcc
    
      15  lapack
    
      16  libedit
    
      17  libevent
    
      18  libstemmer
    
      19  lz4
    
      20  mecab-git
    
      21  mecab-ipadic
    
      22  msgpack-c
    
      23  simdjson
    
      24  xsimd
    
      25  xxhash
    
      26  zeromq
    
      27)
    
      28makedepends=(
    
      29  cmake
    
      30  ninja
    
      31  pkgconf
    
      32  ruby
    
      33  ruby-rake
    
      34)
    
      35checkdepends=(
    
      36  git
    
      37  make
    
      38  ruby-bundler
    
      39  ruby-erb
    
      40)
    
      41source=(
    
      42  "https://github.com/groonga/groonga/releases/download/v${pkgver}/${pkgname}-${pkgver}.tar.gz"
    
      43  "https://github.com/groonga/groonga/releases/download/v${pkgver}/${pkgname}-${pkgver}.tar.gz.asc"
    
      44)
    
      45sha512sums=(
    
      46  "1a95b78aaabc67d4658834219e00dbe86f49cc0473e643f331a5ac6ebb391bf1335e7039e8a8503724e0d48487dce70f16f5420d6c1643e688832485efbb3c9d"
    
      47  "SKIP"
    
      48)
    
      49validpgpkeys=(2701F317CFCCCB975CADE9C2624CF77434839225)
    
      50
    
      51# See also: https://wiki.archlinux.org/title/CMake_package_guidelines
    
      52build() {
    
      53  rm -rf build
    
      54  local cmake_options=(
    
      55    -B build
    
      56    -S "${pkgname}-${pkgver}"
    
      57    -G Ninja
    
      58    -W no-dev
    
      59    -D CMAKE_BUILD_TYPE=None
    
      60    -D CMAKE_INSTALL_PREFIX=/usr
    
      61    -D CMAKE_SKIP_RPATH=ON
    
      62    -D GRN_WITH_APACHE_ARROW=ON
    
      63    # This is a workaround.
    
      64    # Currently, the system-provided Blosc2 is not used when building Groonga due to the following error.
    
      65    #
    
      66    # CMake Error at /usr/lib/cmake/Blosc2/Blosc2Targets.cmake:108 (message):
    
      67    # The imported target "Blosc2::blosc2_static" references the file
    
      68    # "/usr/lib/libblosc2.a"
    
      69    #
    
      70    # This is an upstream issue.
    
      71    # So, we use bundled Blosc2 until the upstream issue is resolved.
    
      72    -D GRN_WITH_BLOSC=bundled
    
      73    -D GRN_WITH_MRUBY=ON
    
      74  )
    
      75  cmake "${cmake_options[@]}"
    
      76  cmake --build build
    
      77}
    
      78
    
      79check() {
    
      80  cd build
    
      81  export GEM_HOME="${PWD}/gem"
    
      82  PATH="${GEM_HOME}/bin:${PATH}"
    
      83  MAKEFLAGS="-j$(nproc)" gem install --no-user-install grntest
    
      84  BUILD_DIR="${PWD}/test/command" \
    
      85    "../${pkgname}-${pkgver}/test/command/run-test.sh" \
    
      86    --n-retries=2 \
    
      87    --read-timeout=30 \
    
      88    --reporter=mark
    
      89}
    
      90
    
      91package() {
    
      92  DESTDIR="${pkgdir}" cmake --install build
    
      93}
    
      94

Changes since previous scan

--- PKGBUILD @ 2026-10-27 00:23
+++ PKGBUILD @ 2026-11-01 00:21
@@ -2,7 +2,7 @@
 
 pkgname=groonga
 pkgdesc="An open-source fulltext search engine and column store."
-pkgver=16.0.4
+pkgver=16.1.4
 pkgrel=1
 arch=('i686' 'x86_64')
 url="https://groonga.org/"
@@ -43,7 +43,7 @@
   "https://github.com/groonga/groonga/releases/download/v${pkgver}/${pkgname}-${pkgver}.tar.gz.asc"
 )
 sha512sums=(
-  "f99af9c3e826f86588f83f117f0af17b25b1fcfab9934b5f4424f4fda70bba180f66afa57377107cc69554a50e6024f13d6bea7c67935175a7770d8744ab2506"
+  "1a95b78aaabc67d4658834219e00dbe86f49cc0473e643f331a5ac6ebb391bf1335e7039e8a8503724e0d48487dce70f16f5420d6c1643e688832485efbb3c9d"
   "SKIP"
 )
 validpgpkeys=(2701F317CFCCCB975CADE9C2624CF77434839225)
@@ -60,7 +60,16 @@
     -D CMAKE_INSTALL_PREFIX=/usr
     -D CMAKE_SKIP_RPATH=ON
     -D GRN_WITH_APACHE_ARROW=ON
-    -D GRN_WITH_BLOSC=system
+    # This is a workaround.
+    # Currently, the system-provided Blosc2 is not used when building Groonga due to the following error.
+    #
+    # CMake Error at /usr/lib/cmake/Blosc2/Blosc2Targets.cmake:108 (message):
+    # The imported target "Blosc2::blosc2_static" references the file
+    # "/usr/lib/libblosc2.a"
+    #
+    # This is an upstream issue.
+    # So, we use bundled Blosc2 until the upstream issue is resolved.
+    -D GRN_WITH_BLOSC=bundled
     -D GRN_WITH_MRUBY=ON
   )
   cmake "${cmake_options[@]}"

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 11:47:37	Medium	1
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2