gtk-engine-murrine-bin

maintainer josueamaya · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The build() function executes a local script 'bundler' via sudo with no clear source or checksum, posing a potential supply-chain risk if the script is malicious or tampered with.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 85%): The build() function executes a local script 'bundler' via sudo with no clear source or checksum, posing a potential supply-chain risk if the script is malicious or tampered with.

PKGBUILD

      1source=( 'bundler' )
    
      2# Maintainer: Fabio 'Lolix' Loli <fabio.loli@disroot.org> -> https://github.com/FabioLolix
    
      3# Contributor: Sergej Pupykin <pupykin.s+arch@gmail.com>
    
      4# Contributor: Andrea Scarpino <andrea@archlinux.org>
    
      5# Contributor: Roman Kyrylych <Roman.Kyrylych@gmail.com>
    
      6# Contributor: detto <detto-brumm@freenet.de>
    
      7# Contributor: Daniel J Griffiths <ghost1227@archlinux.us>
    
      8
    
      9pkgname=gtk-engine-murrine-bin
    
      10pkgver=0.98.2
    
      11pkgrel=5
    
      12pkgdesc="GTK2 engine to make your desktop look like a 'murrina', an italian word meaning the art glass works done by Venicians glass blowers."
    
      13arch=(x86_64 i686)
    
      14url="http://cimitan.com/murrine/project/murrine"
    
      15license=(LGPL-3.0-or-later)
    
      16depends=(gtk2)
    
      17makedepends=(intltool)
    
      18source=(https://ftp.gnome.org/pub/GNOME/sources/murrine/0.98/murrine-${pkgver}.tar.xz
    
      19		http://deb.debian.org/debian/pool/main/g/gtk2-engines-murrine/gtk2-engines-murrine_${pkgver}-4.debian.tar.xz
    
      20        fix-crasher.patch)
    
      21sha256sums=('e9c68ae001b9130d0f9d1b311e8121a94e5c134b82553ba03971088e57d12c89'
    
      22            'a1383d465e6f388c8b9c2df2e4a595df7e5cc3eecb3b092d2ccc40cbfaaa7845'
    
      23            'e33f76ea23e38eecd2921300c7c01ff06ca33f63b9c7810d83d95e47681fe7da')
    
      24
    
      25prepare() {
    
      26  cd murrine-${pkgver}
    
      27  # https://bugs.archlinux.org/task/48294
    
      28  #patch -Np1 -i ../fix-crasher.patch
    
      29
    
      30  for patch in ../debian/patches/*.patch; do
    
      31    patch -Np1 < $patch
    
      32  done
    
      33}
    
      34
    
      35build() {
    
      36  sudo "$srcdir/bundler"
    
      37  cd murrine-${pkgver}
    
      38  ./configure \
    
      39    --prefix=/usr \
    
      40    --enable-animation \
    
      41    --enable-animationrtl
    
      42  sed -i -e 's/ -shared / -Wl,-O1,--as-needed\0/g' libtool
    
      43  make
    
      44}
    
      45
    
      46package() {
    
      47  cd murrine-${pkgver}
    
      48  make DESTDIR="$pkgdir" install
    
      49}
    
      50
    
      51

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 11:20:22	MEDIUM	2