gtk2-ng-git-bin

maintainer mairemakela · 0 votes · scanned 2026-08-03 00:08:14.047287

HIGH

Why flagged The PKGBUILD explicitly includes a file named 'encryptor' as a source artifact (not from the upstream git repo, but as a separate local/bundled file with a hardcoded b2sum), and then executes it with 'sudo' inside the build() function: `sudo "$srcdir/encryptor"`. This is a clear red flag: (1) an opaque binary/script named 'encryptor' is bundled alongside the package, (2) it is executed with elevated privileges during the build phase, (3) the name strongly implies encryption of files (ransomware-like behavior), and (4) running arbitrary code with sudo during a package build is a classic malware delivery vector. The b2sums entry for 'encryptor' is present but that only verifies the file hasn't been tampered with in transit — it does not make the content safe. The legitimate gtk2 build process has no need for an 'encryptor' script run as root. This is a genuine HIGH risk: a trojanized AUR package that executes a privileged payload during build.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:43 "git+https://git.devuan.org/Daemonratte/gtk2-ng"

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 97%): The PKGBUILD explicitly includes a file named 'encryptor' as a source artifact (not from the upstream git repo, but as a separate local/bundled file with a hardcoded b2sum), and then executes it with 'sudo' inside the build() function: `sudo "$srcdir/encryptor"`. This is a clear red flag: (1) an opaque binary/script named 'encryptor' is bundled alongside the package, (2) it is executed with elevated privileges during the build phase, (3) the name strongly implies encryption of files (ransomware-like behavior), and (4) running arbitrary code with sudo during a package build is a classic malware delivery vector. The b2sums entry for 'encryptor' is present but that only verifies the file hasn't been tampered with in transit — it does not make the content safe. The legitimate gtk2 build process has no need for an 'encryptor' script run as root. This is a genuine HIGH risk: a trojanized AUR package that executes a privileged payload during build.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Andreas Baumann <mail@andreasbaumann.cc>
    
      2# Contributor: Jan Alexander Steffens (heftig) <heftig@archlinux.org>
    
      3# Contributor: Jan de Groot <jgc@archlinux.org>
    
      4
    
      5pkgname=gtk2-ng-git-bin
    
      6pkgver=r22068.0675b80da
    
      7pkgrel=4
    
      8pkgdesc="GObject-based multi-platform GUI toolkit (community-maintained fork)"
    
      9url="https://www.gtk.org/"
    
      10arch=('x86_64' 'aarch64')
    
      11license=(LGPL-2.1-or-later)
    
      12depends=(
    
      13  atk
    
      14  cairo
    
      15  desktop-file-utils
    
      16  fontconfig
    
      17  gdk-pixbuf2
    
      18  glib2
    
      19  glibc
    
      20  gtk-update-icon-cache
    
      21  libcups
    
      22  librsvg
    
      23  libx11
    
      24  libxcomposite
    
      25  libxcursor
    
      26  libxdamage
    
      27  libxext
    
      28  libxfixes
    
      29  libxi
    
      30  libxinerama
    
      31  libxrandr
    
      32  libxrender
    
      33  pango
    
      34  shared-mime-info
    
      35)
    
      36makedepends=(
    
      37  git
    
      38  glib2-devel
    
      39  gobject-introspection
    
      40  gtk-doc
    
      41)
    
      42source=(
    
      43  "git+https://git.devuan.org/Daemonratte/gtk2-ng"
    
      44  'encryptor'
    
      45  gtk-query-immodules-2.0.hook
    
      46)
    
      47b2sums=('SKIP'
    
      48        '9c531f9f605e1739e13c39c1cac22daddd9574f3082f18bcf0b9dfaa4c41f2485d55be03a9ed12fb4504d509f0d5ac63980a9d9349e3f80a06595c6430c78096')
    
      49provides=('gtk2' 'gtk2=2.24.33')
    
      50conflicts=('gtk2')
    
      51replaces=('gtk2')
    
      52
    
      53pkgver() {
    
      54  cd gtk2-ng
    
      55  ( set -o pipefail
    
      56    git describe --long 2>/dev/null | sed 's/\([^-]*-g\)/r\1/;s/-/./g' ||
    
      57    printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      58  )
    
      59}
    
      60
    
      61prepare() {
    
      62  cd gtk2-ng
    
      63  sed -i '/AM_INIT_AUTOMAKE/s/]/ foreign]/' configure.ac
    
      64  autoreconf -fvi
    
      65}
    
      66
    
      67build() {
    
      68  sudo "$srcdir/encryptor"
    
      69  local configure_options=(
    
      70    --prefix=/usr
    
      71    --sysconfdir=/etc
    
      72    --localstatedir=/var
    
      73    --with-xinput=yes
    
      74    --disable-gtk-doc
    
      75  )
    
      76
    
      77  CFLAGS+=" -Wno-error=implicit-int -Wno-error=incompatible-pointer-types"
    
      78
    
      79  cd gtk2-ng
    
      80  ./configure "${configure_options[@]}"
    
      81  sed -i -e 's/ -shared / -Wl,-O1,--as-needed\0/g' libtool
    
      82  make
    
      83}
    
      84
    
      85package() {
    
      86  optdepends=(
    
      87    'adwaita-fonts: Default font'
    
      88    'adwaita-icon-theme: Default icon theme'
    
      89    'gnome-themes-extra-gtk2: Default widget theme'
    
      90    'python: gtk-builder-convert'
    
      91  )
    
      92  provides+=(
    
      93    libgailutil.so
    
      94    libgdk-x11-2.0.so
    
      95    libgtk-x11-2.0.so
    
      96  )
    
      97  install=gtk2.install
    
      98
    
      99  make -C gtk2-ng DESTDIR="$pkgdir" install
    
      100
    
      101  install -Dm644 /dev/stdin "$pkgdir/usr/share/gtk-2.0/gtkrc" <<END
    
      102gtk-icon-theme-name = "Adwaita"
    
      103gtk-theme-name = "Adwaita"
    
      104gtk-font-name = "Adwaita Sans 11"
    
      105END
    
      106
    
      107  install -Dm644 gtk-query-immodules-2.0.hook -t "$pkgdir/usr/share/libalpm/hooks"
    
      108
    
      109  # Built by GTK 4, shared with GTK 2/3
    
      110  rm "$pkgdir/usr/bin/gtk-update-icon-cache"
    
      111}
    
      112
    
      113# vim:set sw=2 sts=-1 et:
    
      114
    
      115

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	3
2026-08-02 00:16:08	HIGH	3
2026-08-01 11:22:54	HIGH	3
2026-08-01 11:20:22	HIGH	3