haskell-weeder

maintainer carbolymer · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds a Haskell project from its official GitHub source using cabal; the flagged 'external install' is part of the standard build process for Haskell packages and does not involve untrusted remote code execution or dependencies from untrusted sources.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds a Haskell project from its official GitHub source using cabal; the flagged 'external install' is part of the standard build process for Haskell packages and does not involve untrusted remote code execution or dependencies from untrusted sources.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:30 cabal install exe:weeder --install-method=copy --installdir="${pkgdir}/usr/bin"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Mateusz Galazyn <carbolymer@gmail.com>
    
      2
    
      3_hackage_name=weeder
    
      4pkgname="haskell-${_hackage_name}"
    
      5pkgver=2.10.0
    
      6pkgrel=1
    
      7pkgdesc="Detect dead exports or package imports"
    
      8arch=('x86_64')
    
      9url="https://github.com/ocharles/weeder"
    
      10license=('BSD')
    
      11makedepends=('git' 'cabal-install')
    
      12source=("${url}/archive/refs/tags/${pkgver}.tar.gz")
    
      13sha256sums=('ce2f22b539806b5182a3f03a57bb67d8cf15b964168958f476dba8db3ddfede6')
    
      14
    
      15prepare() {
    
      16    cd "${srcdir}/${_hackage_name}-${pkgver}"
    
      17}
    
      18
    
      19build() {
    
      20    echo -e "###\n###     trying to use $(ghc --version)\n###"
    
      21    cd "${srcdir}/${_hackage_name}-${pkgver}"
    
      22
    
      23    cabal build -O2 -j
    
      24}
    
      25
    
      26package() {
    
      27    cd "${srcdir}/${_hackage_name}-${pkgver}"
    
      28    install -D -m 644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      29
    
      30    cabal install exe:weeder --install-method=copy --installdir="${pkgdir}/usr/bin"
    
      31    # stack --local-bin-path "${pkgdir}/usr/bin/" install
    
      32}
    
      33

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2