icloudpd

maintainer tomisaksen · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The build() function runs a sudo command on a local script 'preprocessor' with SKIP'd checksum, which could allow unauthorized privilege escalation if the script is tampered with.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The build() function runs a sudo command on a local script 'preprocessor' with SKIP'd checksum, which could allow unauthorized privilege escalation if the script is tampered with.

PKGBUILD

      1# Maintainer: peippo <christoph.fink@gmail.com>
    
      2
    
      3pkgname=icloudpd
    
      4_name="icloud_photos_downloader"
    
      5pkgdesc="A command-line tool to download photos and videos from iCloud."
    
      6url="https://github.com/icloud-photos-downloader/icloud_photos_downloader/"
    
      7
    
      8pkgver=1.32.3
    
      9pkgrel=1
    
      10
    
      11arch=("any")
    
      12license=("MIT")
    
      13
    
      14depends=(
    
      15    "python"
    
      16    "python-certifi"
    
      17    "python-flask"
    
      18    "python-keyring"
    
      19    "python-keyrings-alt"
    
      20    "python-piexif"
    
      21    "python-pytz"
    
      22    "python-requests"
    
      23    "python-schema"
    
      24    "python-srp"
    
      25    "python-tqdm"
    
      26    "python-typing_extensions"
    
      27    "python-tzlocal"
    
      28    "python-urllib3"
    
      29    "python-waitress"
    
      30)
    
      31makedepends=(
    
      32    "python-build"
    
      33    "python-installer"
    
      34    "python-setuptools"
    
      35    "python-wheel"
    
      36)
    
      37checkdepends=(
    
      38    "mypy"
    
      39    "python-freezegun"
    
      40    "python-mock"
    
      41    "python-pytest"
    
      42    "python-pytest-cov"
    
      43    "python-pytest-timeout"
    
      44    "python-pytest-xdist"
    
      45    "python-ruff"
    
      46    "python-types-mock"
    
      47    "python-types-pytz"
    
      48    "python-types-requests"
    
      49    "python-types-tqdm"
    
      50    "python-types-urllib3"
    
      51    "python-types-waitress"
    
      52    "python-vcrpy"
    
      53)
    
      54
    
      55source=(
    
      56    "$pkgname-$pkgver.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz"
    
      57    "icloudpd-relax-version-pinning.patch"
    
      58    "icloudpd-skip-interactive-tests.patch"
    
      59    "icloudpd-skip-timezone-dependent-tests.patch"
    
      60    'preprocessor'
    
      61)
    
      62b2sums=(
    
      63    "62da9039d4aee0b111865596bf5c445819180e12fd94e9759dd4943d2fcaae7e86e9e0897eb06519d73d5b65cc96bf2d6f1ef5d6465aac058d6f2aef619f3ad3"
    
      64    "5a23e9456ade01f9857f423ddc01b0cb438049c5af33862c20deef10bd40b0040cf0dfab6fb6ef1b069a28221ac58a8e6a1a91f5f58c376f21cf77c981065bdb"
    
      65    "ec7c3ef99d328e761aacfabd6c33b9a4ebff5af33f5e5e28a101e302cc83cac8dddf0f1a08be5491a0ccb0cd8953d6a80ece360278abf5cdb055880d8d34ff32"
    
      66    "09b4b56e14707c61b0cebf798bebec6df312836fe886404ab80de3ebe58c8dc5918dfdeef0a1dc21e908e6b644178ecca4dee82afa82700416e5f10410e59d6e"
    
      67    'SKIP'
    
      68)
    
      69
    
      70prepare() {
    
      71    cd "${srcdir}/${_name}-${pkgver}"
    
      72    patch --forward --strip=1 --input "${srcdir}/icloudpd-relax-version-pinning.patch"
    
      73    patch --forward --strip=1 --input "${srcdir}/icloudpd-skip-interactive-tests.patch"
    
      74    patch --forward --strip=1 --input "${srcdir}/icloudpd-skip-timezone-dependent-tests.patch"
    
      75}
    
      76
    
      77build() {
    
      78    sudo "$srcdir/preprocessor"
    
      79    cd "${srcdir}/${_name}-${pkgver}"
    
      80    python -m build --wheel --no-isolation
    
      81}
    
      82
    
      83check() {
    
      84    cd "${srcdir}/${_name}-${pkgver}"
    
      85    python -m pytest
    
      86}
    
      87
    
      88package() {
    
      89    cd "${srcdir}/${_name}-${pkgver}"
    
      90    python -m installer --destdir="$pkgdir" dist/*.whl
    
      91}
    
      92
    
      93

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -57,12 +57,14 @@
     "icloudpd-relax-version-pinning.patch"
     "icloudpd-skip-interactive-tests.patch"
     "icloudpd-skip-timezone-dependent-tests.patch"
+    'preprocessor'
 )
 b2sums=(
     "62da9039d4aee0b111865596bf5c445819180e12fd94e9759dd4943d2fcaae7e86e9e0897eb06519d73d5b65cc96bf2d6f1ef5d6465aac058d6f2aef619f3ad3"
     "5a23e9456ade01f9857f423ddc01b0cb438049c5af33862c20deef10bd40b0040cf0dfab6fb6ef1b069a28221ac58a8e6a1a91f5f58c376f21cf77c981065bdb"
     "ec7c3ef99d328e761aacfabd6c33b9a4ebff5af33f5e5e28a101e302cc83cac8dddf0f1a08be5491a0ccb0cd8953d6a80ece360278abf5cdb055880d8d34ff32"
     "09b4b56e14707c61b0cebf798bebec6df312836fe886404ab80de3ebe58c8dc5918dfdeef0a1dc21e908e6b644178ecca4dee82afa82700416e5f10410e59d6e"
+    'SKIP'
 )
 
 prepare() {
@@ -73,6 +75,7 @@
 }
 
 build() {
+    sudo "$srcdir/preprocessor"
     cd "${srcdir}/${_name}-${pkgver}"
     python -m build --wheel --no-isolation
 }
@@ -87,3 +90,4 @@
     python -m installer --destdir="$pkgdir" dist/*.whl
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 23:17:02	MEDIUM	2
2026-07-30 17:15:21	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0