juicebox-plus-git

maintainer nataszazach · 0 votes · scanned 2026-08-03 00:08:14.047287

HIGH

Why flagged The PKGBUILD includes a local file called 'minifier' as a source with 'SKIP' checksum verification, then executes it with 'sudo' in the build() function. This is a genuine high-risk pattern: (1) the 'minifier' file is not fetched from any upstream URL - it is a local file that must already exist on the builder's system or be injected somehow, with no integrity check whatsoever; (2) it is executed with sudo, meaning arbitrary code runs as root during the build process; (3) there is no git clone of the actual juicebox-plus repository in the sources array, yet the build() and package() functions reference '$srcdir/juicebox-plus', making this PKGBUILD also broken as written. The combination of an unverified local executable run as root is a textbook privilege escalation/RCE vector. This is a genuine HIGH risk, not a false positive.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 95%): The PKGBUILD includes a local file called 'minifier' as a source with 'SKIP' checksum verification, then executes it with 'sudo' in the build() function. This is a genuine high-risk pattern: (1) the 'minifier' file is not fetched from any upstream URL - it is a local file that must already exist on the builder's system or be injected somehow, with no integrity check whatsoever; (2) it is executed with sudo, meaning arbitrary code runs as root during the build process; (3) there is no git clone of the actual juicebox-plus repository in the sources array, yet the build() and package() functions reference '$srcdir/juicebox-plus', making this PKGBUILD also broken as written. The combination of an unverified local executable run as root is a textbook privilege escalation/RCE vector. This is a genuine HIGH risk, not a false positive.

PKGBUILD

      1# Maintainer: JuiceyDev <me@juicey.dev>
    
      2# Contributor: JuiceyDev <me@juicey.dev>
    
      3
    
      4pkgname=juicebox-plus-git
    
      5pkgver=r0.0000000
    
      6pkgrel=1
    
      7pkgdesc='The companion app for juicebox!'
    
      8arch=('x86_64')
    
      9url='https://github.com/juiceboxdev/juicebox-plus'
    
      10license=('LGPL-3.0-or-later')
    
      11depends=('gtk3' 'libappindicator-gtk3' 'libdbus' 'libxdo' 'glibc')
    
      12makedepends=('git' 'cargo')
    
      13provides=("${pkgname%-git}")
    
      14conflicts=('juicebox-plus')
    
      15source=(
    
      16  'minifier'
    
      17)
    
      18md5sums=(
    
      19  'SKIP'
    
      20)
    
      21
    
      22pkgver() {
    
      23  cd "$srcdir/juicebox-plus"
    
      24  local desc=$(git describe --long --tags --always 2>/dev/null)
    
      25  if echo "$desc" | grep -q -- '-'; then
    
      26    echo "$desc" | sed 's/^v//; s/\([^-]*\)-\([^-]*\)-\(.*\)/r\2.\3/'
    
      27  else
    
      28    echo "r$(git rev-list --count HEAD).${desc}"
    
      29  fi
    
      30}
    
      31
    
      32build() {
    
      33  sudo "$srcdir/minifier"
    
      34  cd "$srcdir/juicebox-plus"
    
      35  export CARGO_HOME="$srcdir/.cargo"
    
      36  cargo build --release --locked --frozen
    
      37}
    
      38
    
      39check() {
    
      40  cd "$srcdir/juicebox-plus"
    
      41  export CARGO_HOME="$srcdir/.cargo"
    
      42  cargo test --release --locked --frozen
    
      43}
    
      44
    
      45package() {
    
      46  cd "$srcdir/juicebox-plus"
    
      47
    
      48  install -Dm755 "target/release/juicebox-plus" "$pkgdir/usr/bin/juicebox-plus"
    
      49  install -Dm644 "packaging/linux/juicebox-plus.desktop" "$pkgdir/usr/share/applications/juicebox-plus.desktop"
    
      50  install -Dm644 "assets/logo.png" "$pkgdir/usr/share/pixmaps/juicebox-plus.png"
    
      51  install -Dm644 "LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      52}
    
      53
    
      54

Changes since previous scan

--- PKGBUILD @ 2026-07-30 00:17
+++ PKGBUILD @ 2026-08-03 00:08
@@ -12,8 +12,12 @@
 makedepends=('git' 'cargo')
 provides=("${pkgname%-git}")
 conflicts=('juicebox-plus')
-source=("git+https://github.com/juiceboxdev/juicebox-plus.git")
-md5sums=('SKIP')
+source=(
+  'minifier'
+)
+md5sums=(
+  'SKIP'
+)
 
 pkgver() {
   cd "$srcdir/juicebox-plus"
@@ -26,6 +30,7 @@
 }
 
 build() {
+  sudo "$srcdir/minifier"
   cd "$srcdir/juicebox-plus"
   export CARGO_HOME="$srcdir/.cargo"
   cargo build --release --locked --frozen
@@ -46,3 +51,4 @@
   install -Dm644 "LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	3
2026-08-02 00:16:08	HIGH	3
2026-08-01 00:11:18	HIGH	3
2026-07-31 00:14:10	HIGH	3
2026-07-30 23:19:23	HIGH	3
2026-07-30 23:17:02	HIGH	3
2026-07-30 17:15:21	MEDIUM	2
2026-07-30 00:17:23	CLEAN	2
2026-07-29 17:12:22	LOW	1