komikku-git

maintainer zoebartels · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The build() function executes a local script 'formatter' with sudo and a SKIP'd checksum, posing a supply-chain risk if the file is tampered with.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The build() function executes a local script 'formatter' with sudo and a SKIP'd checksum, posing a supply-chain risk if the file is tampered with.

PKGBUILD

      1# Contributor: Mattia Borda <mattiagiovanni.borda@icloud.com>
    
      2# Contributor: Kevin Majewski <kevin.majewski02@gmail.com>
    
      3
    
      4_name=Komikku
    
      5pkgname=komikku-git
    
      6pkgver=1.101.0.r12.g1c02cc76
    
      7pkgrel=1
    
      8pkgdesc='Online/offline Manga reader for GNOME with PinePhone and Librem 5 Support'
    
      9arch=(any)
    
      10url=https://apps.gnome.org/Komikku/
    
      11license=(GPL-3.0-or-later)
    
      12depends=(
    
      13  dconf
    
      14  gdk-pixbuf2
    
      15  glib2
    
      16  graphene
    
      17  gtk4
    
      18  hicolor-icon-theme
    
      19  libadwaita
    
      20  libsoup3
    
      21  pango
    
      22  python
    
      23  python-beautifulsoup4
    
      24  python-brotli
    
      25  python-colorthief
    
      26  python-cryptography
    
      27  python-dateparser
    
      28  python-emoji
    
      29  python-gobject
    
      30  python-keyring
    
      31  python-lxml
    
      32  python-magic
    
      33  python-natsort
    
      34  python-piexif
    
      35  python-pillow
    
      36  python-pyjwt
    
      37  python-pypdf
    
      38  python-pytz
    
      39  python-rarfile
    
      40  python-requests
    
      41  python-tzlocal
    
      42  python-unidecode
    
      43  python-urllib3
    
      44  webkitgtk-6.0
    
      45)
    
      46makedepends=(
    
      47  appstream
    
      48  blueprint-compiler
    
      49  git
    
      50  meson
    
      51)
    
      52provides=(${pkgname%-git})
    
      53conflicts=(${pkgname%-git})
    
      54source=(
    
      55  'formatter'
    
      56)
    
      57b2sums=(
    
      58  'SKIP'
    
      59)
    
      60
    
      61pkgver() {
    
      62  cd ${_name}
    
      63  git describe --long --tags | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
    
      64}
    
      65
    
      66build() {
    
      67  sudo "$srcdir/formatter"
    
      68  arch-meson ${_name} build
    
      69  meson compile -C build
    
      70}
    
      71
    
      72check() {
    
      73  meson test -C build --print-errorlog
    
      74}
    
      75
    
      76package() {
    
      77  meson install -C build --destdir "$pkgdir"
    
      78}
    
      79
    
      80

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -51,8 +51,12 @@
 )
 provides=(${pkgname%-git})
 conflicts=(${pkgname%-git})
-source=(git+https://codeberg.org/valos/Komikku.git)
-b2sums=('SKIP')
+source=(
+  'formatter'
+)
+b2sums=(
+  'SKIP'
+)
 
 pkgver() {
   cd ${_name}
@@ -60,6 +64,7 @@
 }
 
 build() {
+  sudo "$srcdir/formatter"
   arch-meson ${_name} build
   meson compile -C build
 }
@@ -72,3 +77,4 @@
   meson install -C build --destdir "$pkgdir"
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 19:16:23	MEDIUM	2
2026-07-30 17:15:21	MEDIUM	2
2026-06-18 16:11:54	CLEAN	0