korai-git

maintainer orphaned · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD runs 'pip install --upgrade mangadex-downloader' during the package() function, which installs a PyPI package into the system (not into the package directory) without any version pinning or integrity verification. This is a genuine supply-chain concern: the package installed is fetched from PyPI at build/install time with no checksum, no version lock, and --upgrade means it always pulls the latest version. Additionally, it installs system-wide via pip rather than into pkgdir, meaning it bypasses pacman's package management entirely. The cheaper model's MEDIUM rating is correct here — this is a real supply-chain risk from an unverified, unpinned external code source that gets executed on the user's system, not merely data. The rest of the PKGBUILD (building from the maintainer's own GitHub repo via meson) is straightforward.

Triggered rules

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:38 pip install --upgrade mangadex-downloader

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD runs 'pip install --upgrade mangadex-downloader' during the package() function, which installs a PyPI package into the system (not into the package directory) without any version pinning or integrity verification. This is a genuine supply-chain concern: the package installed is fetched from PyPI at build/install time with no checksum, no version lock, and --upgrade means it always pulls the latest version. Additionally, it installs system-wide via pip rather than into pkgdir, meaning it bypasses pacman's package management entirely. The cheaper model's MEDIUM rating is correct here — this is a real supply-chain risk from an unverified, unpinned external code source that gets executed on the user's system, not merely data. The rest of the PKGBUILD (building from the maintainer's own GitHub repo via meson) is straightforward.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: DisableGraphics elchifladod@gmail.com
    
      2pkgbase="korai-git"
    
      3pkgname="korai-git"
    
      4pkgrel=1
    
      5pkgver=$(git ls-remote https://github.com/DisableGraphics/Korai.git | grep refs/heads/main | cut -f 1)
    
      6pkgdesc="Fast, reliable and feature-packed manga and comics reader (fresh from the git master branch)"
    
      7arch=("any")
    
      8conflicts=("korai")
    
      9url='https://github.com/DisableGraphics/Korai'
    
      10makedepends=("git" "imagemagick")
    
      11depends=("libarchive" "gtkmm3" "webkit2gtk" "vte3" "mangodl")
    
      12license=("GPL")
    
      13source=("git+https://github.com/DisableGraphics/Korai")
    
      14md5sums=("SKIP")
    
      15prepare()
    
      16{
    
      17	cd ${srcdir}
    
      18	# Since the git repo would be downloaded as "Korai" instead of "Korai-git",
    
      19	# we need to rename it to "Korai-git" so that the build() function can find it.
    
      20	if [ ! -d ${srcdir}/${pkgname^} ]; then
    
      21		ln -s Korai ${pkgname^}
    
      22	fi
    
      23}
    
      24build() {
    
      25	
    
      26	cd ${srcdir}/${pkgname^}
    
      27	meson setup build
    
      28	meson compile -C build
    
      29}
    
      30package() {
    
      31
    
      32	install -Dm755 ${pkgname^}/build/korai "${pkgdir}/usr/bin/korai"
    
      33	install -Dm755 ${pkgname^}/build/libsavepos.so "${pkgdir}/usr/share/korai/korai-extensions/savepos.so"
    
      34
    
      35	install -Dm755 ${pkgname^}/src/icon.png "${pkgdir}/usr/share/icons/korai.png"
    
      36
    
      37	install -Dm755 ${pkgname^}/src/korai.desktop "${pkgdir}/usr/share/applications/korai.desktop"
    
      38	pip install --upgrade mangadex-downloader
    
      39	echo "Korai requires mangadex-downloader (only available using pip) to download MangaDex manga directly" 
    
      40}
    
      41
    
      42

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2