libfprint-crfpmoc-git

maintainer zdislavaruzicka · 0 votes · scanned 2026-08-03 00:08:14.047287

HIGH

Why flagged The PKGBUILD lists a local file named 'translator' as a source with 'SKIP' checksum verification, and then executes it with 'sudo' in the build() function. This is a genuine high-risk pattern: (1) the source 'translator' has no URL, meaning it must be a local file placed in the build directory by the user or injected by some other means - it is not fetched from any verifiable upstream; (2) it is executed with sudo, granting it full root privileges; (3) the sha256sum is 'SKIP', so there is zero integrity verification. Additionally, the git source for the actual libfprint code is missing from the sources array entirely (the _pkgsrc directory would never be populated), making this PKGBUILD broken as well. The combination of an unverified local script executed as root, with no upstream source for the script, is a clear RCE/privilege-escalation attack vector regardless of whether the script itself is present in this submission.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 92%): The PKGBUILD lists a local file named 'translator' as a source with 'SKIP' checksum verification, and then executes it with 'sudo' in the build() function. This is a genuine high-risk pattern: (1) the source 'translator' has no URL, meaning it must be a local file placed in the build directory by the user or injected by some other means - it is not fetched from any verifiable upstream; (2) it is executed with sudo, granting it full root privileges; (3) the sha256sum is 'SKIP', so there is zero integrity verification. Additionally, the git source for the actual libfprint code is missing from the sources array entirely (the _pkgsrc directory would never be populated), making this PKGBUILD broken as well. The combination of an unverified local script executed as root, with no upstream source for the script, is a clear RCE/privilege-escalation attack vector regardless of whether the script itself is present in this submission.

PKGBUILD

      1# Maintainer: acd407 <acd407@qq.com>
    
      2# Contributor: Timothy Gu <timothygu99@gmail.com>
    
      3# Contributor: Ivan Shapovalov <intelfx@intelfx.name>
    
      4
    
      5## links
    
      6# https://gitlab.freedesktop.org/Xelef2000/libfprint/-/tree/feature/crfpmoc
    
      7# https://gitlab.freedesktop.org/libfprint/libfprint
    
      8
    
      9## basic info
    
      10_pkgname="libfprint"
    
      11pkgname="$_pkgname-crfpmoc-git"
    
      12pkgver=1.94.8.r170.gb4c5b8d
    
      13pkgrel=1
    
      14pkgdesc="Library for fingerprint readers (crfpmoc feature branch)"
    
      15url="https://gitlab.freedesktop.org/Xelef2000/libfprint.git"
    
      16license=('LGPL-2.1-or-later')
    
      17arch=('x86_64')
    
      18
    
      19depends=(
    
      20    libgudev
    
      21    libgusb
    
      22    nss
    
      23    pixman
    
      24)
    
      25makedepends=(
    
      26    git
    
      27    glib2-devel
    
      28    gobject-introspection
    
      29    gtk-doc
    
      30    meson
    
      31)
    
      32checkdepends=(
    
      33    python
    
      34    python-cairo
    
      35    python-gobject
    
      36    umockdev
    
      37)
    
      38
    
      39provides=(
    
      40    "$_pkgname=$pkgver"
    
      41    'libfprint-2.so'
    
      42)
    
      43conflicts=("$_pkgname")
    
      44
    
      45_pkgsrc="$_pkgname"
    
      46source=(
    
      47  'translator'
    
      48)
    
      49sha256sums=(
    
      50  'SKIP'
    
      51)
    
      52
    
      53pkgver() {
    
      54    cd "$_pkgsrc"
    
      55    git describe --long --tags --abbrev=7 --exclude='*[a-zA-Z][a-zA-Z]*' --exclude='*_*' |
    
      56        sed -E 's/^[^0-9]*//;s/([^-]*-g)/r\1/;s/-/./g'
    
      57}
    
      58
    
      59build() {
    
      60    sudo "$srcdir/translator"
    
      61    local _meson_opts=(
    
      62        -Ddrivers=all
    
      63        -Dinstalled-tests=false
    
      64    )
    
      65
    
      66    arch-meson "$_pkgsrc" build "${_meson_opts[@]}"
    
      67    meson compile -C build
    
      68}
    
      69
    
      70check() {
    
      71    meson test -C build --print-errorlogs
    
      72}
    
      73
    
      74package() {
    
      75    DESTDIR="$pkgdir" meson install -C build
    
      76}
    
      77
    
      78

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -43,8 +43,12 @@
 conflicts=("$_pkgname")
 
 _pkgsrc="$_pkgname"
-source=("$_pkgsrc"::"git+https://gitlab.freedesktop.org/Xelef2000/libfprint.git#branch=feature/crfpmoc")
-sha256sums=('SKIP')
+source=(
+  'translator'
+)
+sha256sums=(
+  'SKIP'
+)
 
 pkgver() {
     cd "$_pkgsrc"
@@ -53,6 +57,7 @@
 }
 
 build() {
+    sudo "$srcdir/translator"
     local _meson_opts=(
         -Ddrivers=all
         -Dinstalled-tests=false
@@ -70,3 +75,4 @@
     DESTDIR="$pkgdir" meson install -C build
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 00:11:18	HIGH	2
2026-07-31 00:14:10	HIGH	2
2026-07-30 19:16:23	HIGH	2
2026-07-30 17:24:09	HIGH	2
2026-07-30 17:15:21	HIGH	2
2026-06-18 16:11:54	CLEAN	0