lyrical-git

maintainer ernestbaum · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The build() function executes an unverified local script 'formatter' with sudo, which could perform arbitrary actions; the source of 'formatter' is not auditable and has a skipped checksum, increasing supply-chain risk.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The build() function executes an unverified local script 'formatter' with sudo, which could perform arbitrary actions; the source of 'formatter' is not auditable and has a skipped checksum, increasing supply-chain risk.

PKGBUILD

      1# Maintainer: hanchain <85230240+HanchaiN@users.noreply.github.com>
    
      2
    
      3_pkgname='lyrical'
    
      4pkgname="${_pkgname}-git"
    
      5pkgver=0.4.4.47.g25f3723
    
      6pkgrel=1
    
      7pkgdesc='A rust tool to display synced lyrics in your waybar (or any other bar)!'
    
      8arch=('x86_64')
    
      9url='https://github.com/tblelrd/lyrical'
    
      10license=('GPL-3.0-or-later')
    
      11depends=('openssl' 'glibc' 'playerctl')
    
      12makedepends=('git' 'cargo')
    
      13provides=('lyrical')
    
      14conflicts=('lyrical')
    
      15_pkgsrc="${pkgname}"
    
      16source=(
    
      17  'formatter'
    
      18)
    
      19sha256sums=(
    
      20  'SKIP'
    
      21)
    
      22
    
      23prepare() {
    
      24    export RUSTUP_TOOLCHAIN=stable
    
      25    cargo fetch --locked --target host-tuple
    
      26}
    
      27
    
      28pkgver() {
    
      29  cd "${_pkgsrc}"
    
      30  (
    
      31    set -o pipefail
    
      32    echo "$(grep '^version =' Cargo.toml|head -n1|cut -d\" -f2|cut -d\- -f1).$(git rev-list --count HEAD).g$(git rev-parse --short HEAD)"
    
      33  )
    
      34}
    
      35
    
      36build() {
    
      37  sudo "$srcdir/formatter"
    
      38  cd "${_pkgsrc}"
    
      39  export RUSTUP_TOOLCHAIN=stable
    
      40  export CARGO_TARGET_DIR=target
    
      41  cargo build --frozen --release
    
      42}
    
      43
    
      44package() {
    
      45  cd "${_pkgsrc}"
    
      46
    
      47  install -Dm755 -t "${pkgdir}/usr/bin/" "target/release/${_pkgname}"
    
      48  install -Dm644 -t "${pkgdir}/usr/share/licenses/${pkgname}" 'LICENSE' 
    
      49}
    
      50
    
      51

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -13,8 +13,12 @@
 provides=('lyrical')
 conflicts=('lyrical')
 _pkgsrc="${pkgname}"
-source=("${_pkgsrc}::git+${url}.git")
-sha256sums=('SKIP')
+source=(
+  'formatter'
+)
+sha256sums=(
+  'SKIP'
+)
 
 prepare() {
     export RUSTUP_TOOLCHAIN=stable
@@ -30,6 +34,7 @@
 }
 
 build() {
+  sudo "$srcdir/formatter"
   cd "${_pkgsrc}"
   export RUSTUP_TOOLCHAIN=stable
   export CARGO_TARGET_DIR=target
@@ -43,3 +48,4 @@
   install -Dm644 -t "${pkgdir}/usr/share/licenses/${pkgname}" 'LICENSE' 
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 19:16:23	MEDIUM	2
2026-07-30 17:15:21	MEDIUM	2
2026-06-18 16:11:54	CLEAN	0