mikutter

maintainer gomasy · 39 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads the mikutter tarball from hachune.net (the official upstream host for this Japanese Twitter client) and has a pinned sha256sum, so the primary source is reasonably trustworthy. However, the build() function runs 'gem install rake' and 'bundle install' at build time, which fetches Ruby gems from rubygems.org without any pinning or integrity verification of the individual gems. The Gemfile.lock (if present in the tarball) would provide some pinning, but the PKGBUILD also modifies the Gemfile in-place (sed replacing gtk3 gem version) which could bypass lock-file pinning for that gem. This is a genuine supply-chain concern: any gem fetched during bundle install is executed code from an external source not verified by the PKGBUILD's sha256sums. This is a real but common AUR pattern for Ruby applications, and the risk is moderate rather than high — it is not clearly malicious, but it does represent an unverified external code execution path during the build.

Triggered rules

MEDIUM External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:27 gem install --no-document --no-user-install -i $_gemdir rake

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 https://mikutter.hachune.net/bin/$pkgname-$pkgver.tar.gz

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads the mikutter tarball from hachune.net (the official upstream host for this Japanese Twitter client) and has a pinned sha256sum, so the primary source is reasonably trustworthy. However, the build() function runs 'gem install rake' and 'bundle install' at build time, which fetches Ruby gems from rubygems.org without any pinning or integrity verification of the individual gems. The Gemfile.lock (if present in the tarball) would provide some pinning, but the PKGBUILD also modifies the Gemfile in-place (sed replacing gtk3 gem version) which could bypass lock-file pinning for that gem. This is a genuine supply-chain concern: any gem fetched during bundle install is executed code from an external source not verified by the PKGBUILD's sha256sums. This is a real but common AUR pattern for Ruby applications, and the risk is moderate rather than high — it is not clearly malicious, but it does represent an unverified external code execution path during the build.

PKGBUILD:27 gem install --no-document --no-user-install -i $_gemdir rake

PKGBUILD

2 offending line(s) highlighted

      1# vim:set ts=2 sw=2 et:
    
      2# Maintainer: Gomasy <nyan@gomasy.jp>
    
      3# Contributor: 2GMon <t_2gmon@yahoo.co.jp>
    
      4
    
      5pkgname=mikutter
    
      6pkgver=5.1.2
    
      7pkgrel=1
    
      8pkgdesc="a moest twitter client"
    
      9arch=('i686' 'x86_64')
    
      10url="http://mikutter.hachune.net/"
    
      11license=('MIT')
    
      12depends=('gobject-introspection-runtime' 'gtk3' 'ruby-bundler')
    
      13makedepends=('gobject-introspection')
    
      14optdepends=('alsa-utils: sound notification support'
    
      15            'libnotify: notify support')
    
      16source=(
    
      17https://mikutter.hachune.net/bin/$pkgname-$pkgver.tar.gz
    
      18mikutter.desktop
    
      19)
    
      20sha256sums=('ac5d5cc386dd03d544d34a2fd2e5c73e38985eb2fcbe98e7137931de04bb6433'
    
      21            '698cbd105c91296c92003352e2e66015a6db33ead5ae629a5441fdea7e67607f')
    
      22_gemdir="vendor/bundle/ruby/`ruby -e'print Gem.dir.match(/^.+\/(.+?)$/)[1]'`"
    
      23
    
      24build() {
    
      25  cd "$pkgname-$pkgver"
    
      26
    
      27  gem install --no-document --no-user-install -i $_gemdir rake
    
      28  bundle config --local path "vendor/bundle"
    
      29  bundle config --local without "test"
    
      30
    
      31  # Update gtk3 gem to fix build failure with gcc 15
    
      32  sed -i "s/gem 'gtk3', '4.2.1'/gem 'gtk3', '4.3.6'/" plugin/gtk3/Gemfile
    
      33
    
      34  bundle install
    
      35
    
      36  rm -rf $_gemdir/{build_info,cache,doc}
    
      37}
    
      38
    
      39package() {
    
      40  mkdir "$pkgdir/opt"
    
      41  cp -r "$srcdir/$pkgname-$pkgver" "$pkgdir/opt/$pkgname"
    
      42
    
      43  mkdir -p "$pkgdir/usr/bin"
    
      44  cat <<'EOF' > "$pkgdir/usr/bin/mikutter"
    
      45#!/bin/sh
    
      46BUNDLE_GEMFILE=/opt/mikutter/Gemfile bundle exec ruby /opt/mikutter/mikutter.rb $@
    
      47EOF
    
      48  chmod a+x "$pkgdir/usr/bin/mikutter"
    
      49
    
      50  mkdir -p $pkgdir/usr/share/applications
    
      51  cp "$srcdir/mikutter.desktop" "$pkgdir/usr/share/applications"
    
      52  chmod +x $pkgdir/usr/share/applications/mikutter.desktop
    
      53}
    
      54

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 00:29:32	MEDIUM	3
2026-07-21 00:24:15	MEDIUM	3
2026-07-20 00:19:49	MEDIUM	3
2026-07-19 00:17:08	MEDIUM	3
2026-07-18 00:14:48	MEDIUM	3
2026-07-17 00:06:16	MEDIUM	3
2026-07-16 00:05:41	MEDIUM	3
2026-07-15 00:09:25	MEDIUM	3