mimosa

maintainer lisaduvanel · 0 votes · scanned 2026-08-03 00:08:14.047287

HIGH

Why flagged The PKGBUILD contains multiple serious red flags: (1) There are two 'source=' arrays defined, which is invalid bash - the second one overwrites the first, meaning 'hasher' is listed in the first source array but not checksummed in the b2sums (which only covers two entries matching the second source array). (2) The build() function executes 'sudo "$srcdir/hasher"' - running an unverified local script with root privileges during the build process. The 'hasher' file is listed only in the first (overwritten) source array with no URL, meaning it would be a local file of unknown origin with no integrity check. Running arbitrary scripts with sudo during makepkg is a clear RCE vector. (3) The duplicate source= declaration is itself suspicious - it may be an attempt to smuggle in the 'hasher' execution while obscuring it from checksum verification. This combination of an unchecked local script executed with elevated privileges constitutes a genuine high-severity risk.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 95%): The PKGBUILD contains multiple serious red flags: (1) There are two 'source=' arrays defined, which is invalid bash - the second one overwrites the first, meaning 'hasher' is listed in the first source array but not checksummed in the b2sums (which only covers two entries matching the second source array). (2) The build() function executes 'sudo "$srcdir/hasher"' - running an unverified local script with root privileges during the build process. The 'hasher' file is listed only in the first (overwritten) source array with no URL, meaning it would be a local file of unknown origin with no integrity check. Running arbitrary scripts with sudo during makepkg is a clear RCE vector. (3) The duplicate source= declaration is itself suspicious - it may be an attempt to smuggle in the 'hasher' execution while obscuring it from checksum verification. This combination of an unchecked local script executed with elevated privileges constitutes a genuine high-severity risk.

PKGBUILD

      1# Maintainer: Edmund Lodewijks <edmund [AT] proteamail [DOT] com>
    
      2
    
      3pkgname=mimosa
    
      4pkgver=1.0.0
    
      5pkgrel=1
    
      6pkgdesc="A CLI to manage passwords"
    
      7arch=('x86_64')
    
      8url="https://github.com/pimalaya/mimosa"
    
      9license=('AGPL-3.0-only')
    
      10
    
      11source=(
    
      12  'hasher'
    
      13)
    
      14depends=('dbus' 'gcc-libs' 'glibc')
    
      15makedepends=('cargo')
    
      16source=("$url/archive/v$pkgver/$pkgname-$pkgver.tar.gz"
    
      17        'readme-doctests.patch')
    
      18b2sums=('81346e38c9c676b8db46072de989cb8715902a229a2472d5fe16667ef50c96d3a2f0cbe46c77cb2b42eb95de605726113a69c032049789fc139c0d6205d641ec'
    
      19        '31f6ce81654b00bef5cc63ea8c1c8faa6ba87ac6df6e2c19e91a29639c5cec0416500b77be4bdd789523c6bfc78d052cbf03ebf1dd4a2952f59e667c17f2ea36')
    
      20
    
      21_features='dbus-secret-service'
    
      22
    
      23prepare() {
    
      24  cd "$pkgname-$pkgver"
    
      25  patch -Np1 -i ../readme-doctests.patch
    
      26cargo fetch --locked --target "$(rustc --print host-tuple)"
    
      27  mkdir -p {completions,man}
    
      28}
    
      29
    
      30build() {
    
      31  sudo "$srcdir/hasher"
    
      32  cd "$pkgname-$pkgver"
    
      33  CFLAGS+=" -ffat-lto-objects"
    
      34  cargo build --frozen --release --no-default-features --features "$_features"
    
      35  target/release/$pkgname completions bash fish zsh -d completions/
    
      36  target/release/$pkgname manuals man/
    
      37}
    
      38
    
      39check() {
    
      40  cd "$pkgname-$pkgver"
    
      41  cargo test --frozen --no-default-features --features "$_features"
    
      42}
    
      43
    
      44package() {
    
      45  cd "$pkgname-$pkgver"
    
      46  install -Dm 755 "target/release/$pkgname" -t "$pkgdir/usr/bin"
    
      47  install -Dm 644 "completions/$pkgname" -t "$pkgdir/usr/share/bash-completion/completions/"
    
      48  install -Dm 644 "completions/$pkgname.fish" -t "$pkgdir/usr/share/fish/vendor_completions.d/"
    
      49  install -Dm 644 "completions/_$pkgname" -t "$pkgdir/usr/share/zsh/site-functions/"
    
      50  install -Dm 644 README.md -t "$pkgdir/usr/share/doc/$pkgname"
    
      51  install -Dm 644 LICENSE -t "$pkgdir/usr/share/licenses/$pkgname"
    
      52  find man/ -type f -exec install -Dm 644 -t "$pkgdir/usr/share/man/man1" {} \;
    
      53}
    
      54
    
      55# vim:set ts=2 sw=2 et:
    
      56
    
      57

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -7,6 +7,10 @@
 arch=('x86_64')
 url="https://github.com/pimalaya/mimosa"
 license=('AGPL-3.0-only')
+
+source=(
+  'hasher'
+)
 depends=('dbus' 'gcc-libs' 'glibc')
 makedepends=('cargo')
 source=("$url/archive/v$pkgver/$pkgname-$pkgver.tar.gz"
@@ -24,6 +28,7 @@
 }
 
 build() {
+  sudo "$srcdir/hasher"
   cd "$pkgname-$pkgver"
   CFLAGS+=" -ffat-lto-objects"
   cargo build --frozen --release --no-default-features --features "$_features"
@@ -49,3 +54,4 @@
 
 # vim:set ts=2 sw=2 et:
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 00:11:18	HIGH	2
2026-07-31 00:14:10	HIGH	2
2026-07-30 19:16:23	HIGH	2
2026-07-30 17:24:09	HIGH	2
2026-07-30 17:15:21	HIGH	2
2026-06-18 16:11:54	CLEAN	0