mingw-w64-vtk

maintainer xantares · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD fetches four patches at build time via curl from gitlab.kitware.com (the official Kitware GitLab, which hosts the upstream VTK project) and pipes them directly into patch without any integrity verification. While gitlab.kitware.com is the legitimate upstream host for VTK, these MR patches are not listed in source=() and have no checksums, meaning: (1) they cannot be verified by makepkg's integrity checks, (2) the content can change at any time (MRs can be force-pushed or the patch endpoint can serve different content), and (3) there is no reproducibility guarantee. This is a real supply-chain concern — unverified, mutable code is fetched and applied to the source tree before compilation. The main source tarball is from the official vtk.org release host (clean), and MR13293.patch is included in source=() with SKIP (sloppy but at least declared). The four curl-piped patches represent a genuine medium-severity supply-chain risk: if Kitware's GitLab were compromised or the MR content changed, arbitrary code would be compiled and installed without any warning to the user.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:18 curl -L https://gitlab.kitware.com/vtk/vtk/-/merge_requests/12856.patch | patch -p1
PKGBUILD:19 curl -L https://gitlab.kitware.com/vtk/vtk/-/merge_requests/12937.patch | patch -p1
PKGBUILD:20 curl -L https://gitlab.kitware.com/vtk/vtk/-/merge_requests/12939.patch | patch -p1
PKGBUILD:21 curl -L https://gitlab.kitware.com/vtk/vtk/-/merge_requests/12940.patch | patch -p1

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:11 source=("https://www.vtk.org/files/release/${pkgver:0:3}/VTK-${pkgver}.tar.gz" MR13293.patch)

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD fetches four patches at build time via curl from gitlab.kitware.com (the official Kitware GitLab, which hosts the upstream VTK project) and pipes them directly into patch without any integrity verification. While gitlab.kitware.com is the legitimate upstream host for VTK, these MR patches are not listed in source=() and have no checksums, meaning: (1) they cannot be verified by makepkg's integrity checks, (2) the content can change at any time (MRs can be force-pushed or the patch endpoint can serve different content), and (3) there is no reproducibility guarantee. This is a real supply-chain concern — unverified, mutable code is fetched and applied to the source tree before compilation. The main source tarball is from the official vtk.org release host (clean), and MR13293.patch is included in source=() with SKIP (sloppy but at least declared). The four curl-piped patches represent a genuine medium-severity supply-chain risk: if Kitware's GitLab were compromised or the MR content changed, arbitrary code would be compiled and installed without any warning to the user.

PKGBUILD

5 offending line(s) highlighted

      1pkgname=mingw-w64-vtk
    
      2pkgver=9.6.2
    
      3pkgrel=1
    
      4pkgdesc='Software system for 3D computer graphics, image processing, and visualization (mingw-w64)'
    
      5arch=('any')
    
      6url='https://www.vtk.org/'
    
      7license=('BSD')
    
      8depends=('mingw-w64-crt' 'mingw-w64-qt5-base' 'mingw-w64-jsoncpp' 'mingw-w64-expat' 'mingw-w64-netcdf' 'mingw-w64-libtiff' 'mingw-w64-libjpeg-turbo' 'mingw-w64-freetype2' 'mingw-w64-libpng' 'mingw-w64-libxml2' 'mingw-w64-hdf5' 'mingw-w64-freeglut' 'mingw-w64-lz4' 'mingw-w64-proj' 'mingw-w64-double-conversion' 'mingw-w64-pugixml' 'mingw-w64-libtheora' 'mingw-w64-gl2ps' 'mingw-w64-cgns' 'mingw-w64-libharu' 'mingw-w64-verdict' 'mingw-w64-scnlib')
    
      9makedepends=('mingw-w64-cmake' 'mingw-w64-wine')
    
      10options=('!buildflags' 'staticlibs' '!strip')
    
      11source=("https://www.vtk.org/files/release/${pkgver:0:3}/VTK-${pkgver}.tar.gz" MR13293.patch)
    
      12sha256sums=('aed12cec12a9609179bf66329070266627ca64244a10856a452b2a17ffb04a1d' SKIP)
    
      13
    
      14_architectures="x86_64-w64-mingw32"
    
      15
    
      16prepare() {
    
      17  cd "${srcdir}/VTK-${pkgver}"
    
      18  curl -L https://gitlab.kitware.com/vtk/vtk/-/merge_requests/12856.patch | patch -p1
    
      19  curl -L https://gitlab.kitware.com/vtk/vtk/-/merge_requests/12937.patch | patch -p1
    
      20  curl -L https://gitlab.kitware.com/vtk/vtk/-/merge_requests/12939.patch | patch -p1
    
      21  curl -L https://gitlab.kitware.com/vtk/vtk/-/merge_requests/12940.patch | patch -p1
    
      22
    
      23  # gcc16: vtkNativePartitioningStrategy.cxx:(.text+0x6865): undefined reference to `vtkAOSDataArrayTemplate<long long>::IsTypeOf(char const*)'
    
      24  patch -p1 -i "${srcdir}"/MR13293.patch
    
      25}
    
      26
    
      27build() {
    
      28  cd "${srcdir}/VTK-${pkgver}"
    
      29  for _arch in ${_architectures}; do
    
      30    ${_arch}-cmake \
    
      31      -DCMAKE_BUILD_TYPE=Release \
    
      32      -DVTK_USE_EXTERNAL=ON \
    
      33      -DVTK_BUILD_TESTING=OFF \
    
      34      -DVTK_QT_VERSION=5 \
    
      35      -DVTK_MODULE_USE_EXTERNAL_VTK_cli11=OFF \
    
      36      -DVTK_MODULE_USE_EXTERNAL_VTK_ioss=OFF \
    
      37      -DVTK_MODULE_USE_EXTERNAL_VTK_eigen=OFF \
    
      38      -DVTK_MODULE_USE_EXTERNAL_VTK_exprtk=OFF \
    
      39      -DVTK_MODULE_USE_EXTERNAL_VTK_fmt=OFF \
    
      40      -DVTK_MODULE_USE_EXTERNAL_VTK_fast_float=OFF \
    
      41      -DVTK_MODULE_USE_EXTERNAL_VTK_nlohmannjson=OFF \
    
      42      -DVTK_MODULE_USE_EXTERNAL_VTK_pegtl=OFF \
    
      43      -DVTK_MODULE_USE_EXTERNAL_VTK_token=OFF \
    
      44      -DVTK_MODULE_USE_EXTERNAL_VTK_utf8=OFF \
    
      45      -DVTK_MODULE_ENABLE_VTK_GUISupportQt=YES \
    
      46      -DVTK_MODULE_ENABLE_VTK_cli11=YES \
    
      47      -DVTK_MODULE_ENABLE_VTK_FiltersParallelStatistics=YES \
    
      48      -DVTK_MODULE_ENABLE_VTK_FiltersParallelVerdict=YES \
    
      49      -DVTK_MODULE_ENABLE_VTK_FiltersParallelDIY2=YES \
    
      50      -DVTK_MODULE_ENABLE_VTK_IOAvmesh=YES \
    
      51      -DVTK_MODULE_ENABLE_VTK_IOH5part=YES \
    
      52      -DVTK_MODULE_ENABLE_VTK_IOH5Rage=YES \
    
      53      -DVTK_MODULE_ENABLE_VTK_IOOMF=YES \
    
      54      -DVTK_MODULE_ENABLE_VTK_IOParallelExodus=YES \
    
      55      -DVTK_MODULE_ENABLE_VTK_IOParallelLSDyna=YES \
    
      56      -DVTK_MODULE_ENABLE_VTK_IOPIO=YES \
    
      57      -DVTK_MODULE_ENABLE_VTK_IOTRUCHAS=YES \
    
      58      -DVTK_MODULE_ENABLE_VTK_IOVPIC=YES \
    
      59      -DVTK_MODULE_ENABLE_VTK_IOXdmf2=YES \
    
      60      -DVTK_MODULE_ENABLE_VTK_RenderingParallel=YES \
    
      61      -DVTK_MODULE_ENABLE_VTK_RenderingVolumeAMR=YES \
    
      62      -B build-${_arch} .
    
      63    make -C build-${_arch}
    
      64  done
    
      65}
    
      66
    
      67package() {
    
      68  for _arch in ${_architectures}; do
    
      69    cd "$srcdir/VTK-${pkgver}/build-${_arch}"
    
      70    make install/fast DESTDIR="$pkgdir"
    
      71    rm -r "$pkgdir"/usr/${_arch}/share
    
      72    ${_arch}-strip --strip-unneeded "$pkgdir"/usr/${_arch}/bin/*.dll
    
      73    ${_arch}-strip -g "$pkgdir"/usr/${_arch}/lib/*.a
    
      74  done
    
      75}
    
      76

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 00:29:32	MEDIUM	3
2026-07-21 00:24:15	MEDIUM	3
2026-07-20 00:19:49	MEDIUM	3
2026-07-19 00:17:08	MEDIUM	3
2026-07-18 00:14:48	MEDIUM	3
2026-07-17 00:06:16	MEDIUM	3
2026-07-16 00:05:41	MEDIUM	3
2026-07-15 00:09:25	MEDIUM	3