opengrep

LOW
maintainer craftingDragon7 3 votes scanned 2026-10-28 00:06:54.512692
View on AUR
Why flagged

The flagged 'external install via pipx/uv/poetry/cargo/go/gem' refers to the use of 'python -m build' and 'python -m installer', which are standard, non-malicious Python packaging tools used to build and install a wheel from the project's own source; this is normal for Python-based packages and does not involve untrusted third-party code execution.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The flagged 'external install via pipx/uv/poetry/cargo/go/gem' refers to the use of 'python -m build' and 'python -m installer', which are standard, non-malicious Python packaging tools used to build and install a wheel from the project's own source; this is normal for Python-based packages and does not involve untrusted third-party code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

  • PKGBUILD:210 opam install --switch="${pkgname}" --fake ocamlbuild

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Julian Houba <info@craftingdragon.ch>
2pkgname=opengrep
3pkgver=1.33.0
4pkgrel=1
5_memprof_limits_commit=c2cced325a93d2271379f0712db85867b29dbee1
6_visitors_commit=e18a7a67150a54a3aef51661e0317cacc313d764
7_semgrep_interfaces_commit=5e705660dc7381d4c4c247fa83c4c5860e61d555
8_semgrep_apex_commit=024974494b1042141388e1efda11cd5dbcc273e3
9_semgrep_bash_commit=aa7d8eec0714a1e1492a1dcbac32c883a58bb6da
10_semgrep_cairo_commit=a8e2d5d5dcf8345735b15268b76b24377103a188
11_semgrep_circom_commit=a6084cd52d1dbae28365635934279c0100e89762
12_semgrep_cpp_commit=eddec4922e67e757c546cdec7e640a6e7b0ecba4
13_opengrep_crystal_commit=f279484792c259278c4e135e8f1048bbcea7c358
14_semgrep_c_sharp_commit=75c7277df0202ad6f8f8db968c38733ecdb9ea4e
15_semgrep_dart_commit=8e04531936bca9f508692e97646019abfd4c2774
16_semgrep_dockerfile_commit=783ee02353d0da80c03e74598394b2fb84745deb
17_semgrep_elixir_commit=dc48d05492c8d2020698f832ec43974bdd9aae15
18_semgrep_go_commit=51ff7be525c452c0201b3969b3117f7bf8e588dc
19_semgrep_hack_commit=d803e5719874de90ba9a0db9c6f7ba08314c50be
20_semgrep_html_commit=0b0f69e7d12ba20625b3af5223aa3ca9767d38bd
21_semgrep_java_commit=8b9830231a447945d7af372d29720496e3058782
22_semgrep_jsonnet_commit=fde344cc44f2787f8afd9b28c4b70f04ced32c41
23_semgrep_julia_commit=885a1421f27e20c36e18eadb18c8f79cb8d54298
24_semgrep_kotlin_commit=a7d508fe9b623fb9d5c9e90b47a1eba704908110
25_semgrep_clojure_commit=754ea8a63c06e16984b9c7b4e2713bc160667c87
26_semgrep_lua_commit=6fe7090fe8c1dd2193211af0443fa902e16bba74
27_semgrep_move_on_aptos_commit=257a384fca87ce6831670b4aac5296a382cf6974
28_semgrep_move_on_sui_commit=4fe01c06c24ada6a9b0a99d49cc488964fa11046
29_semgrep_ocaml_commit=9ba9be79844df3e560da2d2c77e160b3f827a8ce
30_semgrep_php_commit=0b2ef9bc28ae87200af5cd85ff5e53fc5306cbef
31_semgrep_promql_commit=5e9ca596499c5730a0bc687bd806ca28f5a99a46
32_semgrep_proto_commit=9e169500bdfadb93cbf6ec92094581e88b1369a6
33_semgrep_python_commit=0a623865209259662df6606946805756997c0074
34_semgrep_ql_commit=55749f3c2124dfe1661453ab0790042035a16d41
35_semgrep_r_commit=06fa8af03dca9aa293efd603ba107faf7e82a3c3
36_semgrep_ruby_commit=a824639aeb646c03b5bbc74c3fc5844ed691e7b7
37_semgrep_rust_commit=fa0ae954dfd2c62c4aba9781e5f0fcc584c4a248
38_semgrep_solidity_commit=968fd0d7096720e72c9870933ae7afa58221278f
39_semgrep_swift_commit=7214b8436dd77d5dede681b05905009bb14c64a9
40_semgrep_hcl_commit=546b85986d1965450ba942eea71cc80f55ea39ee
41_semgrep_tsx_commit=4293c1bc21f441ccfa3b0fa4306a9978ee9ec0b7
42_semgrep_typescript_commit=08a13a2a846e6d64dc859435be5f0214dff2d72c
43_ocaml_tree_sitter_core_commit=1392efc21e60d5acde72d0d1c6586f5692fedace
44_pcre2_ocaml_commit=b763e279b7aa624c9f1adf0afdd45ee7555e2460
45_testo_commit=634c978b8c03f02f8f172820fed4554aff721313
46_semgrep_rules_commit=16b9e6d45f10649f6a531ec4838ed9924372c3bc
47_opam_switch_stamp=4
48pkgdesc="Lightweight static analysis for many languages. Find bug variants with patterns that look like source code. Fork of semgrep"
49arch=('x86_64' 'aarch64')
50url="https://github.com/opengrep/opengrep"
51license=('LGPL-2.1-only')
52
53depends=(
54 'gmp'
55 'libev'
56 'pcre'
57 'pcre2'
58 'python'
59 'python-attrs'
60 'python-boltons'
61 'python-click-option-group'
62 'python-click'
63 'python-colorama'
64 'python-glom'
65 'python-jsonschema'
66 'python-packaging'
67 'python-peewee'
68 'python-requests'
69 'python-rich'
70 'python-ruamel-yaml'
71 'python-typing_extensions'
72 'python-urllib3'
73 'python-wcmatch'
74 'tree-sitter'
75)
76makedepends=(
77 'dune'
78 'git'
79 'ocaml'
80 'ocamlbuild'
81 'opam'
82 'pkgconf'
83 'python-build'
84 'python-installer'
85 'python-setuptools'
86 'python-wheel'
87 'rsync'
88)
89
90_submodules=(
91 "OSS/cli/src/semgrep/semgrep_interfaces|cli/src/semgrep/semgrep_interfaces|semgrep-interfaces|https://github.com/opengrep/semgrep-interfaces.git|${_semgrep_interfaces_commit}"
92 "languages/apex/tree-sitter/semgrep-apex|languages/apex/tree-sitter/semgrep-apex|semgrep-apex|https://github.com/opengrep/semgrep-apex.git|${_semgrep_apex_commit}"
93 "OSS/languages/bash/tree-sitter/semgrep-bash|languages/bash/tree-sitter/semgrep-bash|semgrep-bash|https://github.com/opengrep/semgrep-bash|${_semgrep_bash_commit}"
94 "OSS/languages/cairo/tree-sitter/semgrep-cairo|languages/cairo/tree-sitter/semgrep-cairo|semgrep-cairo|https://github.com/opengrep/semgrep-cairo|${_semgrep_cairo_commit}"
95 "OSS/languages/circom/tree-sitter/semgrep-circom|languages/circom/tree-sitter/semgrep-circom|semgrep-circom|https://github.com/opengrep/semgrep-circom.git|${_semgrep_circom_commit}"
96 "OSS/languages/cpp/tree-sitter/semgrep-cpp|languages/cpp/tree-sitter/semgrep-cpp|semgrep-cpp|https://github.com/opengrep/semgrep-cpp|${_semgrep_cpp_commit}"
97 "OSS/languages/crystal/tree-sitter/opengrep-crystal|languages/crystal/tree-sitter/opengrep-crystal|opengrep-crystal|https://github.com/opengrep/opengrep-crystal|${_opengrep_crystal_commit}"
98 "OSS/languages/csharp/tree-sitter/semgrep-c-sharp|languages/csharp/tree-sitter/semgrep-c-sharp|semgrep-c-sharp|https://github.com/opengrep/semgrep-c-sharp|${_semgrep_c_sharp_commit}"
99 "OSS/languages/dart/tree-sitter/semgrep-dart|languages/dart/tree-sitter/semgrep-dart|semgrep-dart|https://github.com/opengrep/semgrep-dart.git|${_semgrep_dart_commit}"
100 "OSS/languages/dockerfile/tree-sitter/semgrep-dockerfile|languages/dockerfile/tree-sitter/semgrep-dockerfile|semgrep-dockerfile|https://github.com/opengrep/semgrep-dockerfile|${_semgrep_dockerfile_commit}"
101 "OSS/languages/elixir/tree-sitter/semgrep-elixir|languages/elixir/tree-sitter/semgrep-elixir|semgrep-elixir|https://github.com/opengrep/semgrep-elixir.git|${_semgrep_elixir_commit}"
102 "OSS/languages/go/tree-sitter/semgrep-go|languages/go/tree-sitter/semgrep-go|semgrep-go|https://github.com/opengrep/semgrep-go|${_semgrep_go_commit}"
103 "OSS/languages/tree-sitter-lang/semgrep-hack|languages/hack/tree-sitter/semgrep-hack|semgrep-hack|https://github.com/opengrep/semgrep-hack.git|${_semgrep_hack_commit}"
104 "OSS/languages/html/tree-sitter/semgrep-html|languages/html/tree-sitter/semgrep-html|semgrep-html|https://github.com/opengrep/semgrep-html.git|${_semgrep_html_commit}"
105 "OSS/languages/java/tree-sitter/semgrep-java|languages/java/tree-sitter/semgrep-java|semgrep-java|https://github.com/opengrep/semgrep-java|${_semgrep_java_commit}"
106 "OSS/languages/jsonnet/tree-sitter/semgrep-jsonnet|languages/jsonnet/tree-sitter/semgrep-jsonnet|semgrep-jsonnet|https://github.com/opengrep/semgrep-jsonnet.git|${_semgrep_jsonnet_commit}"
107 "OSS/languages/julia/tree-sitter/semgrep-julia|languages/julia/tree-sitter/semgrep-julia|semgrep-julia|https://github.com/opengrep/semgrep-julia.git|${_semgrep_julia_commit}"
108 "OSS/languages/kotlin/tree-sitter/semgrep-kotlin|languages/kotlin/tree-sitter/semgrep-kotlin|semgrep-kotlin|https://github.com/opengrep/semgrep-kotlin.git|${_semgrep_kotlin_commit}"
109 "OSS/languages/lisp/tree-sitter/semgrep-clojure|languages/lisp/tree-sitter/semgrep-clojure|semgrep-clojure|https://github.com/opengrep/semgrep-clojure.git|${_semgrep_clojure_commit}"
110 "OSS/languages/lua/tree-sitter/semgrep-lua|languages/lua/tree-sitter/semgrep-lua|semgrep-lua|https://github.com/opengrep/semgrep-lua|${_semgrep_lua_commit}"
111 "OSS/languages/move-on-aptos/tree-sitter/semgrep-move-on-aptos|languages/move_on_aptos/tree-sitter/semgrep-move-on-aptos|semgrep-move-on-aptos|https://github.com/opengrep/semgrep-move-on-aptos.git|${_semgrep_move_on_aptos_commit}"
112 "OSS/languages/move_on_sui/tree-sitter/semgrep-move-on-sui|languages/move_on_sui/tree-sitter/semgrep-move-on-sui|semgrep-move-on-sui|https://github.com/opengrep/semgrep-move-on-sui.git|${_semgrep_move_on_sui_commit}"
113 "OSS/languages/ocaml/tree-sitter/semgrep-ocaml|languages/ocaml/tree-sitter/semgrep-ocaml|semgrep-ocaml|https://github.com/opengrep/semgrep-ocaml.git|${_semgrep_ocaml_commit}"
114 "OSS/languages/php/tree-sitter/semgrep-php|languages/php/tree-sitter/semgrep-php|semgrep-php|https://github.com/opengrep/semgrep-php|${_semgrep_php_commit}"
115 "OSS/languages/promql/tree-sitter/semgrep-promql|languages/promql/tree-sitter/semgrep-promql|semgrep-promql|https://github.com/opengrep/semgrep-promql.git|${_semgrep_promql_commit}"
116 "OSS/languages/protobuf/tree-sitter/semgrep-proto|languages/protobuf/tree-sitter/semgrep-proto|semgrep-proto|https://github.com/opengrep/semgrep-proto.git|${_semgrep_proto_commit}"
117 "OSS/languages/python/tree-sitter/semgrep-python|languages/python/tree-sitter/semgrep-python|semgrep-python|https://github.com/opengrep/semgrep-python.git|${_semgrep_python_commit}"
118 "OSS/languages/ql/tree-sitter/semgrep-ql|languages/ql/tree-sitter/semgrep-ql|semgrep-ql|https://github.com/opengrep/semgrep-ql|${_semgrep_ql_commit}"
119 "OSS/languages/r/tree-sitter/semgrep-r|languages/r/tree-sitter/semgrep-r|semgrep-r|https://github.com/opengrep/semgrep-r|${_semgrep_r_commit}"
120 "OSS/languages/ruby/tree-sitter/semgrep-ruby|languages/ruby/tree-sitter/semgrep-ruby|semgrep-ruby|https://github.com/opengrep/semgrep-ruby.git|${_semgrep_ruby_commit}"
121 "OSS/languages/rust/tree-sitter/semgrep-rust|languages/rust/tree-sitter/semgrep-rust|semgrep-rust|https://github.com/opengrep/semgrep-rust|${_semgrep_rust_commit}"
122 "OSS/languages/solidity/tree-sitter/semgrep-solidity|languages/solidity/tree-sitter/semgrep-solidity|semgrep-solidity|https://github.com/opengrep/semgrep-solidity.git|${_semgrep_solidity_commit}"
123 "OSS/languages/swift/tree-sitter/semgrep-swift|languages/swift/tree-sitter/semgrep-swift|semgrep-swift|https://github.com/opengrep/semgrep-swift.git|${_semgrep_swift_commit}"
124 "OSS/languages/terraform/tree-sitter/semgrep-hcl|languages/terraform/tree-sitter/semgrep-hcl|semgrep-hcl|https://github.com/opengrep/semgrep-hcl|${_semgrep_hcl_commit}"
125 "OSS/languages/typescript/tree-sitter/semgrep-tsx|languages/typescript/tree-sitter/semgrep-tsx|semgrep-tsx|https://github.com/opengrep/semgrep-tsx|${_semgrep_tsx_commit}"
126 "OSS/languages/typescript/tree-sitter/semgrep-typescript|languages/typescript/tree-sitter/semgrep-typescript|semgrep-typescript|https://github.com/opengrep/semgrep-typescript|${_semgrep_typescript_commit}"
127 "OSS/libs/ocaml-tree-sitter-core|libs/ocaml-tree-sitter-core|ocaml-tree-sitter-core|https://github.com/opengrep/ocaml-tree-sitter-core.git|${_ocaml_tree_sitter_core_commit}"
128 "OSS/libs/pcre2|libs/pcre2|pcre2-ocaml|https://github.com/semgrep/pcre2-ocaml|${_pcre2_ocaml_commit}"
129 "OSS/libs/testo|libs/testo|testo|https://github.com/semgrep/testo.git|${_testo_commit}"
130 "OSS/tests/semgrep-rules|tests/semgrep-rules|semgrep-rules|https://github.com/semgrep/semgrep-rules.git|${_semgrep_rules_commit}"
131)
132
133source=(
134 "${pkgname}::git+https://github.com/opengrep/opengrep.git#tag=v${pkgver}"
135 "memprof-limits::git+https://gitlab.com/dimitris-m/memprof-limits.git#commit=${_memprof_limits_commit}"
136 "visitors::git+https://github.com/opengrep/visitors.git#commit=${_visitors_commit}"
137)
138
139sha256sums=(
140 'SKIP'
141 'SKIP'
142 'SKIP'
143)
144
145for _submodule in "${_submodules[@]}"; do
146 IFS='|' read -r _name _path _repo _url _commit <<< "${_submodule}"
147 source+=("${_repo}::git+${_url}#commit=${_commit}")
148 sha256sums+=('SKIP')
149done
150
151prepare() {
152 cd "${pkgname}"
153
154 local _commit _name _path _repo _submodule _url
155 local -a _submodule_paths=()
156
157 git submodule init
158
159 for _submodule in "${_submodules[@]}"; do
160 IFS='|' read -r _name _path _repo _url _commit <<< "${_submodule}"
161 git config "submodule.${_name}.url" "${srcdir}/${_repo}"
162 _submodule_paths+=("${_path}")
163 done
164
165 git -c protocol.file.allow=always submodule update --init --force "${_submodule_paths[@]}"
166
167 sed -i \
168 '/^# Remove all symbols with GNU strip/,/^\tstrip bin\/opengrep-core$(EXE)$/d' \
169 Makefile
170
171 cd libs/ocaml-tree-sitter-core
172 ./configure --prefix /usr
173 sed -i \
174 -e 's|^PATH := .*|PATH := $(PATH):$(TREESITTER_BINDIR)|' \
175 -e 's|^PATH=.*|PATH=$PATH:$TREESITTER_BINDIR|' \
176 tree-sitter-config.mk tree-sitter-config.sh
177}
178
179build() {
180 cd "${pkgname}"
181
182 export OPAMROOT="${srcdir}/opam-root"
183 export OPAMYES=1
184 export OPAMERRLOGLEN=0
185
186 local _switch_stamp= _system_ocamlver
187 _system_ocamlver="$(ocamlc -version)"
188
189 if [[ ! -d "${OPAMROOT}" ]]; then
190 opam init --bare --disable-sandboxing --no-setup
191 fi
192
193 if opam switch list --short | grep -Fxq "${pkgname}"; then
194 if [[ -f "${OPAMROOT}/${pkgname}/.opengrep-package-switch" ]]; then
195 _switch_stamp="$(<"${OPAMROOT}/${pkgname}/.opengrep-package-switch")"
196 fi
197 if [[ "$(opam exec --switch="${pkgname}" -- ocamlc -version 2>/dev/null)" != "${_system_ocamlver}" ]] || \
198 [[ "${_switch_stamp}" != "${_opam_switch_stamp}" ]]; then
199 opam switch remove -y "${pkgname}"
200 fi
201 fi
202
203 if ! opam switch list --short | grep -Fxq "${pkgname}"; then
204 opam switch create "${pkgname}" ocaml-system
205 fi
206
207 export OCAMLPATH="${OPAMROOT}/${pkgname}/lib"
208
209 if ! opam list --switch="${pkgname}" --installed --short ocamlbuild | grep -Fxq ocamlbuild; then
210 opam install --switch="${pkgname}" --fake ocamlbuild
211 fi
212
213 opam pin --switch="${pkgname}" add -n -k path \
214 memprof-limits.dev "${srcdir}/memprof-limits"
215 opam pin --switch="${pkgname}" add -n -k path \
216 visitors.dev "${srcdir}/visitors"
217
218 LDFLAGS= OPAMSOLVERTIMEOUT=1200 opam install --switch="${pkgname}" \
219 --assume-depexts \
220 --ignore-pin-depends \
221 --deps-only \
222 ./opam/semgrep.opam \
223 ./libs/ocaml-tree-sitter-core/tree-sitter.opam
224
225 printf '%s\n' "${_opam_switch_stamp}" > "${OPAMROOT}/${pkgname}/.opengrep-package-switch"
226
227 opam exec --switch="${pkgname}" -- make core
228
229 install -Dm755 bin/opengrep-core \
230 cli/src/semgrep/bin/opengrep-core
231
232 cd cli
233 rm -rf dist
234 python -m build --wheel --no-isolation
235}
236
237check() {
238 cd "${pkgname}"
239
240 local _lang="${LANG-}" _lang_is_set="${LANG+x}" _status
241
242 export OPAMROOT="${srcdir}/opam-root"
243 export OPAMYES=1
244 export OPAMERRLOGLEN=0
245 export OCAMLPATH="${OPAMROOT}/${pkgname}/lib"
246 export LANG=C # Needed for e2e and git tests to pass
247
248 if opam exec --switch="${pkgname}" -- make core-test; then
249 _status=0
250 else
251 _status=$?
252 fi
253
254 if [[ -n "${_lang_is_set}" ]]; then
255 export LANG="${_lang}"
256 else
257 unset LANG
258 fi
259
260 return "${_status}"
261}
262
263package() {
264 cd "${pkgname}/cli"
265
266 local -a _wheels
267 shopt -s nullglob
268 _wheels=(dist/*.whl)
269 if (( ${#_wheels[@]} != 1 )); then
270 error "Expected exactly one wheel in cli/dist, found ${#_wheels[@]}"
271 return 1
272 fi
273
274 python -m installer --destdir="${pkgdir}" "${_wheels[0]}"
275
276 cd ..
277 install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
278}
279

Changes since previous scan

--- PKGBUILD @ 2026-10-27 00:23
+++ PKGBUILD @ 2026-10-28 00:06
@@ -1,6 +1,6 @@
# Maintainer: Julian Houba <info@craftingdragon.ch>
pkgname=opengrep
-pkgver=1.32.0
+pkgver=1.33.0
pkgrel=1
_memprof_limits_commit=c2cced325a93d2271379f0712db85867b29dbee1
_visitors_commit=e18a7a67150a54a3aef51661e0317cacc313d764

Scan history

Scanned at (UTC)SeverityRules
2026-10-28 00:06:54 Low 2
2026-10-27 15:48:05 Medium 1
2026-10-27 00:23:28 Low 2
2026-10-26 00:12:40 Low 2
2026-10-25 00:20:48 Low 2
2026-10-24 00:14:55 Low 2
2026-10-23 05:36:55 Medium 1
2026-10-23 00:02:19 Low 2
2026-10-22 00:13:10 Low 2
2026-10-21 00:12:50 Low 2
2026-10-20 00:10:31 Low 2
2026-10-19 00:03:55 Low 2
2026-10-18 00:06:55 Low 2
2026-10-17 00:21:55 Low 2
2026-10-16 00:12:47 Low 2
2026-10-15 17:12:54 Medium 1
2026-10-15 00:28:05 Low 2
2026-10-14 00:06:47 Low 2
2026-10-13 00:23:45 Low 2
2026-10-12 00:18:51 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion