opengrep

MEDIUM

maintainer craftingDragon7 3 votes scanned 2026-09-13 15:14:52.955091

View on AUR

Why flagged

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

Triggered rules

Medium External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:207 opam install --switch="${pkgname}" --fake ocamlbuild

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Julian Houba <info@craftingdragon.ch>
    
      2pkgname=opengrep
    
      3pkgver=1.30.0
    
      4pkgrel=1
    
      5_memprof_limits_commit=c2cced325a93d2271379f0712db85867b29dbee1
    
      6_semgrep_interfaces_commit=5e705660dc7381d4c4c247fa83c4c5860e61d555
    
      7_semgrep_apex_commit=024974494b1042141388e1efda11cd5dbcc273e3
    
      8_semgrep_bash_commit=aa7d8eec0714a1e1492a1dcbac32c883a58bb6da
    
      9_semgrep_cairo_commit=a8e2d5d5dcf8345735b15268b76b24377103a188
    
      10_semgrep_circom_commit=a6084cd52d1dbae28365635934279c0100e89762
    
      11_semgrep_cpp_commit=eddec4922e67e757c546cdec7e640a6e7b0ecba4
    
      12_opengrep_crystal_commit=f279484792c259278c4e135e8f1048bbcea7c358
    
      13_semgrep_c_sharp_commit=75c7277df0202ad6f8f8db968c38733ecdb9ea4e
    
      14_semgrep_dart_commit=8e04531936bca9f508692e97646019abfd4c2774
    
      15_semgrep_dockerfile_commit=783ee02353d0da80c03e74598394b2fb84745deb
    
      16_semgrep_elixir_commit=dc48d05492c8d2020698f832ec43974bdd9aae15
    
      17_semgrep_go_commit=51ff7be525c452c0201b3969b3117f7bf8e588dc
    
      18_semgrep_hack_commit=d803e5719874de90ba9a0db9c6f7ba08314c50be
    
      19_semgrep_html_commit=0b0f69e7d12ba20625b3af5223aa3ca9767d38bd
    
      20_semgrep_java_commit=8b9830231a447945d7af372d29720496e3058782
    
      21_semgrep_jsonnet_commit=fde344cc44f2787f8afd9b28c4b70f04ced32c41
    
      22_semgrep_julia_commit=885a1421f27e20c36e18eadb18c8f79cb8d54298
    
      23_semgrep_kotlin_commit=a7d508fe9b623fb9d5c9e90b47a1eba704908110
    
      24_semgrep_clojure_commit=754ea8a63c06e16984b9c7b4e2713bc160667c87
    
      25_semgrep_lua_commit=6fe7090fe8c1dd2193211af0443fa902e16bba74
    
      26_semgrep_move_on_aptos_commit=257a384fca87ce6831670b4aac5296a382cf6974
    
      27_semgrep_move_on_sui_commit=4fe01c06c24ada6a9b0a99d49cc488964fa11046
    
      28_semgrep_ocaml_commit=9ba9be79844df3e560da2d2c77e160b3f827a8ce
    
      29_semgrep_php_commit=0b2ef9bc28ae87200af5cd85ff5e53fc5306cbef
    
      30_semgrep_promql_commit=5e9ca596499c5730a0bc687bd806ca28f5a99a46
    
      31_semgrep_proto_commit=9e169500bdfadb93cbf6ec92094581e88b1369a6
    
      32_semgrep_python_commit=0a623865209259662df6606946805756997c0074
    
      33_semgrep_ql_commit=55749f3c2124dfe1661453ab0790042035a16d41
    
      34_semgrep_r_commit=06fa8af03dca9aa293efd603ba107faf7e82a3c3
    
      35_semgrep_ruby_commit=a824639aeb646c03b5bbc74c3fc5844ed691e7b7
    
      36_semgrep_rust_commit=fa0ae954dfd2c62c4aba9781e5f0fcc584c4a248
    
      37_semgrep_solidity_commit=968fd0d7096720e72c9870933ae7afa58221278f
    
      38_semgrep_swift_commit=7214b8436dd77d5dede681b05905009bb14c64a9
    
      39_semgrep_hcl_commit=546b85986d1965450ba942eea71cc80f55ea39ee
    
      40_semgrep_tsx_commit=4293c1bc21f441ccfa3b0fa4306a9978ee9ec0b7
    
      41_semgrep_typescript_commit=08a13a2a846e6d64dc859435be5f0214dff2d72c
    
      42_ocaml_tree_sitter_core_commit=1392efc21e60d5acde72d0d1c6586f5692fedace
    
      43_pcre2_ocaml_commit=51cde0d79f8d72562b4d4ebfb07d4bbe719249c6
    
      44_testo_commit=634c978b8c03f02f8f172820fed4554aff721313
    
      45_semgrep_rules_commit=40b8c63f75dc7c22c8a77482d73bfb864b146f7e
    
      46_opam_switch_stamp=4
    
      47pkgdesc="Lightweight static analysis for many languages. Find bug variants with patterns that look like source code. Fork of semgrep"
    
      48arch=('x86_64' 'aarch64')
    
      49url="https://github.com/opengrep/opengrep"
    
      50license=('LGPL-2.1-only')
    
      51
    
      52depends=(
    
      53  'gmp'
    
      54  'libev'
    
      55  'pcre'
    
      56  'pcre2'
    
      57  'python'
    
      58  'python-attrs'
    
      59  'python-boltons'
    
      60  'python-click-option-group'
    
      61  'python-click'
    
      62  'python-colorama'
    
      63  'python-glom'
    
      64  'python-jsonschema'
    
      65  'python-packaging'
    
      66  'python-peewee'
    
      67  'python-requests'
    
      68  'python-rich'
    
      69  'python-ruamel-yaml'
    
      70  'python-typing_extensions'
    
      71  'python-urllib3'
    
      72  'python-wcmatch'
    
      73  'tree-sitter'
    
      74)
    
      75makedepends=(
    
      76  'dune'
    
      77  'git'
    
      78  'ocaml'
    
      79  'ocamlbuild'
    
      80  'opam'
    
      81  'pkgconf'
    
      82  'python-build'
    
      83  'python-installer'
    
      84  'python-setuptools'
    
      85  'python-wheel'
    
      86  'rsync'
    
      87)
    
      88
    
      89_submodules=(
    
      90  "OSS/cli/src/semgrep/semgrep_interfaces|cli/src/semgrep/semgrep_interfaces|semgrep-interfaces|https://github.com/opengrep/semgrep-interfaces.git|${_semgrep_interfaces_commit}"
    
      91  "languages/apex/tree-sitter/semgrep-apex|languages/apex/tree-sitter/semgrep-apex|semgrep-apex|https://github.com/opengrep/semgrep-apex.git|${_semgrep_apex_commit}"
    
      92  "OSS/languages/bash/tree-sitter/semgrep-bash|languages/bash/tree-sitter/semgrep-bash|semgrep-bash|https://github.com/opengrep/semgrep-bash|${_semgrep_bash_commit}"
    
      93  "OSS/languages/cairo/tree-sitter/semgrep-cairo|languages/cairo/tree-sitter/semgrep-cairo|semgrep-cairo|https://github.com/opengrep/semgrep-cairo|${_semgrep_cairo_commit}"
    
      94  "OSS/languages/circom/tree-sitter/semgrep-circom|languages/circom/tree-sitter/semgrep-circom|semgrep-circom|https://github.com/opengrep/semgrep-circom.git|${_semgrep_circom_commit}"
    
      95  "OSS/languages/cpp/tree-sitter/semgrep-cpp|languages/cpp/tree-sitter/semgrep-cpp|semgrep-cpp|https://github.com/opengrep/semgrep-cpp|${_semgrep_cpp_commit}"
    
      96  "OSS/languages/crystal/tree-sitter/opengrep-crystal|languages/crystal/tree-sitter/opengrep-crystal|opengrep-crystal|https://github.com/opengrep/opengrep-crystal|${_opengrep_crystal_commit}"
    
      97  "OSS/languages/csharp/tree-sitter/semgrep-c-sharp|languages/csharp/tree-sitter/semgrep-c-sharp|semgrep-c-sharp|https://github.com/opengrep/semgrep-c-sharp|${_semgrep_c_sharp_commit}"
    
      98  "OSS/languages/dart/tree-sitter/semgrep-dart|languages/dart/tree-sitter/semgrep-dart|semgrep-dart|https://github.com/opengrep/semgrep-dart.git|${_semgrep_dart_commit}"
    
      99  "OSS/languages/dockerfile/tree-sitter/semgrep-dockerfile|languages/dockerfile/tree-sitter/semgrep-dockerfile|semgrep-dockerfile|https://github.com/opengrep/semgrep-dockerfile|${_semgrep_dockerfile_commit}"
    
      100  "OSS/languages/elixir/tree-sitter/semgrep-elixir|languages/elixir/tree-sitter/semgrep-elixir|semgrep-elixir|https://github.com/opengrep/semgrep-elixir.git|${_semgrep_elixir_commit}"
    
      101  "OSS/languages/go/tree-sitter/semgrep-go|languages/go/tree-sitter/semgrep-go|semgrep-go|https://github.com/opengrep/semgrep-go|${_semgrep_go_commit}"
    
      102  "OSS/languages/tree-sitter-lang/semgrep-hack|languages/hack/tree-sitter/semgrep-hack|semgrep-hack|https://github.com/opengrep/semgrep-hack.git|${_semgrep_hack_commit}"
    
      103  "OSS/languages/html/tree-sitter/semgrep-html|languages/html/tree-sitter/semgrep-html|semgrep-html|https://github.com/opengrep/semgrep-html.git|${_semgrep_html_commit}"
    
      104  "OSS/languages/java/tree-sitter/semgrep-java|languages/java/tree-sitter/semgrep-java|semgrep-java|https://github.com/opengrep/semgrep-java|${_semgrep_java_commit}"
    
      105  "OSS/languages/jsonnet/tree-sitter/semgrep-jsonnet|languages/jsonnet/tree-sitter/semgrep-jsonnet|semgrep-jsonnet|https://github.com/opengrep/semgrep-jsonnet.git|${_semgrep_jsonnet_commit}"
    
      106  "OSS/languages/julia/tree-sitter/semgrep-julia|languages/julia/tree-sitter/semgrep-julia|semgrep-julia|https://github.com/opengrep/semgrep-julia.git|${_semgrep_julia_commit}"
    
      107  "OSS/languages/kotlin/tree-sitter/semgrep-kotlin|languages/kotlin/tree-sitter/semgrep-kotlin|semgrep-kotlin|https://github.com/opengrep/semgrep-kotlin.git|${_semgrep_kotlin_commit}"
    
      108  "OSS/languages/lisp/tree-sitter/semgrep-clojure|languages/lisp/tree-sitter/semgrep-clojure|semgrep-clojure|https://github.com/opengrep/semgrep-clojure.git|${_semgrep_clojure_commit}"
    
      109  "OSS/languages/lua/tree-sitter/semgrep-lua|languages/lua/tree-sitter/semgrep-lua|semgrep-lua|https://github.com/opengrep/semgrep-lua|${_semgrep_lua_commit}"
    
      110  "OSS/languages/move-on-aptos/tree-sitter/semgrep-move-on-aptos|languages/move_on_aptos/tree-sitter/semgrep-move-on-aptos|semgrep-move-on-aptos|https://github.com/opengrep/semgrep-move-on-aptos.git|${_semgrep_move_on_aptos_commit}"
    
      111  "OSS/languages/move_on_sui/tree-sitter/semgrep-move-on-sui|languages/move_on_sui/tree-sitter/semgrep-move-on-sui|semgrep-move-on-sui|https://github.com/opengrep/semgrep-move-on-sui.git|${_semgrep_move_on_sui_commit}"
    
      112  "OSS/languages/ocaml/tree-sitter/semgrep-ocaml|languages/ocaml/tree-sitter/semgrep-ocaml|semgrep-ocaml|https://github.com/opengrep/semgrep-ocaml.git|${_semgrep_ocaml_commit}"
    
      113  "OSS/languages/php/tree-sitter/semgrep-php|languages/php/tree-sitter/semgrep-php|semgrep-php|https://github.com/opengrep/semgrep-php|${_semgrep_php_commit}"
    
      114  "OSS/languages/promql/tree-sitter/semgrep-promql|languages/promql/tree-sitter/semgrep-promql|semgrep-promql|https://github.com/opengrep/semgrep-promql.git|${_semgrep_promql_commit}"
    
      115  "OSS/languages/protobuf/tree-sitter/semgrep-proto|languages/protobuf/tree-sitter/semgrep-proto|semgrep-proto|https://github.com/opengrep/semgrep-proto.git|${_semgrep_proto_commit}"
    
      116  "OSS/languages/python/tree-sitter/semgrep-python|languages/python/tree-sitter/semgrep-python|semgrep-python|https://github.com/opengrep/semgrep-python.git|${_semgrep_python_commit}"
    
      117  "OSS/languages/ql/tree-sitter/semgrep-ql|languages/ql/tree-sitter/semgrep-ql|semgrep-ql|https://github.com/opengrep/semgrep-ql|${_semgrep_ql_commit}"
    
      118  "OSS/languages/r/tree-sitter/semgrep-r|languages/r/tree-sitter/semgrep-r|semgrep-r|https://github.com/opengrep/semgrep-r|${_semgrep_r_commit}"
    
      119  "OSS/languages/ruby/tree-sitter/semgrep-ruby|languages/ruby/tree-sitter/semgrep-ruby|semgrep-ruby|https://github.com/opengrep/semgrep-ruby.git|${_semgrep_ruby_commit}"
    
      120  "OSS/languages/rust/tree-sitter/semgrep-rust|languages/rust/tree-sitter/semgrep-rust|semgrep-rust|https://github.com/opengrep/semgrep-rust|${_semgrep_rust_commit}"
    
      121  "OSS/languages/solidity/tree-sitter/semgrep-solidity|languages/solidity/tree-sitter/semgrep-solidity|semgrep-solidity|https://github.com/opengrep/semgrep-solidity.git|${_semgrep_solidity_commit}"
    
      122  "OSS/languages/swift/tree-sitter/semgrep-swift|languages/swift/tree-sitter/semgrep-swift|semgrep-swift|https://github.com/opengrep/semgrep-swift.git|${_semgrep_swift_commit}"
    
      123  "OSS/languages/terraform/tree-sitter/semgrep-hcl|languages/terraform/tree-sitter/semgrep-hcl|semgrep-hcl|https://github.com/opengrep/semgrep-hcl|${_semgrep_hcl_commit}"
    
      124  "OSS/languages/typescript/tree-sitter/semgrep-tsx|languages/typescript/tree-sitter/semgrep-tsx|semgrep-tsx|https://github.com/opengrep/semgrep-tsx|${_semgrep_tsx_commit}"
    
      125  "OSS/languages/typescript/tree-sitter/semgrep-typescript|languages/typescript/tree-sitter/semgrep-typescript|semgrep-typescript|https://github.com/opengrep/semgrep-typescript|${_semgrep_typescript_commit}"
    
      126  "OSS/libs/ocaml-tree-sitter-core|libs/ocaml-tree-sitter-core|ocaml-tree-sitter-core|https://github.com/opengrep/ocaml-tree-sitter-core.git|${_ocaml_tree_sitter_core_commit}"
    
      127  "OSS/libs/pcre2|libs/pcre2|pcre2-ocaml|https://github.com/semgrep/pcre2-ocaml|${_pcre2_ocaml_commit}"
    
      128  "OSS/libs/testo|libs/testo|testo|https://github.com/semgrep/testo.git|${_testo_commit}"
    
      129  "OSS/tests/semgrep-rules|tests/semgrep-rules|semgrep-rules|https://github.com/semgrep/semgrep-rules.git|${_semgrep_rules_commit}"
    
      130)
    
      131
    
      132source=(
    
      133  "${pkgname}::git+https://github.com/opengrep/opengrep.git#tag=v${pkgver}"
    
      134  "memprof-limits::git+https://gitlab.com/dimitris-m/memprof-limits.git#commit=${_memprof_limits_commit}"
    
      135)
    
      136
    
      137sha256sums=(
    
      138    'SKIP'
    
      139    'SKIP'
    
      140)
    
      141
    
      142for _submodule in "${_submodules[@]}"; do
    
      143  IFS='|' read -r _name _path _repo _url _commit <<< "${_submodule}"
    
      144  source+=("${_repo}::git+${_url}#commit=${_commit}")
    
      145  sha256sums+=('SKIP')
    
      146done
    
      147
    
      148prepare() {
    
      149  cd "${pkgname}"
    
      150
    
      151  local _commit _name _path _repo _submodule _url
    
      152  local -a _submodule_paths=()
    
      153
    
      154  git submodule init
    
      155
    
      156  for _submodule in "${_submodules[@]}"; do
    
      157    IFS='|' read -r _name _path _repo _url _commit <<< "${_submodule}"
    
      158    git config "submodule.${_name}.url" "${srcdir}/${_repo}"
    
      159    _submodule_paths+=("${_path}")
    
      160  done
    
      161
    
      162  git -c protocol.file.allow=always submodule update --init --force "${_submodule_paths[@]}"
    
      163
    
      164  sed -i \
    
      165    '/^# Remove all symbols with GNU strip/,/^\tstrip bin\/opengrep-core$(EXE)$/d' \
    
      166    Makefile
    
      167
    
      168  cd libs/ocaml-tree-sitter-core
    
      169  ./configure --prefix /usr
    
      170  sed -i \
    
      171    -e 's|^PATH := .*|PATH := $(PATH):$(TREESITTER_BINDIR)|' \
    
      172    -e 's|^PATH=.*|PATH=$PATH:$TREESITTER_BINDIR|' \
    
      173    tree-sitter-config.mk tree-sitter-config.sh
    
      174}
    
      175
    
      176build() {
    
      177  cd "${pkgname}"
    
      178
    
      179  export OPAMROOT="${srcdir}/opam-root"
    
      180  export OPAMYES=1
    
      181  export OPAMERRLOGLEN=0
    
      182
    
      183  local _switch_stamp= _system_ocamlver
    
      184  _system_ocamlver="$(ocamlc -version)"
    
      185
    
      186  if [[ ! -d "${OPAMROOT}" ]]; then
    
      187    opam init --bare --disable-sandboxing --no-setup
    
      188  fi
    
      189
    
      190  if opam switch list --short | grep -Fxq "${pkgname}"; then
    
      191    if [[ -f "${OPAMROOT}/${pkgname}/.opengrep-package-switch" ]]; then
    
      192      _switch_stamp="$(<"${OPAMROOT}/${pkgname}/.opengrep-package-switch")"
    
      193    fi
    
      194    if [[ "$(opam exec --switch="${pkgname}" -- ocamlc -version 2>/dev/null)" != "${_system_ocamlver}" ]] || \
    
      195       [[ "${_switch_stamp}" != "${_opam_switch_stamp}" ]]; then
    
      196      opam switch remove -y "${pkgname}"
    
      197    fi
    
      198  fi
    
      199
    
      200  if ! opam switch list --short | grep -Fxq "${pkgname}"; then
    
      201    opam switch create "${pkgname}" ocaml-system
    
      202  fi
    
      203
    
      204  export OCAMLPATH="${OPAMROOT}/${pkgname}/lib"
    
      205
    
      206  if ! opam list --switch="${pkgname}" --installed --short ocamlbuild | grep -Fxq ocamlbuild; then
    
      207    opam install --switch="${pkgname}" --fake ocamlbuild
    
      208  fi
    
      209
    
      210  opam pin --switch="${pkgname}" add -n -k path \
    
      211    memprof-limits.dev "${srcdir}/memprof-limits"
    
      212
    
      213  LDFLAGS= OPAMSOLVERTIMEOUT=1200 opam install --switch="${pkgname}" \
    
      214    --assume-depexts \
    
      215    --ignore-pin-depends \
    
      216    --deps-only \
    
      217    ./opam/semgrep.opam \
    
      218    ./libs/ocaml-tree-sitter-core/tree-sitter.opam
    
      219
    
      220  printf '%s\n' "${_opam_switch_stamp}" > "${OPAMROOT}/${pkgname}/.opengrep-package-switch"
    
      221
    
      222  opam exec --switch="${pkgname}" -- make core
    
      223
    
      224  install -Dm755 bin/opengrep-core \
    
      225    cli/src/semgrep/bin/opengrep-core
    
      226
    
      227  cd cli
    
      228  rm -rf dist
    
      229  python -m build --wheel --no-isolation
    
      230}
    
      231
    
      232check() {
    
      233  cd "${pkgname}"
    
      234
    
      235  local _lang="${LANG-}" _lang_is_set="${LANG+x}" _status
    
      236
    
      237  export OPAMROOT="${srcdir}/opam-root"
    
      238  export OPAMYES=1
    
      239  export OPAMERRLOGLEN=0
    
      240  export OCAMLPATH="${OPAMROOT}/${pkgname}/lib"
    
      241  export LANG=C # Needed for e2e and git tests to pass
    
      242
    
      243  if opam exec --switch="${pkgname}" -- make core-test; then
    
      244    _status=0
    
      245  else
    
      246    _status=$?
    
      247  fi
    
      248
    
      249  if [[ -n "${_lang_is_set}" ]]; then
    
      250    export LANG="${_lang}"
    
      251  else
    
      252    unset LANG
    
      253  fi
    
      254
    
      255  return "${_status}"
    
      256}
    
      257
    
      258package() {
    
      259  cd "${pkgname}/cli"
    
      260
    
      261  local -a _wheels
    
      262  shopt -s nullglob
    
      263  _wheels=(dist/*.whl)
    
      264  if (( ${#_wheels[@]} != 1 )); then
    
      265    error "Expected exactly one wheel in cli/dist, found ${#_wheels[@]}"
    
      266    return 1
    
      267  fi
    
      268
    
      269  python -m installer --destdir="${pkgdir}" "${_wheels[0]}"
    
      270
    
      271  cd ..
    
      272  install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      273}
    
      274

Changes since previous scan

--- PKGBUILD @ 2026-09-07 17:15
+++ PKGBUILD @ 2026-09-13 15:14
@@ -43,7 +43,7 @@
 _pcre2_ocaml_commit=51cde0d79f8d72562b4d4ebfb07d4bbe719249c6
 _testo_commit=634c978b8c03f02f8f172820fed4554aff721313
 _semgrep_rules_commit=40b8c63f75dc7c22c8a77482d73bfb864b146f7e
-_opam_switch_stamp=3
+_opam_switch_stamp=4
 pkgdesc="Lightweight static analysis for many languages. Find bug variants with patterns that look like source code. Fork of semgrep"
 arch=('x86_64' 'aarch64')
 url="https://github.com/opengrep/opengrep"
@@ -76,6 +76,7 @@
   'dune'
   'git'
   'ocaml'
+  'ocamlbuild'
   'opam'
   'pkgconf'
   'python-build'
@@ -202,6 +203,10 @@
 
   export OCAMLPATH="${OPAMROOT}/${pkgname}/lib"
 
+  if ! opam list --switch="${pkgname}" --installed --short ocamlbuild | grep -Fxq ocamlbuild; then
+    opam install --switch="${pkgname}" --fake ocamlbuild
+  fi
+
   opam pin --switch="${pkgname}" add -n -k path \
     memprof-limits.dev "${srcdir}/memprof-limits"
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-13 15:14:52	Medium	1
2026-09-07 17:15:15	Clean	0
2026-09-01 09:47:42	Clean	0
2026-08-28 21:36:41	Clean	0
2026-08-26 07:29:42	Clean	0
2026-08-15 05:30:14	Clean	0
2026-08-12 21:24:53	Clean	0
2026-07-24 23:28:32	Clean	0
2026-07-02 06:44:17	Clean	0
2026-06-30 20:39:37	Clean	0
2026-06-19 22:34:54	Clean	0
2026-06-18 16:11:54	Clean	0