ortfo

maintainer gwennlbh · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD contains a curl-pipe-sh pattern in the prepare() function: `curl -fsSL https://get.pnpm.io/install.sh | PNPM_VERSION=7.0.0-rc.8 sh -`. This downloads and executes a shell script from an external host (get.pnpm.io) that is not listed in the source=() array and therefore has no integrity verification (no checksum). While get.pnpm.io is the official pnpm distribution endpoint, the pattern itself is a genuine supply-chain risk: if the host were compromised or the URL redirected, arbitrary code would execute during the build. The script also installs pnpm into the build environment outside of pacman's package management. Additionally, `go install github.com/rakyll/statik` fetches and compiles an external Go tool at build time without pinning a version or verifying a checksum. These are real, if not clearly malicious, supply-chain concerns. The overall risk is medium: not an active attack, but the unverified remote script execution and unpinned external tool installation represent genuine concerns that belong in this category.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:25 which pnpm || curl -fsSL https://get.pnpm.io/install.sh | PNPM_VERSION=7.0.0-rc.8 sh -

MEDIUM External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:29 go install github.com/rakyll/statik

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD contains a curl-pipe-sh pattern in the prepare() function: `curl -fsSL https://get.pnpm.io/install.sh | PNPM_VERSION=7.0.0-rc.8 sh -`. This downloads and executes a shell script from an external host (get.pnpm.io) that is not listed in the source=() array and therefore has no integrity verification (no checksum). While get.pnpm.io is the official pnpm distribution endpoint, the pattern itself is a genuine supply-chain risk: if the host were compromised or the URL redirected, arbitrary code would execute during the build. The script also installs pnpm into the build environment outside of pacman's package management. Additionally, `go install github.com/rakyll/statik` fetches and compiles an external Go tool at build time without pinning a version or verifying a checksum. These are real, if not clearly malicious, supply-chain concerns. The overall risk is medium: not an active attack, but the unverified remote script execution and unpinned external tool installation represent genuine concerns that belong in this category.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: ewen-lbh <hey@ewen.works>
    
      2
    
      3pkgname=ortfo
    
      4pkgver=0.1.0.alpha.2
    
      5pkgrel=2
    
      6pkgdesc="The GUI for ortfo, a portfolio manager"
    
      7arch=('x86_64')
    
      8url="https://github.com/ortfo/gui"
    
      9license=("GPL-3.0")
    
      10depends=("gtk3" "webkit2gtk")
    
      11makedepends=("go" "git" "curl")
    
      12conflicts=("ortfo-git" "ortfo-bin")
    
      13provides=("ortfo")
    
      14source=("git+${url}")
    
      15sha256sums=("SKIP")
    
      16
    
      17pkgver() {
    
      18	cd gui
    
      19	git describe --tags --abbrev=0 | sed 's/-/./g'
    
      20} 
    
      21
    
      22prepare() {
    
      23	cd gui
    
      24	git checkout tags/v${pkgver/.alpha/-alpha}
    
      25	which pnpm || curl -fsSL https://get.pnpm.io/install.sh | PNPM_VERSION=7.0.0-rc.8 sh -
    
      26# Install frontend dependencies
    
      27	pnpm install || yarn install || npm install
    
      28# Install the statik tool
    
      29	go install github.com/rakyll/statik
    
      30# Prepare statik content
    
      31	mkdir -p dist/
    
      32	statik -f -src=dist/
    
      33# Install backend dependencies
    
      34	go mod tidy
    
      35}
    
      36
    
      37build() {
    
      38	cd gui
    
      39	make
    
      40}
    
      41
    
      42check() {
    
      43	cd gui
    
      44	# make test
    
      45}
    
      46
    
      47package() {
    
      48	cd gui
    
      49	install -Dm 755 ortfo -t "${pkgdir}/usr/bin"
    
      50	install -Dm 644 LICENSE -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      51	install -Dm 644 README.md -t "${pkgdir}/usr/share/doc/${pkgname}"
    
      52}
    
      53

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 00:29:32	MEDIUM	3
2026-07-21 00:24:15	MEDIUM	3
2026-07-20 00:19:49	MEDIUM	3
2026-07-19 00:17:08	MEDIUM	3
2026-07-18 00:14:48	MEDIUM	3
2026-07-17 00:06:16	MEDIUM	3
2026-07-16 00:05:41	MEDIUM	3
2026-07-15 00:09:25	MEDIUM	3