ortfo-git

maintainer gwennlbh · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD conditionally downloads and executes a shell script via curl-pipe-sh from get.pnpm.io (curl -fsSL https://get.pnpm.io/install.sh | sh -) if pnpm is not already installed. While get.pnpm.io is the official pnpm installation endpoint, this pattern is still a supply-chain concern: the script is not in source=(), has no checksum verification, and is executed directly during the build phase. If the host is compromised or the connection is intercepted (no integrity check), arbitrary code runs in the build environment. The pinned PNPM_VERSION=7.0.0-rc.8 mitigates version drift but not substitution attacks. This is a real medium-severity concern — not clearly malicious, but an executed script from an external host without integrity verification.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:24 which pnpm || curl -fsSL https://get.pnpm.io/install.sh | PNPM_VERSION=7.0.0-rc.8 sh -

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD conditionally downloads and executes a shell script via curl-pipe-sh from get.pnpm.io (curl -fsSL https://get.pnpm.io/install.sh | sh -) if pnpm is not already installed. While get.pnpm.io is the official pnpm installation endpoint, this pattern is still a supply-chain concern: the script is not in source=(), has no checksum verification, and is executed directly during the build phase. If the host is compromised or the connection is intercepted (no integrity check), arbitrary code runs in the build environment. The pinned PNPM_VERSION=7.0.0-rc.8 mitigates version drift but not substitution attacks. This is a real medium-severity concern — not clearly malicious, but an executed script from an external host without integrity verification.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: ewen-lbh <hey@ewen.works>
    
      2
    
      3pkgname=ortfo-git
    
      4pkgver=0.1.0.alpha.2.r28.g40b2dd0
    
      5pkgrel=1
    
      6pkgdesc="The GUI for ortfo, a portfolio manager (latest git commit)"
    
      7arch=('x86_64')
    
      8url="https://github.com/ortfo/gui"
    
      9license=("GPL-3.0")
    
      10depends=("gtk3" "webkit2gtk")
    
      11makedepends=("go" "git" "curl" "svg2png")
    
      12conflicts=("ortfo" "ortfo-bin")
    
      13provides=("ortfo")
    
      14source=("git+${url}")
    
      15sha256sums=("SKIP")
    
      16
    
      17pkgver() {
    
      18	cd gui
    
      19	git describe --long --tags | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
    
      20}
    
      21
    
      22prepare() {
    
      23	cd gui
    
      24	which pnpm || curl -fsSL https://get.pnpm.io/install.sh | PNPM_VERSION=7.0.0-rc.8 sh -
    
      25	make setup
    
      26}
    
      27
    
      28build() {
    
      29	cd gui
    
      30	make
    
      31}
    
      32
    
      33check() {
    
      34	cd gui
    
      35	# make test
    
      36}
    
      37
    
      38package() {
    
      39	cd gui
    
      40	for size in 16 32 48 64 128 256 512 1024; do
    
      41		svg2png -w $size -h $size public/assets/light-logo.svg ortfo.png
    
      42		install -Dm 644 ortfo.png -t "${pkgdir}/usr/share/icons/hicolor/${size}x${size}/apps"
    
      43	done
    
      44	install -Dm 644 installers/ortfo.desktop "${pkgdir}/usr/share/applications/ortfo.desktop"
    
      45	install -Dm 755 ortfo -t "${pkgdir}/usr/bin"
    
      46	install -Dm 644 LICENSE -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      47	install -Dm 644 README.md -t "${pkgdir}/usr/share/doc/${pkgname}"
    
      48}
    
      49

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2