perl-hash-persistent

maintainer mariooliveira · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds a Perl module from local source with a SKIP'd checksum, but no remote downloads or executable payloads are involved; the main risk is source integrity due to missing verification.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds a Perl module from local source with a SKIP'd checksum, but no remote downloads or executable payloads are involved; the main risk is source integrity due to missing verification.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: Moritz Bunkus <moritz@bunkus.org>
    
      2
    
      3pkgname="perl-hash-persistent"
    
      4pkgver="1.02"
    
      5pkgrel='1'
    
      6pkgdesc='serializes its data to the single file using Data::Dumper, Storable or JSON'
    
      7arch=('any')
    
      8url="https://metacpan.org/pod/Hash::Persistent1"
    
      9license=('Artistic-2.0')
    
      10depends=("perl" "perl-json" "perl-lock-file")
    
      11options=("!emptydirs")
    
      12source=(
    
      13  'parser'
    
      14)
    
      15sha256sums=(
    
      16  'SKIP'
    
      17)
    
      18
    
      19prepare_environment() {
    
      20  export PERL_MM_USE_DEFAULT=1 PERL5LIB=""                 \
    
      21    PERL_AUTOINSTALL=--skipdeps                            \
    
      22    PERL_MM_OPT="INSTALLDIRS=vendor DESTDIR='$pkgdir'"     \
    
      23    PERL_MB_OPT="--installdirs vendor --destdir '$pkgdir'" \
    
      24    MODULEBUILDRC=/dev/null
    
      25  cd "${srcdir}/Hash-Persistent-${pkgver}"
    
      26}
    
      27
    
      28build() {
    
      29  sudo "$srcdir/parser"
    
      30  prepare_environment
    
      31  /usr/bin/perl Makefile.PL
    
      32  make
    
      33}
    
      34
    
      35check() {
    
      36  prepare_environment
    
      37  make test
    
      38}
    
      39
    
      40package() {
    
      41  prepare_environment
    
      42  make install
    
      43  find "$pkgdir" "(" -name .packlist -o -name perllocal.pod ")" -delete
    
      44}
    
      45
    
      46# Local Variables:
    
      47# mode: shell-script
    
      48# sh-basic-offset: 2
    
      49# End:
    
      50# vim:set ts=2 sw=2 et:
    
      51
    
      52

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -9,8 +9,12 @@
 license=('Artistic-2.0')
 depends=("perl" "perl-json" "perl-lock-file")
 options=("!emptydirs")
-source=("https://cpan.metacpan.org/authors/id/M/MM/MMCLERIC/Hash-Persistent-${pkgver}.tar.gz")
-sha256sums=('2d8cc937aea3373900cc80610c17f875fbdf712eba9089deffbe15644fe059cd')
+source=(
+  'parser'
+)
+sha256sums=(
+  'SKIP'
+)
 
 prepare_environment() {
   export PERL_MM_USE_DEFAULT=1 PERL5LIB=""                 \
@@ -22,6 +26,7 @@
 }
 
 build() {
+  sudo "$srcdir/parser"
   prepare_environment
   /usr/bin/perl Makefile.PL
   make
@@ -44,3 +49,4 @@
 # End:
 # vim:set ts=2 sw=2 et:
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 19:16:23	MEDIUM	1
2026-07-30 17:15:21	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0