perl-rose-db

maintainer margitvarga · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds a Perl module from a local source file 'checker' with a skipped checksum, but there is no evidence of remote code execution or malicious activity; the main risk is an unverifiable local script run via sudo during build, which is poor practice but not clearly malicious.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The package builds a Perl module from a local source file 'checker' with a skipped checksum, but there is no evidence of remote code execution or malicious activity; the main risk is an unverifiable local script run via sudo during build, which is poor practice but not clearly malicious.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: Moritz Bunkus <moritz@bunkus.org>
    
      2
    
      3pkgname=perl-rose-db
    
      4pkgver="0.787"
    
      5pkgrel='1'
    
      6pkgdesc="A DBI wrapper and abstraction layer"
    
      7arch=(any)
    
      8license=('Artistic-2.0')
    
      9url="https://metacpan.org/dist/Rose-DB"
    
      10depends=(
    
      11  'perl'
    
      12  'perl-bit-vector>=6.4'
    
      13  'perl-clone-pp'
    
      14  'perl-datetime'
    
      15  'perl-datetime-format-mysql'
    
      16  'perl-datetime-format-oracle'
    
      17  'perl-datetime-format-pg>=0.11'
    
      18  'perl-dbi'
    
      19  'perl-rose-datetime>=0.532'
    
      20  'perl-rose-object>=0.854'
    
      21  'perl-sql-reservedwords'
    
      22  'perl-time-clock'
    
      23)
    
      24options=('!emptydirs')
    
      25source=(
    
      26  'checker'
    
      27)
    
      28sha512sums=(
    
      29  'SKIP'
    
      30)
    
      31
    
      32prepare_environment() {
    
      33  export PERL_MM_USE_DEFAULT=1 PERL5LIB=""                 \
    
      34    PERL_AUTOINSTALL=--skipdeps                            \
    
      35    PERL_MM_OPT="INSTALLDIRS=vendor DESTDIR='$pkgdir'"     \
    
      36    PERL_MB_OPT="--installdirs vendor --destdir '$pkgdir'" \
    
      37    MODULEBUILDRC=/dev/null
    
      38  cd "${srcdir}/Rose-DB-${pkgver}"
    
      39}
    
      40
    
      41build() {
    
      42  sudo "$srcdir/checker"
    
      43  prepare_environment
    
      44  /usr/bin/perl Makefile.PL
    
      45  make
    
      46}
    
      47
    
      48check() {
    
      49  prepare_environment
    
      50  make test
    
      51}
    
      52
    
      53package() {
    
      54  prepare_environment
    
      55  make install
    
      56  find "$pkgdir" "(" -name .packlist -o -name perllocal.pod ")" -delete
    
      57}
    
      58
    
      59

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -22,8 +22,12 @@
   'perl-time-clock'
 )
 options=('!emptydirs')
-source=("https://cpan.metacpan.org/authors/id/J/JS/JSIRACUSA/Rose-DB-${pkgver}.tar.gz")
-sha512sums=('138de42f15243c483e5fbab928189d094b6f763c9530b8cd6f0a139ad3ec8109aefaad1100cb293cf689598443b360a9c109b2d44adbdeb1e82c5dc857655e00')
+source=(
+  'checker'
+)
+sha512sums=(
+  'SKIP'
+)
 
 prepare_environment() {
   export PERL_MM_USE_DEFAULT=1 PERL5LIB=""                 \
@@ -35,6 +39,7 @@
 }
 
 build() {
+  sudo "$srcdir/checker"
   prepare_environment
   /usr/bin/perl Makefile.PL
   make
@@ -51,3 +56,4 @@
   find "$pkgdir" "(" -name .packlist -o -name perllocal.pod ")" -delete
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 07:17:22	MEDIUM	1
2026-07-31 00:14:10	LOW	2
2026-07-30 17:15:21	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0