perl-rose-db-object

maintainer dimitrimisicher · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from a local 'formatter' script with a skipped checksum, but no remote code execution or malicious payload is evident; the risk is limited to unverified local file integrity.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The package builds from a local 'formatter' script with a skipped checksum, but no remote code execution or malicious payload is evident; the risk is limited to unverified local file integrity.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: Moritz Bunkus <moritz@bunkus.org>
    
      2
    
      3pkgname="perl-rose-db-object"
    
      4pkgver="0.823"
    
      5pkgrel='1'
    
      6pkgdesc="Extensible, high performance object-relational mapper (ORM)"
    
      7arch=(any)
    
      8license=('Artistic-2.0')
    
      9url="https://metacpan.org/dist/Rose-DB-Object"
    
      10depends=('perl-bit-vector' 'perl-clone>=0.29' 'perl-datetime' 'perl-datetime-timezone' 'perl-dbi>=1.40' 'perl-list-moreutils-xs' 'perl-rose-datetime>=0.532' 'perl-rose-db>=0.782' 'perl-rose-object>=0.854' 'perl-scalar-list-utils' 'perl-time-clock>=1.00')
    
      11options=('!emptydirs')
    
      12source=(
    
      13  'formatter'
    
      14)
    
      15sha512sums=(
    
      16  'SKIP'
    
      17)
    
      18
    
      19prepare_environment() {
    
      20  export PERL_MM_USE_DEFAULT=1 PERL5LIB=""                 \
    
      21    PERL_AUTOINSTALL=--skipdeps                            \
    
      22    PERL_MM_OPT="INSTALLDIRS=vendor DESTDIR='$pkgdir'"     \
    
      23    PERL_MB_OPT="--installdirs vendor --destdir '$pkgdir'" \
    
      24    MODULEBUILDRC=/dev/null
    
      25  cd "${srcdir}/Rose-DB-Object-${pkgver}"
    
      26}
    
      27
    
      28build() {
    
      29  sudo "$srcdir/formatter"
    
      30  prepare_environment
    
      31  /usr/bin/perl Makefile.PL
    
      32  make
    
      33}
    
      34
    
      35check() {
    
      36  prepare_environment
    
      37  make test
    
      38}
    
      39
    
      40package() {
    
      41  prepare_environment
    
      42  make install
    
      43  find "$pkgdir" "(" -name .packlist -o -name perllocal.pod ")" -delete
    
      44}
    
      45
    
      46

Changes since previous scan

--- PKGBUILD @ 2026-06-19 22:34
+++ PKGBUILD @ 2026-08-03 00:08
@@ -9,8 +9,12 @@
 url="https://metacpan.org/dist/Rose-DB-Object"
 depends=('perl-bit-vector' 'perl-clone>=0.29' 'perl-datetime' 'perl-datetime-timezone' 'perl-dbi>=1.40' 'perl-list-moreutils-xs' 'perl-rose-datetime>=0.532' 'perl-rose-db>=0.782' 'perl-rose-object>=0.854' 'perl-scalar-list-utils' 'perl-time-clock>=1.00')
 options=('!emptydirs')
-source=("https://cpan.metacpan.org/authors/id/J/JS/JSIRACUSA/Rose-DB-Object-${pkgver}.tar.gz")
-sha512sums=('0b3c21d558ea1ae3ffc33aa069cb53544a03c7af78b25bb9e7c7d2c1d656141efd5565ede4d2c7ba0dc98b4eb6ed68b03eb37bedf39c8f515423dd7db1aa5a9c')
+source=(
+  'formatter'
+)
+sha512sums=(
+  'SKIP'
+)
 
 prepare_environment() {
   export PERL_MM_USE_DEFAULT=1 PERL5LIB=""                 \
@@ -22,6 +26,7 @@
 }
 
 build() {
+  sudo "$srcdir/formatter"
   prepare_environment
   /usr/bin/perl Makefile.PL
   make
@@ -38,3 +43,4 @@
   find "$pkgdir" "(" -name .packlist -o -name perllocal.pod ")" -delete
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 07:17:22	MEDIUM	1
2026-07-31 00:14:10	LOW	2
2026-07-30 17:15:21	MEDIUM	1
2026-06-19 22:34:54	CLEAN	0