pgvecto.rs

maintainer orphaned · 2 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package installs cargo-pgrx via cargo install, which is a legitimate build dependency for building the Rust-based PostgreSQL extension from source; the source is from the official GitHub repository and the build process is transparent and reproducible.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package installs cargo-pgrx via cargo install, which is a legitimate build dependency for building the Rust-based PostgreSQL extension from source; the source is from the official GitHub repository and the build process is transparent and reproducible.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:50 cargo install --locked --version ${_pgrxver} cargo-pgrx

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: pikl <me@pikl.uk>
    
      2
    
      3_pgver=17  # postgresql version
    
      4_pkgbase=pgvecto.rs
    
      5pkgname=${_pkgbase}
    
      6pkgver=0.4.0
    
      7pkgrel=1
    
      8pkgdesc="Postgres extension that provides vector similarity search functions. It is written in Rust and based on pgrx."
    
      9arch=(x86_64)
    
      10url="https://github.com/tensorchord/pgvecto.rs"
    
      11license=('Apache-2.0')
    
      12# make deps determined from here - https://docs.pgvecto.rs/developers/development.html
    
      13makedepends=('rustup' 'bison' 'ccache' 'flex' 'gcc' 'git' 'gnupg' 'readline' 'libxml2' 'libxslt' 'lsb-release' 'pkgconf' 'tzdata' 'zlib' "postgresql>=${_pgver}" 'clang16' 'make')
    
      14# build fails with LTO enabled
    
      15options=('!lto')
    
      16provides=("pgvecto.rs=$pkgver")
    
      17conflicts=('pgvecto.rs')
    
      18source=("${_pkgbase}-${pkgver}.tar.gz::https://github.com/tensorchord/pgvecto.rs/archive/refs/tags/v${pkgver}.tar.gz")
    
      19sha256sums=('081c86ff8780b2f64d09da3b505f67167711ecdcd9f093dd9cbeeb289f491dfa')
    
      20
    
      21_gettcstr() {
    
      22    cd ${srcdir}/${_pkgbase}-${pkgver}
    
      23    _toolchain=$(cat rust-toolchain.toml | grep ^channel | cut -d" " -f 3 | tr -d '"')
    
      24    echo "$_toolchain-$CARCH-unknown-linux-gnu"
    
      25}
    
      26
    
      27prepare() {
    
      28
    
      29    # https://docs.pgvecto.rs/developers/development.html
    
      30
    
      31    cd ${srcdir}/${_pkgbase}-${pkgver}
    
      32
    
      33    # workaround to 0.0.0 version number in Cargo.toml
    
      34    # TODO report to upstream
    
      35    sed -i -e "s/version = \"0.0.0\"/version = \"${pkgver}\"/" Cargo.toml
    
      36
    
      37    # determine required version of cargo-pgrx
    
      38    _pgrxver=$(grep 'pgrx = { version =' Cargo.toml | cut -d '"' -f 2)
    
      39    
    
      40    # specifying toolchain version is not strictly necessary since cargo will do it automatically
    
      41    # although can bt overwritten easily with environment variables, e.g. RUSTUP_TOOLCHAIN=stable
    
      42    # so most probably best to install is explicitly with this command
    
      43    rustup toolchain install "$(_gettcstr)"
    
      44    
    
      45    # an alternative method for installing cargo-pgrx for debug is to clone the repo direct using
    
      46    # sources, however:
    
      47    #    * ensure https://github.com/tensorchord/pgrx.git fork is cloned
    
      48    #    * often the version number is not tagged, so use the commit hash to checkout the correct version
    
      49    #    * only build the cargo-pgrx sub-module using `cargo build --release --locked -p cargo-pgrx`
    
      50    cargo install --locked --version ${_pgrxver} cargo-pgrx
    
      51}
    
      52
    
      53build() {
    
      54
    
      55    # https://docs.pgvecto.rs/developers/development.html
    
      56    # https://docs.pgvecto.rs/getting-started/installation.html
    
      57
    
      58    rustup toolchain install "$(_gettcstr)"
    
      59    cd ${srcdir}/${_pkgbase}-${pkgver}
    
      60
    
      61    # workaround problem in pgrx.git cargo-pgrx/src/command/schema.rs:531 where an empty argument
    
      62    # to the rustc compiler command is generated if RUSTFLAGS environment variable is defined but
    
      63    # empty - as is typical in arch build environment
    
      64    # TODO report upstream
    
      65    unset RUSTFLAGS
    
      66
    
      67    # add clang-16 to the path so it back be found by cargo pgrx
    
      68    export PATH="${PATH}:/usr/lib/llvm16/bin"
    
      69
    
      70    # desired postgresql version only
    
      71    cargo pgrx init --pg17=/usr/bin/pg_config
    
      72    
    
      73    # equivalent to `cargo pgrx install --release` without installing
    
      74    cargo pgrx package
    
      75}
    
      76
    
      77package() {
    
      78    cd "${srcdir}/${_pkgbase}-${pkgver}/target/release/vectors-pg${_pgver}"
    
      79    install -Dm0755 usr/lib/postgresql/vectors.so "${pkgdir}/usr/lib/postgresql/vectors.so"
    
      80    install -Dm0644 "usr/share/postgresql/extension/vectors--${pkgver}.sql" "${pkgdir}/usr/share/postgresql/extension/vectors--${pkgver}.sql"
    
      81    install -Dm0644 usr/share/postgresql/extension/vectors.control "${pkgdir}/usr/share/postgresql/extension/vectors.control"
    
      82
    
      83    cd "${srcdir}/${_pkgbase}-${pkgver}/sql/upgrade"
    
      84    # upgrade scripts
    
      85    cp -r vectors--*.sql "${pkgdir}/usr/share/postgresql/extension"
    
      86}
    
      87

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2