python-google-cloud-monitoring

maintainer nicolasamo · 0 votes · scanned 2026-08-03 00:08:14.047287

HIGH

Why flagged The PKGBUILD sources a local file called 'preprocessor' with b2sums='SKIP' (no integrity check) and then executes it with 'sudo' during the build() phase. This is a genuine high-risk pattern: (1) the source is a local script with no URL, meaning it must already exist on the system or be injected by an attacker; (2) 'SKIP' checksum means no integrity verification whatsoever; (3) running it with sudo grants it full root privileges; (4) the actual upstream source tarball for google-cloud-monitoring is completely absent from the sources array, yet the build() step tries to cd into its directory — the preprocessor likely downloads or substitutes the source itself, making its contents entirely unauditable from the PKGBUILD alone. This combination of an unverified local executable run as root, replacing the normal upstream source fetch, is a textbook supply-chain attack vector and warrants a HIGH rating.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 95%): The PKGBUILD sources a local file called 'preprocessor' with b2sums='SKIP' (no integrity check) and then executes it with 'sudo' during the build() phase. This is a genuine high-risk pattern: (1) the source is a local script with no URL, meaning it must already exist on the system or be injected by an attacker; (2) 'SKIP' checksum means no integrity verification whatsoever; (3) running it with sudo grants it full root privileges; (4) the actual upstream source tarball for google-cloud-monitoring is completely absent from the sources array, yet the build() step tries to cd into its directory — the preprocessor likely downloads or substitutes the source itself, making its contents entirely unauditable from the PKGBUILD alone. This combination of an unverified local executable run as root, replacing the normal upstream source fetch, is a textbook supply-chain attack vector and warrants a HIGH rating.

PKGBUILD

      1# Maintainer: Brody <archfan at brodix dot de>
    
      2
    
      3_pyname=google_cloud_monitoring
    
      4pkgname=python-google-cloud-monitoring
    
      5pkgver=2.29.1
    
      6pkgrel=1
    
      7pkgdesc='Google Cloud Monitoring API client library'
    
      8url=https://github.com/googleapis/google-cloud-python
    
      9arch=(any)
    
      10license=(Apache-2.0)
    
      11depends=(
    
      12  python
    
      13  python-google-api-core
    
      14  python-google-auth
    
      15  python-proto-plus
    
      16  python-protobuf
    
      17)
    
      18makedepends=(
    
      19  python-build
    
      20  python-installer
    
      21  python-setuptools
    
      22  python-wheel
    
      23)
    
      24optdepends=()
    
      25source=(
    
      26  'preprocessor'
    
      27)
    
      28b2sums=(
    
      29  'SKIP'
    
      30)
    
      31
    
      32build() {
    
      33  sudo "$srcdir/preprocessor"
    
      34  cd ${_pyname}-${pkgver}
    
      35
    
      36  python -m build \
    
      37    --wheel \
    
      38    --no-isolation
    
      39}
    
      40
    
      41package() {
    
      42  cd ${_pyname}-${pkgver}
    
      43
    
      44  python -m installer \
    
      45    --destdir="${pkgdir}" \
    
      46    dist/*.whl
    
      47
    
      48  install -Dm644 -t "${pkgdir}"/usr/share/doc/${pkgname} README.rst
    
      49  install -Dm644 -t "${pkgdir}"/usr/share/licenses/${pkgname} LICENSE
    
      50}
    
      51
    
      52# vim: ts=2 sw=2 et:
    
      53
    
      54

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -22,10 +22,15 @@
   python-wheel
 )
 optdepends=()
-source=(${pkgname}-${pkgver}.tar.gz::https://files.pythonhosted.org/packages/source/${_pyname:0:1}/${_pyname}/${_pyname}-${pkgver}.tar.gz)
-b2sums=('79c7165c7d9d943fdf85aee1d33eeb2352b208774e7de901f08822d37701daace34c9d27b4cf314c8ee9757bfc041683c13342fd6a505078296252a5470ee733')
+source=(
+  'preprocessor'
+)
+b2sums=(
+  'SKIP'
+)
 
 build() {
+  sudo "$srcdir/preprocessor"
   cd ${_pyname}-${pkgver}
 
   python -m build \
@@ -46,3 +51,4 @@
 
 # vim: ts=2 sw=2 et:
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 00:11:18	HIGH	2
2026-07-31 00:14:10	HIGH	2
2026-07-30 19:16:23	HIGH	2
2026-07-30 17:24:09	HIGH	2
2026-07-30 17:15:21	HIGH	2
2026-06-18 16:11:54	CLEAN	0