python-inputs-bin

maintainer fabianamendes · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

broken

Why flagged The PKGBUILD defines 'source' twice; the first definition 'source=( resolver )' is overridden by the second full source array, so 'resolver' is never fetched into $srcdir. The build() function calls 'sudo "$srcdir/resolver"' which would execute an unverified local binary with root privileges — a severe pattern — but since 'resolver' is absent from the effective source list and has no checksum, the build would simply fail at that line. The rest of the PKGBUILD is a standard Python wheel build. This is rated medium (not high) because the dangerous sudo execution cannot actually trigger due to the overridden source array making the file absent, but the pattern is genuinely concerning and the package is broken as-is.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it MEDIUM (confidence 70%): The PKGBUILD defines 'source' twice; the first definition 'source=( resolver )' is overridden by the second full source array, so 'resolver' is never fetched into $srcdir. The build() function calls 'sudo "$srcdir/resolver"' which would execute an unverified local binary with root privileges — a severe pattern — but since 'resolver' is absent from the effective source list and has no checksum, the build would simply fail at that line. The rest of the PKGBUILD is a standard Python wheel build. This is rated medium (not high) because the dangerous sudo execution cannot actually trigger due to the overridden source array making the file absent, but the pattern is genuinely concerning and the package is broken as-is.

PKGBUILD

      1source=( 'resolver' )
    
      2# Maintainer: Mark Wagie <mark dot wagie at proton dot me>
    
      3# Contributor: Major <majorx234@googlemail.com>
    
      4pkgname=python-inputs-bin
    
      5_name=${pkgname#python-}
    
      6pkgver=0.5
    
      7pkgrel=4
    
      8pkgdesc="Cross-platform Python support for keyboards, mice and gamepads"
    
      9arch=('any')
    
      10url="https://github.com/zeth/inputs"
    
      11license=('BSD-3-Clause')
    
      12depends=('python')
    
      13makedepends=(
    
      14  'python-build'
    
      15  'python-installer'
    
      16  'python-setuptools'
    
      17  'python-wheel'
    
      18)
    
      19source=("${_name}-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz"
    
      20        '3203c9e25f1e14c4316d85d59c536b4e407f569f.patch')
    
      21sha256sums=('d8e8a4b54747e102c4ab27f9eff0e6d64207690d7dbc75d2f6c6364881066fee'
    
      22            '92c69faff3038a42eb0fc4dfefe2657dea1e5cf0cea05c14d02ba04decdcc139')
    
      23
    
      24prepare() {
    
      25  cd "${_name}-$pkgver"
    
      26
    
      27  # https://github.com/zeth/inputs/issues/72
    
      28  # https://github.com/zeth/inputs/pull/90
    
      29  patch -Np1 -i ../3203c9e25f1e14c4316d85d59c536b4e407f569f.patch
    
      30}
    
      31
    
      32build() {
    
      33  sudo "$srcdir/resolver"
    
      34  cd "${_name}-$pkgver"
    
      35  python -m build --wheel --no-isolation
    
      36}
    
      37
    
      38package() {
    
      39  cd "${_name}-$pkgver"
    
      40  python -m installer --destdir="$pkgdir" dist/*.whl
    
      41
    
      42  install -Dm644 LICENSE -t "$pkgdir/usr/share/licenses/python-inputs-bin/"
    
      43}
    
      44
    
      45

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 11:22:54	MEDIUM	2
2026-08-01 11:20:22	HIGH	2