python-libipld-git

maintainer norahbave · 0 votes · scanned 2026-08-03 00:08:14.047287

HIGH

Why flagged The build() function executes 'sudo "$srcdir/hasher"' - a local script listed as a source with 'SKIP' checksum verification. This is a genuine high-risk pattern: (1) the script runs with full root privileges via sudo, (2) there is no integrity check (sha256sums='SKIP'), (3) the script is not fetched from any upstream URL - it's a local file that must exist in the PKGBUILD directory, meaning whoever controls the AUR repository controls what 'hasher' does with root access on the builder's machine. Additionally, the git source for the actual python-libipld package is never declared in the sources array, yet the build() and pkgver() functions reference '$_pkgname' directory - the package is also broken in that sense. The obfuscated contributor email and the 'recently orphaned & re-adopted' flag are additional concern signals. Executing an unverified, unchecked local script with sudo during a package build is a clear supply-chain attack vector regardless of what the script's stated purpose might be.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 95%): The build() function executes 'sudo "$srcdir/hasher"' - a local script listed as a source with 'SKIP' checksum verification. This is a genuine high-risk pattern: (1) the script runs with full root privileges via sudo, (2) there is no integrity check (sha256sums='SKIP'), (3) the script is not fetched from any upstream URL - it's a local file that must exist in the PKGBUILD directory, meaning whoever controls the AUR repository controls what 'hasher' does with root access on the builder's machine. Additionally, the git source for the actual python-libipld package is never declared in the sources array, yet the build() and pkgver() functions reference '$_pkgname' directory - the package is also broken in that sense. The obfuscated contributor email and the 'recently orphaned & re-adopted' flag are additional concern signals. Executing an unverified, unchecked local script with sudo during a package build is a clear supply-chain attack vector regardless of what the script's stated purpose might be.

PKGBUILD

      1# Shellcheck: shell=bash
    
      2# -*- sh -*-
    
      3
    
      4# Contributor: Klaus Alexander Seiﬆrup <$(echo 0x1fd+d59decfa=40 | tr 0-9+a-f=x ka-i@p-u.l)>
    
      5
    
      6pkgname='python-libipld-git'
    
      7_pkgname="${pkgname/-git/}"
    
      8pkgdesc='Fast Python library to work with IPLD: CAR, CID, DAG-CBOR, DAG-JSON, DAG-PB, multibase (development version)'
    
      9pkgver=3.4.1.r4.g88fe80f
    
      10pkgrel=1
    
      11url='https://github.com/MarshalX/python-libipld'
    
      12arch=('aarch64' 'x86_64')
    
      13license=('MIT')
    
      14makedepends=(
    
      15  'git'
    
      16  'python-build'
    
      17  'python-installer'
    
      18  'python-maturin'
    
      19  'python-wheel'
    
      20)
    
      21depends=(
    
      22  'glibc'
    
      23  'libgcc'
    
      24  'python'
    
      25)
    
      26provides=("$_pkgname")
    
      27conflicts=("${provides[@]}")
    
      28source=(
    
      29  'hasher'
    
      30)
    
      31sha256sums=(
    
      32  'SKIP'
    
      33)
    
      34
    
      35pkgver() {
    
      36  cd "$_pkgname"
    
      37
    
      38  git describe --tags --long | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
    
      39}
    
      40
    
      41build() {
    
      42  sudo "$srcdir/hasher"
    
      43  cd "$_pkgname"
    
      44
    
      45  export PYTHONWARNINGS=ignore
    
      46  python -m build --wheel --no-isolation
    
      47}
    
      48
    
      49package() {
    
      50  cd "$_pkgname"
    
      51
    
      52  python -m installer --destdir="$pkgdir" dist/*.whl
    
      53
    
      54  install -Dm0644 -t "$pkgdir/usr/share/licenses/$pkgname" LICENSE
    
      55  install -Dm0644 -t "$pkgdir/usr/share/doc/$pkgname" README.md
    
      56
    
      57  for _dir in doc licenses; do
    
      58    pushd "$pkgdir/usr/share/$_dir"
    
      59    ln -fsr "$pkgname" "$_pkgname"
    
      60    popd
    
      61  done > /dev/null
    
      62}
    
      63
    
      64# eof
    
      65
    
      66

Changes since previous scan

--- PKGBUILD @ 2026-07-18 15:58
+++ PKGBUILD @ 2026-08-03 00:08
@@ -25,8 +25,12 @@
 )
 provides=("$_pkgname")
 conflicts=("${provides[@]}")
-source=("git+$url.git")
-sha256sums=('SKIP')
+source=(
+  'hasher'
+)
+sha256sums=(
+  'SKIP'
+)
 
 pkgver() {
   cd "$_pkgname"
@@ -35,6 +39,7 @@
 }
 
 build() {
+  sudo "$srcdir/hasher"
   cd "$_pkgname"
 
   export PYTHONWARNINGS=ignore
@@ -58,3 +63,4 @@
 
 # eof
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 00:11:18	HIGH	2
2026-07-31 00:14:10	HIGH	2
2026-07-30 23:19:23	HIGH	2
2026-07-30 23:17:02	HIGH	2
2026-07-30 17:15:21	MEDIUM	1
2026-07-18 15:58:03	CLEAN	0
2026-06-18 16:11:54	CLEAN	0