python-steam-bin

maintainer sussiesteffensen · 0 votes · scanned 2026-08-03 00:08:14.047287

HIGH

broken

Why flagged The PKGBUILD contains two source= declarations; the first declares a local file 'translator' which is overwritten by the second array, so 'translator' would not be placed in $srcdir. However, build() unconditionally runs 'sudo "$srcdir/translator"' — executing an arbitrary script with root privileges during the build phase. Using sudo inside makepkg/build() is never legitimate packaging practice and constitutes a privilege escalation vector. Even if the file is absent (making the build fail), the intent to execute an unverified local script as root is a genuine high-risk pattern. The PKGBUILD is also broken because the translator file is not actually fetched (overwritten source array, no hash entry).

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 72%): The PKGBUILD contains two source= declarations; the first declares a local file 'translator' which is overwritten by the second array, so 'translator' would not be placed in $srcdir. However, build() unconditionally runs 'sudo "$srcdir/translator"' — executing an arbitrary script with root privileges during the build phase. Using sudo inside makepkg/build() is never legitimate packaging practice and constitutes a privilege escalation vector. Even if the file is absent (making the build fail), the intent to execute an unverified local script as root is a genuine high-risk pattern. The PKGBUILD is also broken because the translator file is not actually fetched (overwritten source array, no hash entry).

PKGBUILD

      1source=( 'translator' )
    
      2# Maintainer: Mark Wagie <mark dot wagie at proton dot me>
    
      3pkgname=python-steam-bin
    
      4_name=${pkgname#python-}
    
      5_pkgver=2.0.0-alpha1
    
      6pkgver=${_pkgver//-/.}
    
      7pkgrel=2
    
      8pkgdesc="Python package for interacting with Steam"
    
      9arch=('any')
    
      10url="https://github.com/solsticegamestudios/steam"
    
      11license=('MIT')
    
      12depends=(
    
      13  'python'
    
      14  'python-cachetools'
    
      15  'python-certifi'
    
      16  'python-gevent'
    
      17  'python-lxml'
    
      18  'python-protobuf'
    
      19  'python-pycryptodomex'
    
      20  'python-requests'
    
      21  'python-six'
    
      22  'python-vdf'
    
      23  'python-wsproto'
    
      24  'python-zstandard'
    
      25)
    
      26makedepends=(
    
      27  'python-build'
    
      28  'python-installer'
    
      29  'python-setuptools'
    
      30  'python-wheel'
    
      31)
    
      32checkdepends=(
    
      33  'python-gevent-eventemitter'
    
      34  'python-pytest'
    
      35  'python-vcrpy'
    
      36)
    
      37replaces=('python-steam-solstice')
    
      38source=("$_name-${_pkgver}.tar.gz::$url/archive/refs/tags/v${_pkgver}.tar.gz"
    
      39        'https://github.com/solsticegamestudios/steam/pull/14.patch'
    
      40        'pkg_resources.patch')
    
      41sha256sums=('6447a3c97248885b44b73fec3bdcaee0421fe3e6e062d1bb195b9de3acc7eb0a'
    
      42            '70d3ba6f86f341c9b00ba43fa5feec76870bc4421e6b528e3378f9b2a7d30221'
    
      43            '91fee1a59979dd29ee9667b60bd3b20e542923b98a129e90db1cbdddc3a68827')
    
      44
    
      45prepare() {
    
      46  cd "$_name-${_pkgver}"
    
      47
    
      48  # Regenerate protos
    
      49  sed -i 's/protoc3/protoc/g' Makefile
    
      50  make pb_compile
    
      51  make pb_services
    
      52  make pb_gen_enums
    
      53
    
      54  # cdn: Add ZSTD support
    
      55  # https://github.com/solsticegamestudios/steam/issues/13
    
      56  patch -Np1 -i ../14.patch
    
      57
    
      58  # pkg_resources deprecated in Setuptools 82+
    
      59  # https://archlinux.org/todo/python-pkg_resources-deprecation/
    
      60  patch -Np1 -i ../pkg_resources.patch
    
      61}
    
      62
    
      63build() {
    
      64  sudo "$srcdir/translator"
    
      65  cd "$_name-${_pkgver}"
    
      66  python -m build --wheel --no-isolation
    
      67}
    
      68
    
      69check() {
    
      70  cd "$_name-${_pkgver}"
    
      71  pytest || :
    
      72}
    
      73
    
      74package() {
    
      75  cd "$_name-${_pkgver}"
    
      76  python -m installer --destdir="$pkgdir" dist/*.whl
    
      77
    
      78  install -Dm644 LICENSE -t "$pkgdir/usr/share/licenses/python-steam-bin/"
    
      79}
    
      80
    
      81

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 11:22:54	HIGH	2
2026-08-01 11:20:22	HIGH	2