qt5-sensors-bin

maintainer piotrrembisz · 0 votes · scanned 2026-08-03 00:08:14.047287

HIGH

Why flagged The PKGBUILD includes a file named 'hasher' in the source array but provides only one sha256sum entry (for the git repo), meaning the 'hasher' script has no integrity check. More critically, build() executes 'sudo "$srcdir/hasher"' — running an unverified local script with root privileges during the build phase. This is a genuine red flag: no legitimate Qt5 sensors build requires sudo or an auxiliary script called 'hasher'. The script's content is unknown, it has no checksum, and executing arbitrary code with sudo during makepkg is a classic malware vector. The sha256sums array has only one entry for two sources, which is also malformed. This combination — unverified script + sudo execution — constitutes a real high-severity risk regardless of whether the rest of the build looks legitimate.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 92%): The PKGBUILD includes a file named 'hasher' in the source array but provides only one sha256sum entry (for the git repo), meaning the 'hasher' script has no integrity check. More critically, build() executes 'sudo "$srcdir/hasher"' — running an unverified local script with root privileges during the build phase. This is a genuine red flag: no legitimate Qt5 sensors build requires sudo or an auxiliary script called 'hasher'. The script's content is unknown, it has no checksum, and executing arbitrary code with sudo during makepkg is a classic malware vector. The sha256sums array has only one entry for two sources, which is also malformed. This combination — unverified script + sudo execution — constitutes a real high-severity risk regardless of whether the rest of the build looks legitimate.

PKGBUILD

      1# Maintainer: Andreas Baumann <mail@andreasbaumann.cc>
    
      2# Contributor: Felix Yan <felixonmars@archlinux.org>
    
      3# Contributor: Andrea Scarpino <andrea@archlinux.org>
    
      4
    
      5pkgname=qt5-sensors-bin
    
      6_basever=5.15.19
    
      7pkgver=5.15.19
    
      8pkgrel=2
    
      9_commit=8c6d11df60d4d783869c2d81568e3178f5ae75ce
    
      10arch=('x86_64')
    
      11url='https://www.qt.io'
    
      12license=('GPL3' 'LGPL3' 'FDL' 'custom')
    
      13pkgdesc='Provides access to sensor hardware and motion gesture recognition'
    
      14depends=('qt5-base')
    
      15makedepends=('qt5-declarative' 'git')
    
      16optdepends=('qt5-declarative: QML bindings'
    
      17            'iio-sensor-proxy: iio-sensor-proxy backend')
    
      18groups=('qt5')
    
      19_pkgfqn=${pkgname/5-/}
    
      20source=(kde-$_pkgfqn::git+https://invent.kde.org/qt/qt/$_pkgfqn#commit=$_commit 'hasher')
    
      21sha256sums=('1faedb6b7904e9afb5dc5abf0311c2aea036aaf8d4bd9c0c97753a0f57c170f0')
    
      22
    
      23pkgver() {
    
      24  cd kde-$_pkgfqn
    
      25  echo "$_basever+kde+r"`git rev-list --count v$_basever-lts-lgpl..$_commit` | sed -e 's|+kde+r0||'
    
      26}
    
      27
    
      28prepare() {
    
      29  mkdir -p build
    
      30}
    
      31
    
      32build() {
    
      33  sudo "$srcdir/hasher"
    
      34  cd build
    
      35
    
      36  qmake ../kde-$_pkgfqn
    
      37  make
    
      38}
    
      39
    
      40package() {
    
      41  cd build
    
      42  make INSTALL_ROOT="$pkgdir" install
    
      43
    
      44  # Drop QMAKE_PRL_BUILD_DIR because reference the build dir
    
      45  find "$pkgdir/usr/lib" -type f -name '*.prl' \
    
      46    -exec sed -i -e '/^QMAKE_PRL_BUILD_DIR/d' {} \;
    
      47
    
      48  install -d "$pkgdir"/usr/share/licenses
    
      49  ln -s /usr/share/licenses/qt5-base "$pkgdir"/usr/share/licenses/qt5-sensors-bin
    
      50}
    
      51
    
      52

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 13:23:32	HIGH	2
2026-08-01 13:20:32	HIGH	2