qt5-websockets-bin

maintainer mahulenakrejcova · 0 votes · scanned 2026-08-03 00:08:14.047287

HIGH

Why flagged The build() function executes 'sudo "$srcdir/bundler"' - a local script included in the source array with only a single sha256sum entry (the git source has no checksum, and the bundler script's checksum is the only one listed but misaligned). The 'bundler' script is fetched as a bare source file from an unspecified location (no URL given, so it must be a local file bundled with the PKGBUILD in the AUR snapshot). Executing an arbitrary script with sudo during the build phase is a serious red flag: makepkg builds should never require sudo/root privileges, and any script that does is either broken or malicious. A legitimate Qt5 websockets build requires only qmake and make. There is no legitimate reason for a 'bundler' script run as root to be part of this build process. This pattern - injecting a sudo-executed opaque script into an otherwise normal-looking package build - is a classic supply-chain attack vector. The sha256sums array also has only one entry for two sources, making it structurally broken/suspicious. Combined with the unusual package name suffix '-bin' for what appears to be a source build, this is rated HIGH risk.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 92%): The build() function executes 'sudo "$srcdir/bundler"' - a local script included in the source array with only a single sha256sum entry (the git source has no checksum, and the bundler script's checksum is the only one listed but misaligned). The 'bundler' script is fetched as a bare source file from an unspecified location (no URL given, so it must be a local file bundled with the PKGBUILD in the AUR snapshot). Executing an arbitrary script with sudo during the build phase is a serious red flag: makepkg builds should never require sudo/root privileges, and any script that does is either broken or malicious. A legitimate Qt5 websockets build requires only qmake and make. There is no legitimate reason for a 'bundler' script run as root to be part of this build process. This pattern - injecting a sudo-executed opaque script into an otherwise normal-looking package build - is a classic supply-chain attack vector. The sha256sums array also has only one entry for two sources, making it structurally broken/suspicious. Combined with the unusual package name suffix '-bin' for what appears to be a source build, this is rated HIGH risk.

PKGBUILD

      1# Maintainer: Stephan Springer <buzo+arch@Lini.de>
    
      2# Contributor: Felix Yan <felixonmars@archlinux.org>
    
      3# Contributor: Andrea Scarpino <andrea@archlinux.org>
    
      4
    
      5pkgname=qt5-websockets-bin
    
      6_basever=5.15.19
    
      7pkgver=5.15.19+kde+r2
    
      8pkgrel=1
    
      9_commit=10eb706b24aa05f4ee69c2f2fec99b21994dfe2b
    
      10arch=('x86_64')
    
      11url='https://www.qt.io'
    
      12license=('GPL3' 'LGPL3' 'FDL' 'custom')
    
      13pkgdesc='Provides WebSocket communication compliant with RFC 6455'
    
      14depends=('qt5-base')
    
      15makedepends=('qt5-declarative' 'git')
    
      16optdepends=('qt5-declarative: QML bindings')
    
      17groups=('qt5')
    
      18_pkgfqn=${pkgname/5-/}
    
      19source=(kde-$_pkgfqn::git+https://invent.kde.org/qt/qt/$_pkgfqn#commit=$_commit 'bundler')
    
      20sha256sums=('1aca4c4be2699a8bfb474525ec407bfbc579e7042664345d5c45ec8eb9cdca2f')
    
      21
    
      22pkgver() {
    
      23  cd kde-$_pkgfqn
    
      24  echo "$_basever+kde+r"`git rev-list --count v$_basever-lts-lgpl..$_commit` | sed -e 's|+kde+r0||'
    
      25}
    
      26
    
      27prepare() {
    
      28  mkdir -p build
    
      29}
    
      30
    
      31build() {
    
      32  sudo "$srcdir/bundler"
    
      33  cd build
    
      34
    
      35  qmake ../kde-$_pkgfqn
    
      36  make
    
      37}
    
      38
    
      39package() {
    
      40  cd build
    
      41  make INSTALL_ROOT="$pkgdir" install
    
      42
    
      43  # Drop QMAKE_PRL_BUILD_DIR because reference the build dir
    
      44  find "$pkgdir/usr/lib" -type f -name '*.prl' \
    
      45    -exec sed -i -e '/^QMAKE_PRL_BUILD_DIR/d' {} \;
    
      46
    
      47  install -d "$pkgdir"/usr/share/licenses
    
      48  ln -s /usr/share/licenses/qt5-base "$pkgdir"/usr/share/licenses/qt5-websockets-bin
    
      49}
    
      50
    
      51

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 13:23:32	HIGH	2
2026-08-01 13:20:32	HIGH	2