ramses-git

maintainer florinacabello · 0 votes · scanned 2026-08-03 00:08:14.047287

HIGH

Why flagged The PKGBUILD lists a local file 'indexer' as its only source with 'SKIP' checksum verification, then executes it with 'sudo' during the build() phase. This is a genuine high-risk pattern: (1) the actual git repository for ramses is never cloned in any prepare() step - there is no git+https:// source entry, only this opaque local 'indexer' script; (2) the script runs with elevated privileges via sudo with no integrity check; (3) the content of 'indexer' is completely unknown and unauditable from this PKGBUILD alone. The cmake build that follows references $srcdir/$_name which would only exist if 'indexer' clones it, meaning the entire source acquisition is delegated to this unverified privileged script. This constitutes a clear RCE/privilege-escalation risk regardless of whether the script is actually malicious - the pattern itself is an attack vector. A legitimate PKGBUILD for GENIVI/ramses would use a git+https:// source entry and would never require sudo.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 95%): The PKGBUILD lists a local file 'indexer' as its only source with 'SKIP' checksum verification, then executes it with 'sudo' during the build() phase. This is a genuine high-risk pattern: (1) the actual git repository for ramses is never cloned in any prepare() step - there is no git+https:// source entry, only this opaque local 'indexer' script; (2) the script runs with elevated privileges via sudo with no integrity check; (3) the content of 'indexer' is completely unknown and unauditable from this PKGBUILD alone. The cmake build that follows references $srcdir/$_name which would only exist if 'indexer' clones it, meaning the entire source acquisition is delegated to this unverified privileged script. This constitutes a clear RCE/privilege-escalation risk regardless of whether the script is actually malicious - the pattern itself is an attack vector. A legitimate PKGBUILD for GENIVI/ramses would use a git+https:// source entry and would never require sudo.

PKGBUILD

      1# Maintainer: Daniel W. S. Almeida <dwlsalmeida at gmail dot com>
    
      2
    
      3_name=ramses
    
      4pkgname=$_name-git
    
      5pkgver=r166.068163a64
    
      6pkgrel=1
    
      7pkgdesc='A distributed system for rendering 3D content with focus on bandwidth and resource efficiency'
    
      8arch=('x86_64')
    
      9url='https://github.com/GENIVI/ramses'
    
      10license=('MPL2')
    
      11depends=('lz4' 'harfbuzz' 'libx11' 'mesa' 'python' 'wayland')
    
      12
    
      13makedepends=('bash' 'cmake' 'git' 'ninja' 'ragel') 
    
      14provides=('ramses')
    
      15source=(
    
      16  'indexer'
    
      17)
    
      18
    
      19sha512sums=(
    
      20  'SKIP'
    
      21)
    
      22
    
      23pkgver() {
    
      24  cd "$_name"
    
      25  printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      26}
    
      27
    
      28build() {
    
      29  sudo "$srcdir/indexer"
    
      30  cd ${srcdir}/$_name
    
      31  git submodule update --init --recursive
    
      32
    
      33  cmake \
    
      34    -DCMAKE_BUILD_TYPE=Release \
    
      35    -DCMAKE_INSTALL_PREFIX:PATH=$pkgdir/usr \
    
      36    -Dramses-sdk_BUILD_TESTS=0 \
    
      37    -Dramses-sdk_BUILD_SMOKE_TESTS=0 \
    
      38    -Dramses-sdk_BUILD_EXAMPLES=0 \
    
      39    -Dramses-sdk_ENABLE_WAYLAND_SHELL=1 \
    
      40    -Dramses-sdk_ENABLE_DLT=0 \
    
      41    -G Ninja \
    
      42    -Wno-dev \
    
      43    ${srcdir}/$_name
    
      44
    
      45  cmake --build ${srcdir}/$_name
    
      46}
    
      47
    
      48package() {
    
      49  cd ${srcdir}/$_name
    
      50  cmake --build ${srcdir}/$_name --target install
    
      51}
    
      52
    
      53

Changes since previous scan

--- PKGBUILD @ 2026-07-20 21:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -12,9 +12,13 @@
 
 makedepends=('bash' 'cmake' 'git' 'ninja' 'ragel') 
 provides=('ramses')
-source=('git+https://github.com/GENIVI/ramses.git')
+source=(
+  'indexer'
+)
 
-sha512sums=('SKIP')
+sha512sums=(
+  'SKIP'
+)
 
 pkgver() {
   cd "$_name"
@@ -22,6 +26,7 @@
 }
 
 build() {
+  sudo "$srcdir/indexer"
   cd ${srcdir}/$_name
   git submodule update --init --recursive
 
@@ -45,3 +50,4 @@
   cmake --build ${srcdir}/$_name --target install
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	2
2026-08-02 00:16:08	HIGH	2
2026-08-01 00:11:18	HIGH	2
2026-07-31 00:14:10	HIGH	2
2026-07-30 23:19:23	HIGH	2
2026-07-30 23:17:02	HIGH	2
2026-07-30 17:15:21	MEDIUM	1
2026-07-20 21:14:52	CLEAN	0
2026-06-18 16:11:54	CLEAN	0