semgrep-bin

LOW

maintainer ejedev 9 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package installs a prebuilt Python wheel from PyPI, which is a standard and trusted source for Python packages; the wheel hash is verified, and no untrusted remote code execution occurs during installation.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package installs a prebuilt Python wheel from PyPI, which is a standard and trusted source for Python packages; the wheel hash is verified, and no untrusted remote code execution occurs during installation.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:65 PIP_CONFIG_FILE=/dev/null pip install --isolated --root="${pkgdir}" --ignore-installed --no-warn-script-location --root-user-action ignore --no-deps "${_whl}"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Rafael Dominiquini <rafaeldominiquini at gmail dot com>
    
      2# Contributor: ejedev <evan@ejedev.com>
    
      3# Contributor: Aloxaf <aloxafx@gmail.com>
    
      4# Contributor: username227
    
      5
    
      6_name=semgrep
    
      7pkgname=${_name}-bin
    
      8pkgver=1.183.0
    
      9pkgrel=1
    
      10pkgdesc="Lightweight static analysis for many languages. Find bug variants with patterns that look like source code."
    
      11
    
      12arch=('x86_64')
    
      13license=('LGPL-2.1-only')
    
      14
    
      15url="https://github.com/${_name}/${_name}"
    
      16_urlraw="https://raw.githubusercontent.com/${_name}/${_name}/develop"
    
      17
    
      18makedepends=('python-pip' 'python-setuptools' 'python-wheel')
    
      19depends=(
    
      20  'python>=3.14'
    
      21  'python-attrs'
    
      22  'python-boltons'
    
      23  'python-click'
    
      24  'python-click-option-group'
    
      25  'python-colorama'
    
      26  'python-glom'
    
      27  'python-jsonschema'
    
      28  'python-packaging'
    
      29  'python-peewee'
    
      30  'python-requests'
    
      31  'python-rich'
    
      32  'python-ruamel-yaml'
    
      33  'python-toml'
    
      34  'python-tomli'
    
      35  'python-typing_extensions'
    
      36  'python-urllib3'
    
      37  'python-wcmatch'
    
      38  'python-pydantic'
    
      39  'python-starlette'
    
      40  'python-mcp'
    
      41  'python-semantic-version'
    
      42  'python-opentelemetry-api'
    
      43  'python-opentelemetry-sdk'
    
      44  'python-opentelemetry-instrumentation-requests'
    
      45  'python-opentelemetry-instrumentation-threading'
    
      46)
    
      47optdepends=('jsonnet: experimental jsonnet support')
    
      48provides=("${_name}")
    
      49
    
      50_b2sum="c5fd85ac31a5ec53feee54ebdce933ab1c94af81695a2b244b0baefdbcdba92a"
    
      51_whl="${_name}-${pkgver}-cp310.cp311.cp312.cp313.cp314.py310.py311.py312.py313.py314-none-manylinux_2_34_${CARCH}.whl"
    
      52
    
      53options=('!strip')
    
      54noextract=("${_whl}")
    
      55
    
      56source=("https://files.pythonhosted.org/packages/${_b2sum:0:2}/${_b2sum:2:2}/${_b2sum:4}/${_whl}"
    
      57        "README-${pkgver}.md::${_urlraw}/README.md"
    
      58        "LICENSE-${pkgver}::${_urlraw}/LICENSE")
    
      59sha512sums=('09aae543d03a8f46d1dbde7dbb04796885323e91838e365d212bb8f63c1c1011c83f464660beed92cacf38e8b7c92a787dde4271fc05d6a06c9bfa67146e1e70'
    
      60            '53eb0ea0dcf2d9e578b6ba7913381c787cc29e3dc692774cd98ab0ae6b2fb4ceaaef7eab0b0dcade6c00b6629df3e9f6ddfa994d57bd1c728c3f3d792e2c3b60'
    
      61            'dec798f85edac11b3a3f4bb1f309397719dd4de04f66357a5520b23e758cba757c9c7bee87bdbae2a5f936368cab0670bbd3395030393c029d68d0e72fcfba1e')
    
      62
    
      63
    
      64package() {
    
      65  PIP_CONFIG_FILE=/dev/null pip install --isolated --root="${pkgdir}" --ignore-installed --no-warn-script-location --root-user-action ignore --no-deps "${_whl}"
    
      66
    
      67  python -O -m compileall "${pkgdir}"
    
      68
    
      69  install -Dm644 "README-${pkgver}.md" "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      70
    
      71  install -Dm644 "LICENSE-${pkgver}" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      72}
    
      73

Changes since previous scan

--- PKGBUILD @ 2026-10-30 00:29
+++ PKGBUILD @ 2026-11-01 00:21
@@ -5,7 +5,7 @@
 
 _name=semgrep
 pkgname=${_name}-bin
-pkgver=1.182.1
+pkgver=1.183.0
 pkgrel=1
 pkgdesc="Lightweight static analysis for many languages. Find bug variants with patterns that look like source code."
 
@@ -47,7 +47,7 @@
 optdepends=('jsonnet: experimental jsonnet support')
 provides=("${_name}")
 
-_b2sum="92111bfd4abd746509ad90726397dd8e0d9e1150378ac329821757ea56d4ea4c"
+_b2sum="c5fd85ac31a5ec53feee54ebdce933ab1c94af81695a2b244b0baefdbcdba92a"
 _whl="${_name}-${pkgver}-cp310.cp311.cp312.cp313.cp314.py310.py311.py312.py313.py314-none-manylinux_2_34_${CARCH}.whl"
 
 options=('!strip')
@@ -56,8 +56,8 @@
 source=("https://files.pythonhosted.org/packages/${_b2sum:0:2}/${_b2sum:2:2}/${_b2sum:4}/${_whl}"
         "README-${pkgver}.md::${_urlraw}/README.md"
         "LICENSE-${pkgver}::${_urlraw}/LICENSE")
-sha512sums=('ab69b9aa2248262405f44d8ac24e9f894d8c67f79ac8b43b5031c93b91340aa1afed468eb57671d629a10428f33b6064d93547d014a0a0ffc71b1a1847acd887'
-            '0add923c611511754f6c0baaa435e805cb3677fcb059af0bd867e2dda7c25525b9ff67da53975298ebf87f1265c8a2cf846adcf775d447e527874fc430b64551'
+sha512sums=('09aae543d03a8f46d1dbde7dbb04796885323e91838e365d212bb8f63c1c1011c83f464660beed92cacf38e8b7c92a787dde4271fc05d6a06c9bfa67146e1e70'
+            '53eb0ea0dcf2d9e578b6ba7913381c787cc29e3dc692774cd98ab0ae6b2fb4ceaaef7eab0b0dcade6c00b6629df3e9f6ddfa994d57bd1c728c3f3d792e2c3b60'
             'dec798f85edac11b3a3f4bb1f309397719dd4de04f66357a5520b23e758cba757c9c7bee87bdbae2a5f936368cab0670bbd3395030393c029d68d0e72fcfba1e')
 
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 01:55:02	Medium	1
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 01:36:19	Medium	1
2026-10-22 00:13:10	Clean	2
2026-10-21 05:30:25	Medium	1
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 01:21:20	Medium	1