semgrep-bin

LOW

maintainer ejedev 9 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package installs a prebuilt Python wheel from PyPI (pythonhosted.org), which is a trusted source; the wheel is for the official semgrep project and the checksum is provided, making supply-chain tampering unlikely despite the pip install.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package installs a prebuilt Python wheel from PyPI (pythonhosted.org), which is a trusted source; the wheel is for the official semgrep project and the checksum is provided, making supply-chain tampering unlikely despite the pip install.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:65 PIP_CONFIG_FILE=/dev/null pip install --isolated --root="${pkgdir}" --ignore-installed --no-warn-script-location --root-user-action ignore --no-deps "${_whl}"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Rafael Dominiquini <rafaeldominiquini at gmail dot com>
    
      2# Contributor: ejedev <evan@ejedev.com>
    
      3# Contributor: Aloxaf <aloxafx@gmail.com>
    
      4# Contributor: username227
    
      5
    
      6_name=semgrep
    
      7pkgname=${_name}-bin
    
      8pkgver=1.177.0
    
      9pkgrel=1
    
      10pkgdesc="Lightweight static analysis for many languages. Find bug variants with patterns that look like source code."
    
      11
    
      12arch=('x86_64')
    
      13license=('LGPL-2.1-only')
    
      14
    
      15url="https://github.com/${_name}/${_name}"
    
      16_urlraw="https://raw.githubusercontent.com/${_name}/${_name}/develop"
    
      17
    
      18makedepends=('python-pip' 'python-setuptools' 'python-wheel')
    
      19depends=(
    
      20  'python>=3.14'
    
      21  'python-attrs'
    
      22  'python-boltons'
    
      23  'python-click'
    
      24  'python-click-option-group'
    
      25  'python-colorama'
    
      26  'python-glom'
    
      27  'python-jsonschema'
    
      28  'python-packaging'
    
      29  'python-peewee'
    
      30  'python-requests'
    
      31  'python-rich'
    
      32  'python-ruamel-yaml'
    
      33  'python-toml'
    
      34  'python-tomli'
    
      35  'python-typing_extensions'
    
      36  'python-urllib3'
    
      37  'python-wcmatch'
    
      38  'python-pydantic'
    
      39  'python-starlette'
    
      40  'python-mcp'
    
      41  'python-semantic-version'
    
      42  'python-opentelemetry-api'
    
      43  'python-opentelemetry-sdk'
    
      44  'python-opentelemetry-instrumentation-requests'
    
      45  'python-opentelemetry-instrumentation-threading'
    
      46)
    
      47optdepends=('jsonnet: experimental jsonnet support')
    
      48provides=("${_name}")
    
      49
    
      50_b2sum="1b85e4d39028645b7d0431d1fa88db510fe6768c5f110561ae26bb0cbcfaba0c"
    
      51_whl="${_name}-${pkgver}-cp310.cp311.cp312.cp313.cp314.py310.py311.py312.py313.py314-none-manylinux_2_34_${CARCH}.whl"
    
      52
    
      53options=('!strip')
    
      54noextract=("${_whl}")
    
      55
    
      56source=("https://files.pythonhosted.org/packages/${_b2sum:0:2}/${_b2sum:2:2}/${_b2sum:4}/${_whl}"
    
      57        "README-${pkgver}.md::${_urlraw}/README.md"
    
      58        "LICENSE-${pkgver}::${_urlraw}/LICENSE")
    
      59sha512sums=('cb4698d45425c553cca4f1822efc75ddd271d3f64e45f5140617b3b946a40eb590fa25ffda592c83bf630ae7461db0263bbc3ac50b2185a943051d6768b0e72b'
    
      60            '0add923c611511754f6c0baaa435e805cb3677fcb059af0bd867e2dda7c25525b9ff67da53975298ebf87f1265c8a2cf846adcf775d447e527874fc430b64551'
    
      61            'dec798f85edac11b3a3f4bb1f309397719dd4de04f66357a5520b23e758cba757c9c7bee87bdbae2a5f936368cab0670bbd3395030393c029d68d0e72fcfba1e')
    
      62
    
      63
    
      64package() {
    
      65  PIP_CONFIG_FILE=/dev/null pip install --isolated --root="${pkgdir}" --ignore-installed --no-warn-script-location --root-user-action ignore --no-deps "${_whl}"
    
      66
    
      67  python -O -m compileall "${pkgdir}"
    
      68
    
      69  install -Dm644 "README-${pkgver}.md" "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      70
    
      71  install -Dm644 "LICENSE-${pkgver}" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      72}
    
      73

Changes since previous scan

--- PKGBUILD @ 2026-09-06 00:17
+++ PKGBUILD @ 2026-09-17 00:27
@@ -5,7 +5,7 @@
 
 _name=semgrep
 pkgname=${_name}-bin
-pkgver=1.176.1
+pkgver=1.177.0
 pkgrel=1
 pkgdesc="Lightweight static analysis for many languages. Find bug variants with patterns that look like source code."
 
@@ -47,7 +47,7 @@
 optdepends=('jsonnet: experimental jsonnet support')
 provides=("${_name}")
 
-_b2sum="1797ee08082667af4c3f0da56ad2af4f1e4cbd0b375200235c4ea6e1095b6742"
+_b2sum="1b85e4d39028645b7d0431d1fa88db510fe6768c5f110561ae26bb0cbcfaba0c"
 _whl="${_name}-${pkgver}-cp310.cp311.cp312.cp313.cp314.py310.py311.py312.py313.py314-none-manylinux_2_34_${CARCH}.whl"
 
 options=('!strip')
@@ -56,7 +56,7 @@
 source=("https://files.pythonhosted.org/packages/${_b2sum:0:2}/${_b2sum:2:2}/${_b2sum:4}/${_whl}"
         "README-${pkgver}.md::${_urlraw}/README.md"
         "LICENSE-${pkgver}::${_urlraw}/LICENSE")
-sha512sums=('43752eb68c19cd25f3cfbe49013f5f297a6a0b0f6351f7d6d75b120275df0b293021f6b86c8f2bb7e58ba5df5b9e627dc7b62b1c521b1fe7d2e7ce95bce3753c'
+sha512sums=('cb4698d45425c553cca4f1822efc75ddd271d3f64e45f5140617b3b946a40eb590fa25ffda592c83bf630ae7461db0263bbc3ac50b2185a943051d6768b0e72b'
             '0add923c611511754f6c0baaa435e805cb3677fcb059af0bd867e2dda7c25525b9ff67da53975298ebf87f1265c8a2cf846adcf775d447e527874fc430b64551'
             'dec798f85edac11b3a3f4bb1f309397719dd4de04f66357a5520b23e758cba757c9c7bee87bdbae2a5f936368cab0670bbd3395030393c029d68d0e72fcfba1e')
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 21:21:21	Medium	1
2026-09-06 00:17:06	Clean	2
2026-09-05 01:59:11	Medium	1
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 23:49:29	Medium	1
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2
2026-08-28 00:07:31	Low	2