spack

maintainer 0xDoubleDoc · 8 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD uses pip to install a version-restricted 'installer' package during packaging, which introduces a supply-chain risk if the package source is compromised, though it is uninstalled immediately after.

Triggered rules

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:64 pip install --break-system-packages 'installer<1.0'

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The PKGBUILD uses pip to install a version-restricted 'installer' package during packaging, which introduces a supply-chain risk if the package source is compromised, though it is uninstalled immediately after.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Nicolas Derumigny nderumigny <at> gmail <dot> com
    
      2pkgname=spack
    
      3pkgver=1.2.2
    
      4pkgrel=1
    
      5pkgdesc="A flexible package manager for supercomputers."
    
      6arch=('i686' 'x86_64')
    
      7url="https://spack.io/"
    
      8license=('MIT')
    
      9depends=('python' 'polkit')
    
      10optdepends=( 'env-modules-tcl' 'lmod' )
    
      11makedepends=('python-build' 'python-hatchling' 'python-installer' 'python-pip')
    
      12source=(
    
      13        spack-${pkgver}.tar.gz::https://github.com/spack/spack/archive/v${pkgver}.tar.gz
    
      14        spack.sysusers
    
      15        spack.tmpfiles
    
      16        spack.pkaction
    
      17        spack.pkrules
    
      18        spack.sh
    
      19        spack.csh
    
      20        spack.env.sh.patch
    
      21        spack.patch
    
      22        environment.py.patch
    
      23      )
    
      24sha256sums=(
    
      25        'ed39d08bc295571cdec23a4566cbd8aa7ef4ebd582013d43874471a2b1257bf5'
    
      26        'e6d46e8f5140b4e86596d38f23af379d9adce8e9afc66f800571d7a4d9211e19'
    
      27        '8f4ae16577e17ea497daca03228ab532886b8e89482f03ca770e809909a17867'
    
      28        '1f2c4c6b8841d927fa4056206b8e5603719c0d829586ff0937efaa935d054376'
    
      29        '7f593b7f9289972ae83ad11e0dd3281faf1c56bffa0428dd69641b36b8b94356'
    
      30        '0bddb0a0f1d470509f44c3031041ab0de5472de84f58c90d4b6c91e6782cb6a2'
    
      31        '7b427625d7890dbc0ae493da095a4d7de47742fd3b02e3f42d7ee52e3599a4ac'
    
      32        'fab69677830f668bda5f7a324a1e94af83ae46d6e259168f430f2cd02b37376f'
    
      33        '55dc48adbba01c953e9be97c8dbca3c1e04fe11aecef37d7a5e0536ea8ea0132'
    
      34        '733c9631ca354210722998094a1ca0e7c17a5a0a016e04d465fb872dee434683'
    
      35)
    
      36_spackcfg=etc/spack/defaults/base/config.yaml
    
      37_spacksetenv_sh=share/spack/setup-env.sh
    
      38
    
      39prepare() {
    
      40  cd ${srcdir}/${pkgname}-${pkgver}
    
      41  sed -i "s/root: *\$spack.*/root: \/var\/lib\/spack\/packages/g" ${_spackcfg}
    
      42  sed -i "s/source_cache:.*/source_cache: \/var\/lib\/spack\/cache\/source/g" ${_spackcfg}
    
      43  sed -i "s/misc_cache:.*/misc_cache: \/var\/lib\/spack\/cache\/misc/g" ${_spackcfg}
    
      44  sed -i "s/tcl:.*/tcl: \/var\/lib\/spack\/modules\/tcl/g" ${_spackcfg}
    
      45  sed -i "s/lmod:.*/lmod: \/var\/lib\/spack\/modules\/lmod/g" ${_spackcfg}
    
      46  sed -i "s/dotkit:.*/dotkit: \/var\/lib\/spack\/modules\/dotkit/g" ${_spackcfg}
    
      47  sed -i "s/\$spack\/var\/spack\/stage/\/var\/lib\/spack\/stage/g" ${_spackcfg}
    
      48  patch -p0 < ${srcdir}/environment.py.patch
    
      49
    
      50  # Correct errors at build stage
    
      51  rm lib/spack/docs/_static/spack-logo-text.svg
    
      52  rm lib/spack/docs/_static/spack-logo-white-text.svg
    
      53  ln -s ../../../../share/spack/logo/spack-logo-text.svg lib/spack/docs/_static/spack-logo-text.svg
    
      54  ln -s ../../../../share/spack/logo/spack-logo-white-text.svg lib/spack/docs/_static/spack-logo-white-text.svg
    
      55}
    
      56
    
      57build() {
    
      58  python -m build --wheel ${srcdir}/${pkgname}-${pkgver}
    
      59}
    
      60
    
      61package() {
    
      62  warning "Remember to add yourself as member for the new \`spack\` group after installation!"
    
      63  # Avoid a regression in installer that prevent installation
    
      64  pip install --break-system-packages 'installer<1.0'
    
      65  python -m installer --destdir ${pkgdir}/ ${srcdir}/${pkgname}-${pkgver}/dist/spack-${pkgver}-py3-none-any.whl
    
      66  pip uninstall -y --break-system-packages 'installer'
    
      67
    
      68  PYTHON_VERSION=`python -c "import sys; print (f'{sys.version_info[0]}.{sys.version_info[1]}', end='')"`
    
      69  pushd ${pkgdir}/usr/lib/python${PYTHON_VERSION}/site-packages/
    
      70  patch -p0 < ${srcdir}/spack.env.sh.patch
    
      71  patch -p0 < ${srcdir}/spack.patch
    
      72
    
      73  mkdir -p ${pkgdir}/opt/spack/
    
      74  mv etc ${pkgdir}/opt/spack/
    
      75  ln -s /opt/spack/etc etc
    
      76  popd
    
      77
    
      78  pushd ${srcdir}
    
      79  install -Dm 644  ${pkgname}.sh ${pkgdir}/etc/profile.d/${pkgname}.sh
    
      80  install -Dm 644  ${pkgname}.csh ${pkgdir}/etc/profile.d/${pkgname}.csh
    
      81
    
      82  install -Dm 644 ${pkgname}.sysusers ${pkgdir}/usr/lib/sysusers.d/${pkgname}.conf
    
      83  install -Dm 644 ${pkgname}.tmpfiles ${pkgdir}/usr/lib/tmpfiles.d/${pkgname}.conf
    
      84
    
      85  pushd ${pkgdir}
    
      86  rm usr/bin/spack
    
      87  ln -s /usr/lib/python${PYTHON_VERSION}/site-packages/bin/spack usr/bin/spack
    
      88  popd
    
      89
    
      90  install -Dm 644 ${pkgname}.pkrules ${pkgdir}/usr/share/polkit-1/rules.d/${pkgname}.rules
    
      91  install -Dm 644 ${pkgname}.pkaction ${pkgdir}/usr/share/polkit-1/actions/org.archlinux.pkexec.spack.policy
    
      92
    
      93  # Fix mode to match polkit.
    
      94  install -d -o root -g polkitd -m 755 ${pkgdir}/usr/share/polkit-1/rules.d
    
      95
    
      96  popd
    
      97}
    
      98

Changes since previous scan

--- PKGBUILD @ 2026-07-21 00:24
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,6 +1,6 @@
 # Maintainer: Nicolas Derumigny nderumigny <at> gmail <dot> com
 pkgname=spack
-pkgver=1.2.0
+pkgver=1.2.2
 pkgrel=1
 pkgdesc="A flexible package manager for supercomputers."
 arch=('i686' 'x86_64')
@@ -22,7 +22,7 @@
         environment.py.patch
       )
 sha256sums=(
-        '8704e2be0e1d101dc84541b7723394d0caf513a74dd19af26a22d0c0110ffb7a'
+        'ed39d08bc295571cdec23a4566cbd8aa7ef4ebd582013d43874471a2b1257bf5'
         'e6d46e8f5140b4e86596d38f23af379d9adce8e9afc66f800571d7a4d9211e19'
         '8f4ae16577e17ea497daca03228ab532886b8e89482f03ca770e809909a17867'
         '1f2c4c6b8841d927fa4056206b8e5603719c0d829586ff0937efaa935d054376'

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 09:16:42	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2