super-bombinhas-bin

maintainer AidenIsik · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD runs 'gem install gosu' and 'gem install minigl' during the package() function, pulling Ruby gems from rubygems.org at build time without any integrity verification (no checksums, no lockfile). These gems are executed/compiled native code (gosu in particular wraps SDL2/OpenGL and includes C extensions). While rubygems.org is an official ecosystem mirror, installing gems inside package() rather than declaring them as proper dependencies or vendoring them with verified checksums is a genuine supply-chain concern: a compromised or yanked-and-replaced gem version could execute arbitrary code during packaging. Additionally, gem install in package() installs to the system gem path rather than $pkgdir, meaning the installed gems persist on the build host outside the package's control. The .deb source is from the official GitHub releases page with a b2sum, which is fine, but the unverified gem installs represent a real medium-severity supply-chain risk.

Triggered rules

MEDIUM External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:16 gem install gosu -v 1.4.6 --conservative
PKGBUILD:17 gem install minigl -v 2.4.3 --conservative

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD runs 'gem install gosu' and 'gem install minigl' during the package() function, pulling Ruby gems from rubygems.org at build time without any integrity verification (no checksums, no lockfile). These gems are executed/compiled native code (gosu in particular wraps SDL2/OpenGL and includes C extensions). While rubygems.org is an official ecosystem mirror, installing gems inside package() rather than declaring them as proper dependencies or vendoring them with verified checksums is a genuine supply-chain concern: a compromised or yanked-and-replaced gem version could execute arbitrary code during packaging. Additionally, gem install in package() installs to the system gem path rather than $pkgdir, meaning the installed gems persist on the build host outside the package's control. The .deb source is from the official GitHub releases page with a b2sum, which is fine, but the unverified gem installs represent a real medium-severity supply-chain risk.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Aiden Isik <aidenisik+aur@member.fsf.org>
    
      2pkgname=super-bombinhas-bin
    
      3pkgver=1.5.2
    
      4pkgrel=1
    
      5pkgdesc="A 2D platformer written in Ruby."
    
      6arch=('any')
    
      7url="https://github.com/victords/super-bombinhas"
    
      8license=('GPL3')
    
      9makedepends=('tar' 'pkg-config' 'binutils')
    
      10depends=('ruby>=2.0' 'pango' 'sdl2' 'sdl2_ttf')
    
      11source=(https://github.com/victords/super-bombinhas/releases/download/v${pkgver}/super-bombinhas-${pkgver}.deb)
    
      12b2sums=('f2db0a8bc99c0173646cc8f68399a1817777e519f452911cb9c821e0b9f0e2d4290fc12a47eab39c83815445424ff62dfb038d8ccf2d38e77286087f3291221b')
    
      13
    
      14package() {
    
      15	# Get required gems
    
      16	gem install gosu -v 1.4.6 --conservative
    
      17	gem install minigl -v 2.4.3 --conservative
    
      18	
    
      19	# Extract to correct place
    
      20	ar -xvf ${srcdir}/super-bombinhas-${pkgver}.deb
    
      21	mkdir data
    
      22	tar -xvf ${srcdir}/data.tar.xz -C data
    
      23	chmod -R 755 data # Match Arch system directory permissions
    
      24	cp -a data/* ${pkgdir}
    
      25}
    
      26

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2