swiss-army-knife-hs
LOW
maintainer eltoro
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The remote download executed by shell (get-ghcup.haskell.org) is part of a standard Haskell toolchain bootstrap for building the project from source, not arbitrary code execution; the source is built from a legitimate project repository and the download is a common, expected step in Haskell development environments.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this HIGH, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The remote download executed by shell (get-ghcup.haskell.org) is part of a standard Haskell toolchain bootstrap for building the project from source, not arbitrary code execution; the source is built from a legitimate project repository and the download is a common, expected step in Haskell development environments.
1 higher static finding superseded - not the current verdict (shown for transparency)
High
Remote download executed by a shell
curl_pipe_shell
curl/wget/fetch output reaches a shell (via pipe, xargs, process substitution, `sh -c "$(…)"`, or `| source`), executing remote code that was never reviewed or checksummed.
-
PKGBUILD:26
curl --proto '=https' --tlsv1.2 -sSf https://get-ghcup.haskell.org | sh
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: qFred Mitchell <fred.mitchell@atomlogik.de>
2
pkgname=swiss-army-knife-hs
3
pkgver=1.0.0.1
4
pkgrel=5
5
pkgdesc="A collection of powerful but useful small tools."
6
arch=('x86_64')
7
url="https://github.com/flajann2/swiss-army-knife-hs"
8
license=('MIT')
9
depends=('ghc' 'glibc')
10
makedepends=('wget' 'xz' 'git' 'ghc-libs' 'cabal-install')
11
source=("$pkgname::git+https://github.com/flajann2/swiss-army-knife-hs.git")
12
13
md5sums=('SKIP')
14
15
prepare() {
16
cd "$srcdir"
17
export HOME="$srcdir"
18
export BOOTSTRAP_HASKELL_NONINTERACTIVE=1
19
export BOOTSTRAP_HASKELL_NO_UPGRADE=1
20
export BOOTSTRAP_HASKELL_MINIMAL=1
21
export BOOTSTRAP_HASKELL_GHC_VERSION=9.10.1
22
export BOOTSTRAP_HASKELL_CABAL_VERSION=1.14
23
export BOOTSTRAP_HASKELL_INSTALL_NO_STACK=1
24
export BOOTSTRAP_HASKELL_INSTALL_NO_STACK_HOOK=1
25
26
curl --proto '=https' --tlsv1.2 -sSf https://get-ghcup.haskell.org | sh
27
source "$srcdir/.ghcup/env"
28
29
# Install specific GHC version
30
ghcup install ghc 9.10.1
31
ghcup set ghc 9.10.1
32
33
# Install cabal
34
ghcup install cabal latest
35
}
36
37
build() {
38
cd "$srcdir"
39
40
# Debug: List the contents to see what directory was actually created
41
echo "Contents of srcdir:"
42
ls -la
43
44
# Find the actual source directory
45
if [[ -d "$pkgname-$pkgver" ]]; then
46
cd "$pkgname-$pkgver"
47
elif [[ -d "$pkgname" ]]; then
48
cd "$pkgname"
49
else
50
# If it's a git checkout, it might be in a subdirectory
51
cd $(find . -maxdepth 1 -type d -name "*$pkgname*" | head -1)
52
fi
53
54
# Build the project
55
cabal update
56
cabal build
57
}
58
59
package() {
60
cd "$srcdir"
61
62
# Find the actual source directory (same logic as build)
63
if [[ -d "$pkgname-$pkgver" ]]; then
64
cd "$pkgname-$pkgver"
65
elif [[ -d "$pkgname" ]]; then
66
cd "$pkgname"
67
else
68
cd $(find . -maxdepth 1 -type d -name "*$pkgname*" | head -1)
69
fi
70
71
# Debug: Show what's in the build directory
72
echo "Looking for executable in dist-newstyle:"
73
find dist-newstyle -name "*sak*" -type f 2>/dev/null || echo "No sak executable found in dist-newstyle"
74
75
# Method 1: Try to find and install the executable directly
76
local exe_path=$(find dist-newstyle -name "sak" -type f -executable 2>/dev/null | head -1)
77
if [[ -n "$exe_path" ]]; then
78
echo "Found executable at: $exe_path"
79
install -Dm755 "$exe_path" "$pkgdir/usr/bin/sak"
80
else
81
echo "Method 1 failed, trying cabal install method..."
82
83
# Method 2: Use cabal install
84
mkdir -p "$pkgdir/usr/bin"
85
cabal install --installdir="$pkgdir/usr/bin" --install-method=copy --overwrite-policy=always
86
87
# Check if it was installed
88
if [[ ! -f "$pkgdir/usr/bin/sak" ]]; then
89
echo "Method 2 failed, trying cabal copy method..."
90
91
# Method 3: Use cabal copy with destdir
92
cabal copy --destdir="$pkgdir"
93
94
# If still not found, try to locate it manually
95
if [[ ! -f "$pkgdir/usr/bin/sak" ]]; then
96
echo "Searching for any sak executable in the entire build tree:"
97
find . -name "*sak*" -type f -executable 2>/dev/null
98
99
# Try alternative common locations
100
local alt_exe=$(find . -name "sak" -type f -executable 2>/dev/null | head -1)
101
if [[ -n "$alt_exe" ]]; then
102
echo "Found alternative executable at: $alt_exe"
103
install -Dm755 "$alt_exe" "$pkgdir/usr/bin/sak"
104
else
105
echo "ERROR: Could not find sak executable anywhere!"
106
exit 1
107
fi
108
fi
109
fi
110
fi
111
112
# Verify installation
113
if [[ -f "$pkgdir/usr/bin/sak" ]]; then
114
echo "Successfully installed sak to $pkgdir/usr/bin/sak"
115
ls -la "$pkgdir/usr/bin/sak"
116
else
117
echo "ERROR: sak was not installed to $pkgdir/usr/bin/sak"
118
exit 1
119
fi
120
121
# Install documentation if available
122
if [[ -f README.md ]]; then
123
install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
124
fi
125
126
# Install license if available
127
if [[ -f LICENSE ]]; then
128
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
129
fi
130
}
131
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |