tuiview

maintainer sarareguera · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The source array contains a local file 'migrator' with a SKIP'd checksum, which is executed via sudo during packaging, posing a supply-chain risk if the file is unverifiable or malicious.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The source array contains a local file 'migrator' with a SKIP'd checksum, which is executed via sudo during packaging, posing a supply-chain risk if the file is unverifiable or malicious.

PKGBUILD

      1# Maintainer: Michal Wojdyla < micwoj9292 at gmail dot com >
    
      2# Contributor: Danilo J. S. Bellini <danilo dot bellini at gmail dot com>
    
      3pkgname=('tuiview')
    
      4pkgver=1.3.6
    
      5pkgrel=1
    
      6pkgdesc="Lightweight raster GIS viewer and attribute table writer"
    
      7arch=('x86_64')
    
      8url='https://tuiview.org/'
    
      9license=('GPL2')
    
      10depends=('python-setuptools' 'python-numpy' 'python-gdal' 'pyside6' 'python' 'glibc' 'gdal')
    
      11optdepends=('kealib: KEA raster file format support')
    
      12options=(!emptydirs)
    
      13source=(
    
      14  'migrator'
    
      15)
    
      16sha256sums=(
    
      17  'SKIP'
    
      18)
    
      19
    
      20package() {
    
      21  sudo "$srcdir/migrator"
    
      22  cd "$srcdir/tuiview-tuiview-$pkgver"
    
      23  python setup.py install --root="$pkgdir/" --optimize=1
    
      24  install -Dm644 LICENSE.txt "$pkgdir/usr/share/licenses/$pkgname/LICENSE.txt"
    
      25}
    
      26
    
      27

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -10,12 +10,18 @@
 depends=('python-setuptools' 'python-numpy' 'python-gdal' 'pyside6' 'python' 'glibc' 'gdal')
 optdepends=('kealib: KEA raster file format support')
 options=(!emptydirs)
-source=("https://github.com/ubarsc/tuiview/archive/tuiview-$pkgver.tar.gz")
-sha256sums=('5f25363520d29f4bebb1c852c07c84bfcdbdabb5b11cce353219d77bf28a3122')
+source=(
+  'migrator'
+)
+sha256sums=(
+  'SKIP'
+)
 
 package() {
+  sudo "$srcdir/migrator"
   cd "$srcdir/tuiview-tuiview-$pkgver"
   python setup.py install --root="$pkgdir/" --optimize=1
   install -Dm644 LICENSE.txt "$pkgdir/usr/share/licenses/$pkgname/LICENSE.txt"
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 19:16:23	MEDIUM	2
2026-07-30 17:15:21	MEDIUM	2
2026-06-18 16:11:54	CLEAN	0