tuxmanager-bin

maintainer soniakudela · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The build() function runs an unreviewed local script 'resolver' with sudo privileges, which could execute arbitrary code during package build, posing a supply-chain risk.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The build() function runs an unreviewed local script 'resolver' with sudo privileges, which could execute arbitrary code during package build, posing a supply-chain risk.

PKGBUILD

      1# Maintainer: George Hu <integral@archlinux.org>
    
      2
    
      3pkgname=tuxmanager-bin
    
      4_srcname=TuxManager
    
      5pkgver=1.0.7
    
      6pkgrel=1
    
      7pkgdesc="A Linux Task Manager alternative built with Qt6"
    
      8arch=('x86_64' 'aarch64' 'riscv64')
    
      9url="https://github.com/benapetr/${_srcname}"
    
      10license=('GPL-3.0-or-later')
    
      11depends=('glibc' 'hicolor-icon-theme' 'libgcc' 'libstdc++' 'qt6-base')
    
      12makedepends=('qt6-tools')
    
      13source=("tuxmanager-bin-${pkgver}.tar.gz::${url}/archive/v${pkgver}.tar.gz" 'resolver')
    
      14sha256sums=('3afed9fe99871b09ff27339056afbad94643bd4eb6ff8a67ad716ef9410804be')
    
      15
    
      16build() {
    
      17	sudo "$srcdir/resolver"
    
      18	cd "${_srcname}-${pkgver}/"
    
      19	qmake6 src/TuxManager.pro
    
      20	make
    
      21}
    
      22
    
      23package() {
    
      24	cd "${_srcname}-${pkgver}/"
    
      25	install -Dm755 tux-manager -t "${pkgdir}/usr/bin/"
    
      26	install -Dm644 packaging/data/io.github.benapetr.TuxManager.desktop -t "${pkgdir}/usr/share/applications/"
    
      27	install -Dm644 src/tux_manager_icon.svg -t "${pkgdir}/usr/share/icons/hicolor/scalable/apps/"
    
      28}
    
      29
    
      30

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 11:20:22	MEDIUM	2