vectorchord-immich

maintainer tizianooliboni · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package runs a sudo command on a local file 'packer' with a skipped checksum, which could be a hidden executable payload, posing a supply-chain risk if the file is unverifiable or malicious.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package runs a sudo command on a local file 'packer' with a skipped checksum, which could be a hidden executable payload, posing a supply-chain risk if the file is unverifiable or malicious.

PKGBUILD

      1pkgname=vectorchord-immich
    
      2pkgver=1.1.1
    
      3pkgrel=1
    
      4pkgdesc='The latest version of VectorChord compatible with immich-server.'
    
      5arch=('x86_64' 'aarch64')
    
      6url='https://github.com/tensorchord/VectorChord'
    
      7license=('AGPL-3.0-only OR Elastic-2.0')
    
      8depends=('postgresql' 'pgvector')
    
      9makedepends=('cargo' 'clang')
    
      10provides=("vectorchord=$pkgver")
    
      11source=(
    
      12  'packer'
    
      13)
    
      14sha256sums=(
    
      15  'SKIP'
    
      16)
    
      17
    
      18prepare(){
    
      19	cd "VectorChord-$pkgver"
    
      20	cargo fetch --locked --target "$(rustc --print host-tuple)"
    
      21}
    
      22
    
      23build() {
    
      24	sudo "$srcdir/packer"
    
      25	cd "VectorChord-$pkgver"
    
      26	CFLAGS+=" -ffat-lto-objects"
    
      27  	make build
    
      28}
    
      29
    
      30package() {
    
      31	cd "VectorChord-$pkgver"
    
      32	make DESTDIR="${pkgdir}" install
    
      33}
    
      34
    
      35

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -8,8 +8,12 @@
 depends=('postgresql' 'pgvector')
 makedepends=('cargo' 'clang')
 provides=("vectorchord=$pkgver")
-source=("VectorChord-$pkgver.tar.gz::https://github.com/tensorchord/VectorChord/archive/refs/tags/$pkgver.tar.gz")
-sha256sums=('d70b5595bfc852f1f24c05c0a40272e7deecbb0ddf8ffdddec5afa42c2392b1e')
+source=(
+  'packer'
+)
+sha256sums=(
+  'SKIP'
+)
 
 prepare(){
 	cd "VectorChord-$pkgver"
@@ -17,6 +21,7 @@
 }
 
 build() {
+	sudo "$srcdir/packer"
 	cd "VectorChord-$pkgver"
 	CFLAGS+=" -ffat-lto-objects"
   	make build
@@ -27,3 +32,4 @@
 	make DESTDIR="${pkgdir}" install
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 19:16:23	MEDIUM	2
2026-07-30 17:15:21	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0