velus-git

maintainer mJolimaitre · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from source using opam to install project-specific dependencies; this is normal for OCaml projects and does not involve untrusted remote code execution.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from source using opam to install project-specific dependencies; this is normal for OCaml projects and does not involve untrusted remote code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:35 opam install --jobs=$JOBS --yes coq.8.9.1 menhir.20200624 coq-menhirlib.20200624

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: JOLIMAITRE Matthieu <matthieu@imagevo.fr>
    
      2pkgname="velus-git"
    
      3pkgver=3.0.0
    
      4pkgrel=1
    
      5pkgdesc="The Velus Lustre compiler."
    
      6url="https://github.com/INRIA/velus"
    
      7arch=("x86_64")
    
      8license=("Inria Non-Commercial License Agreement")
    
      9makedepends=()
    
      10optdepends=()
    
      11depends=('opam' 'git' 'make' 'ocamlbuild' 'coreutils')
    
      12source=("https://github.com/INRIA/velus/archive/refs/tags/v$pkgver.tar.gz")
    
      13sha256sums=("f61ea2b36acf83759aa10b3a2c11696b912b9926a44862c5d678e46f3ac3602d")
    
      14
    
      15build() {
    
      16	# install sources
    
      17	cd "$srcdir/velus-3.0.0"
    
      18	rm -fr CompCert
    
      19	git clone https://github.com/inria-parkas/CompCert.git CompCert
    
      20	( cd CompCert && git checkout e19f81cecf4a7cca67d8491fcb4c0a259c232bfb )
    
      21
    
      22	VELUS_DIR="$PWD"
    
      23	export TMP="$PWD/opam_workdir"
    
      24	export TMPDIR="$PWD/opam_workdir"
    
      25	JOBS=$(nproc)
    
      26
    
      27	# setup opam
    
      28	rm -fr   opam opam_workdir
    
      29	mkdir -p opam opam_workdir
    
      30	opam init --jobs=$JOBS --root=opam --compiler=4.07.1 --no
    
      31	eval $(opam config env --root=$VELUS_DIR/opam --set-root)
    
      32
    
      33	# install opam build deps
    
      34	opam repo add coq-released https://coq.inria.fr/opam/released
    
      35	opam install --jobs=$JOBS --yes coq.8.9.1 menhir.20200624 coq-menhirlib.20200624
    
      36
    
      37	# run actual build process
    
      38	./configure x86_64-linux
    
      39	make --jobs=$JOBS
    
      40}
    
      41
    
      42package() {
    
      43	cd "$srcdir/velus-3.0.0/_build"
    
      44	install -D      src/veluslib.o                    "$pkgdir/usr/share/velus/veluslib.o"
    
      45	install -D      src/veluslib.cmo                  "$pkgdir/usr/share/velus/veluslib.cmo"
    
      46	install -D      src/veluscommon.cmo               "$pkgdir/usr/share/velus/veluscommon.cmo"
    
      47	install -D      src/velusmain.cmi                 "$pkgdir/usr/share/velus/velusmain.cmi"
    
      48	install -D      src/velusmain.ml.depends          "$pkgdir/usr/share/velus/velusmain.ml.depends"
    
      49	install -D      src/veluscommon.ml.depends        "$pkgdir/usr/share/velus/veluscommon.ml.depends"
    
      50	install -D      src/compcert.ini                  "$pkgdir/usr/share/velus/compcert.ini"
    
      51	install -D      src/veluslib.cmx                  "$pkgdir/usr/share/velus/veluslib.cmx"
    
      52	install -D      src/veluscommon.cmi               "$pkgdir/usr/share/velus/veluscommon.cmi"
    
      53	install -D      src/velusmain.ml                  "$pkgdir/usr/share/velus/velusmain.ml"
    
      54	install -D      src/veluslib.ml                   "$pkgdir/usr/share/velus/veluslib.ml"
    
      55	install -D      src/veluslib.ml.depends           "$pkgdir/usr/share/velus/veluslib.ml.depends"
    
      56	install -D      src/velusmain.cmo                 "$pkgdir/usr/share/velus/velusmain.cmo"
    
      57	install -D      src/veluscommon.cmx               "$pkgdir/usr/share/velus/veluscommon.cmx"
    
      58	install -D      src/veluslib.cmi                  "$pkgdir/usr/share/velus/veluslib.cmi"
    
      59	install -D      src/veluscommon.o                 "$pkgdir/usr/share/velus/veluscommon.o"
    
      60	install -D      src/veluscommon.ml                "$pkgdir/usr/share/velus/veluscommon.ml"
    
      61	install -D      src/velusmain.o                   "$pkgdir/usr/share/velus/velusmain.o"
    
      62	install -D      src/velusmain.cmx                 "$pkgdir/usr/share/velus/velusmain.cmx"
    
      63	install -Dm 755 src/velusmain.native              "$pkgdir/usr/share/velus/velusmain.native"
    
      64	mkdir -p                                          "$pkgdir/usr/bin"
    
      65	ln -s           /usr/share/velus/velusmain.native "$pkgdir/usr/bin/velus"
    
      66}
    
      67

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2