velus-git

LOW

maintainer mJolimaitre 1 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package builds from source using opam to install project-specific dependencies; this is normal for OCaml projects and does not involve untrusted remote code execution.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from source using opam to install project-specific dependencies; this is normal for OCaml projects and does not involve untrusted remote code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:35 opam install --jobs=$JOBS --yes coq.8.9.1 menhir.20200624 coq-menhirlib.20200624

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: JOLIMAITRE Matthieu <matthieu@imagevo.fr>
    
      2pkgname="velus-git"
    
      3pkgver=3.0.0
    
      4pkgrel=1
    
      5pkgdesc="The Velus Lustre compiler."
    
      6url="https://github.com/INRIA/velus"
    
      7arch=("x86_64")
    
      8license=("Inria Non-Commercial License Agreement")
    
      9makedepends=()
    
      10optdepends=()
    
      11depends=('opam' 'git' 'make' 'ocamlbuild' 'coreutils')
    
      12source=("https://github.com/INRIA/velus/archive/refs/tags/v$pkgver.tar.gz")
    
      13sha256sums=("f61ea2b36acf83759aa10b3a2c11696b912b9926a44862c5d678e46f3ac3602d")
    
      14
    
      15build() {
    
      16	# install sources
    
      17	cd "$srcdir/velus-3.0.0"
    
      18	rm -fr CompCert
    
      19	git clone https://github.com/inria-parkas/CompCert.git CompCert
    
      20	( cd CompCert && git checkout e19f81cecf4a7cca67d8491fcb4c0a259c232bfb )
    
      21
    
      22	VELUS_DIR="$PWD"
    
      23	export TMP="$PWD/opam_workdir"
    
      24	export TMPDIR="$PWD/opam_workdir"
    
      25	JOBS=$(nproc)
    
      26
    
      27	# setup opam
    
      28	rm -fr   opam opam_workdir
    
      29	mkdir -p opam opam_workdir
    
      30	opam init --jobs=$JOBS --root=opam --compiler=4.07.1 --no
    
      31	eval $(opam config env --root=$VELUS_DIR/opam --set-root)
    
      32
    
      33	# install opam build deps
    
      34	opam repo add coq-released https://coq.inria.fr/opam/released
    
      35	opam install --jobs=$JOBS --yes coq.8.9.1 menhir.20200624 coq-menhirlib.20200624
    
      36
    
      37	# run actual build process
    
      38	./configure x86_64-linux
    
      39	make --jobs=$JOBS
    
      40}
    
      41
    
      42package() {
    
      43	cd "$srcdir/velus-3.0.0/_build"
    
      44	install -D      src/veluslib.o                    "$pkgdir/usr/share/velus/veluslib.o"
    
      45	install -D      src/veluslib.cmo                  "$pkgdir/usr/share/velus/veluslib.cmo"
    
      46	install -D      src/veluscommon.cmo               "$pkgdir/usr/share/velus/veluscommon.cmo"
    
      47	install -D      src/velusmain.cmi                 "$pkgdir/usr/share/velus/velusmain.cmi"
    
      48	install -D      src/velusmain.ml.depends          "$pkgdir/usr/share/velus/velusmain.ml.depends"
    
      49	install -D      src/veluscommon.ml.depends        "$pkgdir/usr/share/velus/veluscommon.ml.depends"
    
      50	install -D      src/compcert.ini                  "$pkgdir/usr/share/velus/compcert.ini"
    
      51	install -D      src/veluslib.cmx                  "$pkgdir/usr/share/velus/veluslib.cmx"
    
      52	install -D      src/veluscommon.cmi               "$pkgdir/usr/share/velus/veluscommon.cmi"
    
      53	install -D      src/velusmain.ml                  "$pkgdir/usr/share/velus/velusmain.ml"
    
      54	install -D      src/veluslib.ml                   "$pkgdir/usr/share/velus/veluslib.ml"
    
      55	install -D      src/veluslib.ml.depends           "$pkgdir/usr/share/velus/veluslib.ml.depends"
    
      56	install -D      src/velusmain.cmo                 "$pkgdir/usr/share/velus/velusmain.cmo"
    
      57	install -D      src/veluscommon.cmx               "$pkgdir/usr/share/velus/veluscommon.cmx"
    
      58	install -D      src/veluslib.cmi                  "$pkgdir/usr/share/velus/veluslib.cmi"
    
      59	install -D      src/veluscommon.o                 "$pkgdir/usr/share/velus/veluscommon.o"
    
      60	install -D      src/veluscommon.ml                "$pkgdir/usr/share/velus/veluscommon.ml"
    
      61	install -D      src/velusmain.o                   "$pkgdir/usr/share/velus/velusmain.o"
    
      62	install -D      src/velusmain.cmx                 "$pkgdir/usr/share/velus/velusmain.cmx"
    
      63	install -Dm 755 src/velusmain.native              "$pkgdir/usr/share/velus/velusmain.native"
    
      64	mkdir -p                                          "$pkgdir/usr/bin"
    
      65	ln -s           /usr/share/velus/velusmain.native "$pkgdir/usr/bin/velus"
    
      66}
    
      67

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2