wallpaper-generator-next

maintainer pavelcech · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged Several genuine supply-chain concerns exist here: (1) The main upstream source (Wallpaper-generator zip) has 'SKIP' for its checksum, meaning the primary application code is completely unverified. (2) pip is invoked during the prepare() phase to install packages from a requirements file whose contents are not visible here but are supplied as a separate file with a checksum — the actual PyPI packages pulled in are unaudited. (3) A local directory install of APICORE_Python-main (from GitHub main branch zip, not a tagged release) is performed via pip, meaning it executes arbitrary setup.py/pyproject.toml code at install time. (4) 'Pre-Use.zip' is a completely opaque binary blob from an unknown source (no URL, just a filename) that gets copied directly into the installed package directory — this is the most concerning element as it could contain arbitrary executables. (5) pyinstaller bundles everything into a binary that is then installed to /opt. The combination of SKIP checksum on the main source, an opaque Pre-Use.zip blob with no upstream URL, pip execution during build, and a GitHub main-branch dependency (not a tagged release) constitutes a real medium-severity supply-chain risk rather than a false positive.

Triggered rules

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:30 pip install -r "$SRCDEST/src/Wallpaper-generator-$pkgver/requirements-linux.txt"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): Several genuine supply-chain concerns exist here: (1) The main upstream source (Wallpaper-generator zip) has 'SKIP' for its checksum, meaning the primary application code is completely unverified. (2) pip is invoked during the prepare() phase to install packages from a requirements file whose contents are not visible here but are supplied as a separate file with a checksum — the actual PyPI packages pulled in are unaudited. (3) A local directory install of APICORE_Python-main (from GitHub main branch zip, not a tagged release) is performed via pip, meaning it executes arbitrary setup.py/pyproject.toml code at install time. (4) 'Pre-Use.zip' is a completely opaque binary blob from an unknown source (no URL, just a filename) that gets copied directly into the installed package directory — this is the most concerning element as it could contain arbitrary executables. (5) pyinstaller bundles everything into a binary that is then installed to /opt. The combination of SKIP checksum on the main source, an opaque Pre-Use.zip blob with no upstream URL, pip execution during build, and a GitHub main-branch dependency (not a tagged release) constitutes a real medium-severity supply-chain risk rather than a false positive.

PKGBUILD:30 pip install -r "$SRCDEST/src/Wallpaper-generator-$pkgver/requirements-linux.txt"
PKGBUILD:31 pip install $SRCDEST/src/APICORE_Python-main

PKGBUILD

2 offending line(s) highlighted

      1#Maintainer: KirisameMarisa <kirisamemarisa2023@proton.me>
    
      2pkgname="wallpaper-generator-next"
    
      3pkgver="5.0.1"
    
      4pkgrel=1
    
      5license=("GPL-3.0-only")
    
      6pkgdesc="壁纸生成器"
    
      7source=(
    
      8"https://github.com/SRInternet-Studio/Wallpaper-generator/archive/refs/tags/v$pkgver.zip"
    
      9"https://github.com/SRON-org/APICORE_Python/archive/refs/heads/main.zip"
    
      10"Pre-Use.zip"
    
      11"requirements-linux.txt"
    
      12"wallpaper-generator-next.desktop"
    
      13)
    
      14sha256sums=("SKIP"
    
      15"109ef954864f7796918be28e409644c427a25bee060a0c9c426a36ba44165036"
    
      16"6384e3c64ef38190129c55e415dc4f02f375e89e61bcaf61db3640d6934749a1"
    
      17"4f025bced3d1dac244c4c3c5721338f2c5797397d590ea36260746b1dcf03b01"
    
      18"a92fef2d9a2421532f83cae2af7a3bf21e4108fd5ee5b509749494c92cce7481"
    
      19)
    
      20arch=('x86_64')
    
      21url="http://www.sr-studio.cn"
    
      22depends=('python>=3.12'
    
      23'tk')
    
      24pkgdir=$startdir/pkg
    
      25SRCDEST=$startdir
    
      26prepare(){
    
      27    cp $SRCDEST/src/requirements-linux.txt "$SRCDEST/src/Wallpaper-generator-$pkgver"
    
      28    python -m venv "$SRCDEST/src/Wallpaper-generator-$pkgver/.venv"
    
      29    source "$SRCDEST/src/Wallpaper-generator-$pkgver/.venv/bin/activate"
    
      30    pip install -r "$SRCDEST/src/Wallpaper-generator-$pkgver/requirements-linux.txt"
    
      31    pip install $SRCDEST/src/APICORE_Python-main
    
      32}
    
      33build(){
    
      34    pyinstaller --noconfirm --onedir --windowed --icon "$SRCDEST/src/Wallpaper-generator-$pkgver/NewIcon.ico" --name "Wallpaper Generator NEXT" --add-data "$SRCDEST/src/Wallpaper-generator-$pkgver/BACKIMG1.png:." --add-data "$SRCDEST/src/Wallpaper-generator-$pkgver/NewIcon.ico:." --add-data "$SRCDEST/src/Wallpaper-generator-$pkgver/None.ico:." --add-data "$SRCDEST/src/Wallpaper-generator-$pkgver/boolean_ui.py:." --add-data "$SRCDEST/src/Wallpaper-generator-$pkgver/emum_ui.py:." --add-data "$SRCDEST/src/Wallpaper-generator-$pkgver/Exception_Handler.py:." --add-data "$SRCDEST/src/Wallpaper-generator-$pkgver/integer_ui.py:." --add-data "$SRCDEST/src/Wallpaper-generator-$pkgver/MainWindowTemplate_ui.py:." --add-data "$SRCDEST/src/Wallpaper-generator-$pkgver/MarketTemplate_ui.py:." --add-data "$SRCDEST/src/Wallpaper-generator-$pkgver/PageTemplate_ui.py:." --add-data "$SRCDEST/src/Wallpaper-generator-$pkgver/SettingsPage_ui.py:." --add-data "$SRCDEST/src/Wallpaper-generator-$pkgver/string_ui.py:." --add-data "$SRCDEST/src/Wallpaper-generator-$pkgver/V4Resources.qrc:." --add-data "$SRCDEST/src/Wallpaper-generator-$pkgver/V4Resources_rc.py:." --add-data "$SRCDEST/src/Wallpaper-generator-$pkgver/WelcomePage_ui.py:." --add-data "$SRCDEST/src/Wallpaper-generator-$pkgver/WelcomePageNext_ui.py:." --add-data "$SRCDEST/src/Wallpaper-generator-$pkgver/acw_next:acw_next/" --add-data "$SRCDEST/src/Wallpaper-generator-$pkgver/fonts:fonts/" --add-data "$SRCDEST/src/Wallpaper-generator-$pkgver/Kernel:Kernel/" --add-data "$SRCDEST/src/Wallpaper-generator-$pkgver/UI:UI/"  "$SRCDEST/src/Wallpaper-generator-$pkgver/MainWindow.py"
    
      35    cp -r $SRCDEST/src/Pre-Use/* "$SRCDEST/src/dist/Wallpaper Generator NEXT"
    
      36}
    
      37package(){
    
      38    mkdir -p "$pkgdir/opt/wallpaper-genrator-next" "$pkgdir/usr/share/applications/"
    
      39    cp -r $SRCDEST/src/dist/Wallpaper\ Generator\ NEXT/* "$pkgdir/opt/wallpaper-genrator-next"
    
      40    cp "$SRCDEST/src/wallpaper-generator-next.desktop" "$pkgdir/usr/share/applications"
    
      41}
    
      42

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2