weber-git

maintainer spynetS · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD has multiple real concerns: (1) It runs 'pip install flagser' during prepare() without any version pinning, hash verification, or sandboxing — this installs an arbitrary PyPI package directly into the build system (or user environment) with no integrity check, constituting a genuine supply-chain risk. (2) The source array is empty and the repo is cloned via git clone in prepare() with no commit hash or tag pinning, meaning the build pulls whatever HEAD is at build time with no reproducibility or integrity guarantee. (3) The pip install runs outside the package directory and installs system-wide (or into the user environment), which is non-standard and potentially harmful. The 'flagser' package on PyPI could be a typosquat or could be updated maliciously at any time. These are real supply-chain concerns involving executed code from unverified/unpinned sources, justifying a MEDIUM rating.

Triggered rules

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:29 pip install flagser

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD has multiple real concerns: (1) It runs 'pip install flagser' during prepare() without any version pinning, hash verification, or sandboxing — this installs an arbitrary PyPI package directly into the build system (or user environment) with no integrity check, constituting a genuine supply-chain risk. (2) The source array is empty and the repo is cloned via git clone in prepare() with no commit hash or tag pinning, meaning the build pulls whatever HEAD is at build time with no reproducibility or integrity guarantee. (3) The pip install runs outside the package directory and installs system-wide (or into the user environment), which is non-standard and potentially harmful. The 'flagser' package on PyPI could be a typosquat or could be updated maliciously at any time. These are real supply-chain concerns involving executed code from unverified/unpinned sources, justifying a MEDIUM rating.

PKGBUILD

1 offending line(s) highlighted

      1
    
      2# Maintainer: Alfred Roos alfred@stensatter.se
    
      3pkgname=weber-git
    
      4pkgver=1.0.5
    
      5pkgrel=1
    
      6epoch=
    
      7pkgdesc="compiles html components to pages"
    
      8arch=(x86_64)
    
      9url="https://github.com/SharkooMaster/weber.git"
    
      10license=('GPL-2.0')
    
      11groups=()
    
      12depends=(python)
    
      13makedepends=(python-pip)
    
      14checkdepends=()
    
      15optdepends=()
    
      16provides=()
    
      17conflicts=()
    
      18replaces=()
    
      19backup=()
    
      20options=()
    
      21install=
    
      22changelog=
    
      23source=()
    
      24noextract=()
    
      25md5sums=()
    
      26validpgpkeys=()
    
      27
    
      28prepare() {
    
      29    pip install flagser
    
      30    git clone https://github.com/SharkooMaster/weber.git
    
      31}
    
      32
    
      33package() {
    
      34    cd weber
    
      35    sed -i -e '1i#!/bin/python\' ./compile.py
    
      36    install -Dm755 ./compile.py "$pkgdir/usr/bin/weber" 
    
      37    install -Dm755 ./watcher.py "$pkgdir/usr/bin/watcher.py" 
    
      38    install -Dm755 ./generateFiles.py "$pkgdir/usr/bin/generateFiles.py" 
    
      39}
    
      40

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2