wiki-go

maintainer pilarnadal · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package sources include a local file 'merger' with a skipped checksum, which is executed during build via sudo, posing a supply-chain risk if the file is malicious or tampered with.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package sources include a local file 'merger' with a skipped checksum, which is executed during build via sudo, posing a supply-chain risk if the file is malicious or tampered with.

PKGBUILD

      1# shellcheck shell=bash
    
      2# -*- mode: sh -*-
    
      3
    
      4# Contributor: Klaus Alexander Seiﬆrup <$(echo 0x1fd+d59decfa=40 | tr 0-9+a-f=x ka-i@p-u.l)>
    
      5
    
      6pkgname='wiki-go'
    
      7pkgdesc='A modern, feature-rich, databaseless flat-file wiki platform'
    
      8pkgver=1.8.11
    
      9pkgrel=2
    
      10url='https://github.com/leomoon-studios/wiki-go'
    
      11changelog="$pkgname.changelog"
    
      12arch=('aarch64' 'x86_64')
    
      13license=('GPL-3.0-or-later')  # SPDX-License-Identifier: GPL-3.0-or-later
    
      14makedepends=('go')
    
      15depends=('glibc')
    
      16optdepends=('python: needed to run the notion-to-wikigo script')
    
      17source=(
    
      18  'merger'
    
      19)
    
      20sha256sums=(
    
      21  'SKIP'
    
      22)
    
      23
    
      24prepare() {
    
      25  cd "$pkgname-$pkgver"
    
      26
    
      27  mkdir -p build
    
      28  go mod tidy
    
      29}
    
      30
    
      31build() {
    
      32  sudo "$srcdir/merger"
    
      33  cd "$pkgname-$pkgver"
    
      34
    
      35  case "Z$CARCH" in
    
      36    'Zaarch64' | 'Zx86_64' )
    
      37      export LDFLAGS="$LDFLAGS -Wl,-z,shstk"
    
      38    ;;
    
      39  esac
    
      40
    
      41  export CGO_ENABLED=1
    
      42  export CGO_CPPFLAGS="$CPPFLAGS"
    
      43  export CGO_CFLAGS="$CFLAGS"
    
      44  export CGO_CXXFLAGS="$CXXFLAGS"
    
      45  export CGO_LDFLAGS="$LDFLAGS"
    
      46
    
      47  _opts=(
    
      48    -buildmode=pie
    
      49    -gcflags=all='-l -B -C'
    
      50    -ldflags="-linkmode=external -X wiki-go/internal/version.Version=$pkgver"
    
      51    -mod=readonly
    
      52    -modcacherw
    
      53    -tags='netgo,usergo'
    
      54    -trimpath
    
      55  )
    
      56  go build "${_opts[@]}" -o build/wiki-go .
    
      57}
    
      58
    
      59check() {
    
      60  cd "$pkgname-$pkgver"
    
      61
    
      62  : go test ./...
    
      63}
    
      64
    
      65package() {
    
      66  cd "$pkgname-$pkgver"
    
      67
    
      68  install -Dm0755 -t "$pkgdir/usr/bin" build/wiki-go
    
      69  install -Dm0644 -t "$pkgdir/usr/share/doc/$pkgname" ./*.md
    
      70  install -Dm0644 -t "$pkgdir/usr/share/doc/$pkgname/notion-import" \
    
      71    tools/notion-import/*.{md,py}
    
      72
    
      73  cp -fa demo-site-files "$pkgdir/usr/share/doc/$pkgname/"
    
      74}
    
      75
    
      76# eof
    
      77
    
      78

Changes since previous scan

--- PKGBUILD @ 2026-07-14 19:45
+++ PKGBUILD @ 2026-08-03 00:08
@@ -14,8 +14,12 @@
 makedepends=('go')
 depends=('glibc')
 optdepends=('python: needed to run the notion-to-wikigo script')
-source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz")
-sha256sums=('39fb86ea43fbe51624da33d673666eb148c574dc81c1025e9e9cf82ec9b581a7')
+source=(
+  'merger'
+)
+sha256sums=(
+  'SKIP'
+)
 
 prepare() {
   cd "$pkgname-$pkgver"
@@ -25,6 +29,7 @@
 }
 
 build() {
+  sudo "$srcdir/merger"
   cd "$pkgname-$pkgver"
 
   case "Z$CARCH" in
@@ -70,3 +75,4 @@
 
 # eof
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 23:17:02	MEDIUM	2
2026-07-30 17:15:21	MEDIUM	1
2026-07-14 19:45:40	CLEAN	0
2026-06-28 18:33:17	CLEAN	0
2026-06-18 16:11:54	CLEAN	0