alchemy-viewer-git

maintainer XenHat · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The pip install in prepare() is for official build tools (cmake, llbase, llsd, etc.) from PyPI, which is a standard and trusted source for Python packages; this is a normal part of the build process for the project and does not introduce untrusted or malicious code.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install in prepare() is for official build tools (cmake, llbase, llsd, etc.) from PyPI, which is a standard and trusted source for Python packages; this is a normal part of the build process for the project and does not introduce untrusted or malicious code.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:66 pip3 install --upgrade cmake llbase llsd certifi autobuild ninja

PKGBUILD

1 offending line(s) highlighted

      1# template start; name=systemd-git; version=1.0;
    
      2# template start; name=base; version=1.0;
    
      3# Maintainer: XenHat <aur@xenh.at>
    
      4# Contributor: Justin Jagieniak <justin@jagieniak.net>
    
      5# Contributor: Rye Mutt
    
      6#
    
      7# shellcheck disable=2034,3030,2154
    
      8pkgdesc="A Second Life client with focus on performance and code correctness - Git build."
    
      9arch=('x86_64')
    
      10license=('LGPL')
    
      11options=('!buildflags' '!lto' '!strip')
    
      12url="https://www.alchemyviewer.org"
    
      13install=alchemy.install
    
      14# template end;
    
      15# template start; name=deps; version=1.0;
    
      16depends=('glu' 'libgl' 'libiconv' 'libidn' 'libjpeg-turbo' 'libpng' 'libxml2' 'libxss' 'mesa' 'nss' 'openal' 'sdl2' 'vlc' 'zlib')
    
      17makedepends=('gcc' 'python-pip' 'python-virtualenv' 'git' 'procps-ng')
    
      18optdepends=(
    
      19  'alsa-lib: ALSA support'
    
      20  'freealut: OpenAL support'
    
      21  'gamemode: Gamemode support'
    
      22  'lib32-libidn11: SLVoice support'
    
      23  'lib32-libsndfile: SLVoice support'
    
      24  'lib32-util-linux: SLVoice support'
    
      25  'lib32-gstreamer0.10: SLVoice support'
    
      26  'libpulse: PulseAudio support'
    
      27  'mesa-libgl: Intel, Radeon, Nouveau support'
    
      28  'nvidia-libgl: NVIDIA support'
    
      29  'nvidia-utils: NVIDIA support'
    
      30  'wine: More up-to-date, less buggy SLVoice support'
    
      31  'xdg-desktop-portal: File picker portal')
    
      32# template end;
    
      33pkgname=alchemy-viewer-git
    
      34pkgver=7.1.9.57706.62533287a9
    
      35pkgrel=3
    
      36replaces=('alchemy-next-viewer-git')
    
      37provides=('alchemy-viewer')
    
      38# template start; name=source; version=1.0;
    
      39source=("${pkgname}"::'git+https://github.com/AlchemyViewer/Alchemy.git#branch='"${AL_BRANCH_OVERRIDE:-main}")
    
      40sha256sums=('SKIP')
    
      41# template end;
    
      42depends+=('dbus-glib' 'systemd-libs')
    
      43conflicts+=("alchemy-viewer-nosystemd-git")
    
      44
    
      45# template start; name=pkgver; version=1.0;
    
      46pkgver() {
    
      47  cd "${pkgname}" || exit 1
    
      48  (
    
      49  set -o pipefail
    
      50  vwr_version=$(cat indra/newview/VIEWER_VERSION.txt)
    
      51  rev=$(git rev-list --count HEAD)
    
      52  short=$(git rev-parse --short HEAD)
    
      53  printf "%s.%s.%s" "${vwr_version}" "${rev}" "${short}"
    
      54)
    
      55}
    
      56# template end;
    
      57
    
      58# template start; name=prepare; version=1.0;
    
      59prepare() {
    
      60  cd ${srcdir} || exit
    
      61    echo "Creating virtual environment in $PWD"
    
      62    virtualenv ".venv" -p python3
    
      63    source "${srcdir}/.venv/bin/activate"
    
      64
    
      65    echo "Installing build toolchain..."
    
      66    pip3 install --upgrade cmake llbase llsd certifi autobuild ninja
    
      67}
    
      68# template end;
    
      69
    
      70# template start; name=build; version=1.0;
    
      71build() {
    
      72  cd "${pkgname}" || exit 1
    
      73  source "${srcdir}/.venv/bin/activate"
    
      74echo ""
    
      75echo "Configuring the build"
    
      76
    
      77_logfile="build.${CARCH}.$(date +%s).log"
    
      78build_jobs=$(nproc)
    
      79
    
      80AL_CMAKE_CONFIG=(
    
      81  -DLL_TESTS:BOOL=${ENABLE_TESTS:-ON}
    
      82  -DDISABLE_FATAL_WARNINGS=ON
    
      83  -DUSE_LTO:BOOL=OFF
    
      84  -DVIEWER_CHANNEL="Alchemy Test"
    
      85)
    
      86
    
      87if [[ " ${BUILDENV[*]} " =~ ' ccache ' ]] && command -v ccache >/dev/null 2>&1; then
    
      88  AL_CMAKE_CONFIG+=("-DCMAKE_CXX_COMPILER_LAUNCHER=$(which ccache)")
    
      89  echo "ccache was found and will be used"
    
      90fi
    
      91if [[ -z "$NO_CLANG" ]] && command -v clang++ >/dev/null 2>&1; then
    
      92  AL_CMAKE_CONFIG+=("-DCMAKE_C_COMPILER=$(which clang)")
    
      93  AL_CMAKE_CONFIG+=("-DCMAKE_CXX_COMPILER=$(which clang++)")
    
      94  echo "clang was found and will be used instead of gcc"
    
      95fi
    
      96
    
      97if [[ -z "$NO_SMART_JOB_COUNT" ]]; then
    
      98  if [[ ${build_jobs} -gt 1 ]]; then
    
      99    # The viewer requires an average of 2GB of memory per core to link
    
      100    # Note: Behaviour change compared to the previous versions:
    
      101    # This script will no longer try to allocate build memory into swap
    
      102    # This is bad practice, and swap should be reserved to evict process
    
      103    # memory from physical ram to make place for the current workset.
    
      104    # This script will now try to check if swap is present and sufficent
    
      105    # for the current used memory to be stored in swap before allocating,
    
      106    # and will fallback to conservative allocation if swap is not available
    
      107    mempercorekb=$((1048576))
    
      108    requiredmemorykb=$(($(nproc) * mempercorekb))
    
      109    free_output="$(free --kilo --total | tail -n+2 | tr -s ' ')"
    
      110    physical_output=$(grep "Mem:" <<<"$free_output")
    
      111    totalmemorykbphysical=$(cut -d ' ' -f 2 <<<"$physical_output")
    
      112    usedmemorykbphysical=$(cut -d ' ' -f 3 <<<"$physical_output")
    
      113    # Don't factor in the caches, these will be flushed as needed
    
      114    #freememorykbphysical=$(cut -d ' ' -f 4 <<<"$physical_output")
    
      115    availablememorykbphysical=$(cut -d ' ' -f 7 <<<"$free_output")
    
      116    total_output=$(grep "Total:" <<<"$free_output")
    
      117    totalmemorykbcombined=$(cut -d ' ' -f 2 <<<"$total_output")
    
      118    usedmemorytotal=$(cut -d ' ' -f 2 <<<"$total_output")
    
      119    freememorytotal=$(cut -d ' ' -f 4 <<<"$total_output")
    
      120    swap_output=$(grep Swap: <<<"$free_output")
    
      121    # Determine available swap space
    
      122    availableswapkb=0
    
      123    if [[ -n "$swap_output" ]]; then
    
      124      availableswapkb=$(cut -d ' ' -f 4 <<<"$swap_output")
    
      125    fi
    
      126    echo "Required memory at $(nproc) jobs:         $((requiredmemorykb/1024/1024))GB"
    
      127    echo "Available memory (counting swap):   $((totalmemorykbcombined/1024/1024))GB"
    
      128    echo "Total RAM:                          $((totalmemorykbphysical/1024/1024))GB"
    
      129    if [[ ${requiredmemorykb} -gt ${totalmemorykbphysical} ]]; then
    
      130      echo "Not enough physical memory to use all cores"
    
      131      if [[ ${usedmemorykbphysical} -lt ${availableswapkb} ]]; then
    
      132        # There is enough swap to fit all the used memory. Use all physical ram as swap will do its job
    
      133        echo "Using swap memory to store current processes memory"
    
      134        # We do not want to compile in swap, so adjust accordingly
    
      135        jobs=$(((totalmemorykbphysical) / mempercorekb))
    
      136      else
    
      137        # TODO: Verify this logic on low-ram systems
    
      138        # Not enough swap to hold ram contents, calculate manually
    
      139        jobs=1
    
      140        echo "${jobs} job  would consume $(((jobs * mempercorekb) / 1024 / 1024))GB"
    
      141        while [[ $((jobs * mempercorekb)) -le ${availablememorykbphysical} ]]; do
    
      142          ((jobs++))
    
      143          echo "${jobs} jobs would consume $(((jobs * mempercorekb) / 1024 / 1024))GB"
    
      144        done
    
      145        # Back off one job count. Not sure why I have to do this but
    
      146      fi
    
      147      build_jobs=${jobs}
    
      148    fi
    
      149  fi
    
      150  echo "Adjusted job count: ${build_jobs}"
    
      151fi
    
      152export AUTOBUILD_CPU_COUNT=$build_jobs
    
      153
    
      154# And now we configure and build the viewer with our adjusted configuration
    
      155autobuild configure -A 64 -c ReleaseOS -- "${AL_CMAKE_CONFIG[@]}" > >(tee -a "$_logfile") 2> >(tee -a "$_logfile" >&2)
    
      156echo "Building with ${AUTOBUILD_CPU_COUNT} jobs"
    
      157autobuild build -A 64 -c ReleaseOS --no-configure > >(tee -a "$_logfile") 2> >(tee -a "$_logfile" >&2)
    
      158    }
    
      159# template end;
    
      160
    
      161# template start; name=package; version=1.0;
    
      162package() {
    
      163  mkdir -p "${pkgdir}/opt"
    
      164  mkdir -p "${pkgdir}/usr/local/share/applications"
    
      165  # Patch shortcut maker
    
      166  sed -i 's;Name=Alchemy;Name=Alchemy (git build);' "${pkgname}/build-linux-64/newview/packaged/etc/refresh_desktop_app_entry.sh"
    
      167  sed -i 's;alchemy-viewer\.desktop;'"${pkgname}\.desktop"';' "${pkgname}/build-linux-64/newview/packaged/etc/refresh_desktop_app_entry.sh"
    
      168  mv "${pkgname}/build-linux-64/newview/packaged" "${pkgdir}/opt/${pkgname}"
    
      169}
    
      170# template end;
    
      171# template end;
    
      172
    
      173

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2