archivebox
LOW
maintainer jasongodev
11 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The pip install is used to install build dependencies from requirements.txt within a local venv during prepare(), which is a normal part of building the package from its own source; the dependencies are not external or arbitrary, and the build is self-contained.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install is used to install build dependencies from requirements.txt within a local venv during prepare(), which is a normal part of building the package from its own source; the dependencies are not external or arbitrary, and the build is self-contained.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
pip install of an external package
pip_install_external
`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:68
./venv/bin/pip install --upgrade --no-compile --no-cache-dir pip build pdm-backend installer -
PKGBUILD:69
./venv/bin/pip install --upgrade --no-compile --no-cache-dir -r requirements.txt
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: Jason Go <jasongo@jasongo.net>
2
# Contributor: Carl Smedstad <carsme@archlinux.org>
3
# Contributor: Hao Long <aur@esd.cc>
4
5
pkgname=archivebox
6
pkgver=0.7.3
7
pkgrel=2
8
pkgdesc='Open source self-hosted web archiving'
9
arch=('x86_64' 'aarch64')
10
url='https://github.com/ArchiveBox/ArchiveBox'
11
license=('MIT')
12
depends=(
13
'chromium'
14
'curl'
15
'ffmpeg'
16
'nodejs'
17
'procps-ng'
18
'postlight-parser'
19
'readability-extractor'
20
'ripgrep'
21
'single-file-cli'
22
'wget'
23
'yt-dlp'
24
25
# Starting v0.7.3-2, this AUR package will use Python 3.11.x which is also available in the AUR.
26
# The dependencies of ArchiveBox such as Django and SQLite function calls are only compatible with Python 3.11.x.
27
# The upstream did not made further attempts to backport archivebox 0.7.x branch to the latest Python
28
# and instead proceeded with the 0.8.x dev branch and the soon to be released 0.9.x branch.
29
# All prior Python modules managed by pacman are dropped because those only work with latest Python.
30
# We will use pip to download the dependencies during installation.
31
# The caveat is you need to be online during installation.
32
'python311'
33
)
34
makedepends=('git')
35
options=(!buildflags !debug !makeflags !strip)
36
source=(
37
"git+$url.git#tag=v$pkgver"
38
'archivebox-pre.hook'
39
'archivebox-post.hook'
40
)
41
sha256sums=(
42
'5a530b3e86332db33b24b675e98d9b8b3d0bd9148095aa3025495952c1d16834'
43
'dc6bfa6d11ac085d6871b7e6fb8641e945fd7ebef429b4f50c1d57ee9084d67b'
44
'8aec6b06fe483d080cc14b8ccb8b02b112c0524826db4c38fc7249df24dfbf7b'
45
)
46
47
prepare() {
48
cd 'ArchiveBox'
49
50
git submodule init
51
git config --remove-section submodule.brew_dist
52
git config --remove-section submodule.deb_dist
53
git config --remove-section submodule.docker
54
git config --remove-section submodule.pip_dist
55
git submodule update --init --recursive
56
57
{
58
echo '[tool.pdm.build]'
59
echo 'excludes = ['
60
echo ' "archivebox/vendor/base32-crockford",'
61
echo ' "archivebox/vendor/django-taggit",'
62
echo ' "archivebox/vendor/pocket",'
63
echo ' "archivebox/vendor/python-atomicwrites",'
64
echo ']'
65
} >> pyproject.toml
66
67
python3.11 -m venv venv
68
./venv/bin/pip install --upgrade --no-compile --no-cache-dir pip build pdm-backend installer
69
./venv/bin/pip install --upgrade --no-compile --no-cache-dir -r requirements.txt
70
}
71
72
build() {
73
cd 'ArchiveBox'
74
./venv/bin/python -m build --wheel
75
./venv/bin/python -m installer dist/*.whl
76
}
77
78
# Starting v0.7.3-2, check function is disabled to speed up installation.
79
# We may use this again if there's a compelling reason to do so.
80
#
81
# check() {
82
# cd 'ArchiveBox'
83
# ./venv/bin/pip install --upgrade --no-cache-dir pytest bottle
84
# PATH="$PWD/venv/bin:$PATH" ./venv/bin/python -m pytest tests
85
# ./venv/bin/pip uninstall --yes pytest bottle
86
# }
87
88
package() {
89
cd 'ArchiveBox'
90
91
#############
92
# 1. CLEANUP
93
#############
94
95
# Remove build related Python modules
96
./venv/bin/pip uninstall --yes build pdm-backend installer setuptools pip
97
98
# Remove bytecode cache remnants
99
find "$srcdir/ArchiveBox/venv" -type d -name "__pycache__" -exec rm -rf {} +
100
101
# Remove venv activate scripts as it may be executed by outside apps
102
find "$srcdir/ArchiveBox/venv/bin" -type f -iname "activate*" -delete
103
104
# Remove share docs and completions from other Python modules (yt_dlp)
105
rm -r "$srcdir/ArchiveBox/venv/share"
106
107
# Silence namcap warning
108
rm -r "$srcdir/ArchiveBox/venv/include"
109
110
111
################
112
# 2. COPY FILES
113
################
114
115
# Copy to /opt/archivebox
116
install -dm755 "$pkgdir/opt/archivebox"
117
cp -a -t "$pkgdir/opt/archivebox" venv/*
118
119
# Copy license and docs
120
install -Dm644 -t "$pkgdir/usr/share/licenses/$pkgname" LICENSE
121
install -dm755 "$pkgdir/usr/share/doc/$pkgname"
122
rm docs/README.md # remove redundant symbolic link
123
cp -a -t "$pkgdir/usr/share/doc/$pkgname" ./etc ./docs/*.md ./*.md
124
125
# Install hook file that aborts upgrade/removal if archivebox is running
126
install -Dm644 "$srcdir/archivebox-pre.hook" "$pkgdir/usr/share/libalpm/hooks/archivebox-pre.hook"
127
install -Dm644 "$srcdir/archivebox-post.hook" "$pkgdir/usr/share/libalpm/hooks/archivebox-post.hook"
128
129
130
#################
131
# 3. LINK BINARY
132
#################
133
install -dm755 "$pkgdir/usr/bin"
134
ln -s /opt/archivebox/bin/archivebox "$pkgdir/usr/bin/archivebox"
135
136
137
################
138
# 4. FIX PATHS
139
################
140
141
# Fix shebangs and paths to point to /opt/archivebox
142
find "$pkgdir/opt/archivebox/bin" -type f -exec sed -i "s|$srcdir/ArchiveBox/venv|/opt/archivebox|g" {} +
143
sed -i "s|$srcdir/ArchiveBox/venv|/opt/archivebox|g" "$pkgdir/opt/archivebox/pyvenv.cfg"
144
145
# Fix binary paths of the sample config files
146
sed -i "s|/usr/local/bin/archivebox|/usr/bin/archivebox|g" "$pkgdir/usr/share/doc/$pkgname/etc/archivebox.service"
147
sed -i "s|/usr/local/bin/archivebox|/usr/bin/archivebox|g" "$pkgdir/usr/share/doc/$pkgname/etc/crontabs/archivebox"
148
}
149
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |