argus-tracker
maintainer theguardian
· 0 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The pip installs fetch well-known PyPI packages (fastapi, uvicorn, pillow, psutil, etc.) with version pins from the project's own declared dependencies; the wheel itself is built from the project's official GitHub release tarball with a sha256 checksum. The main concern is that pip pulls transitive dependencies from PyPI at build time without pinned hashes, but all named packages are legitimate and widely used, making this a normal (if slightly sloppy) venv-based AUR package rather than a genuine supply-chain threat.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 75%): The pip installs fetch well-known PyPI packages (fastapi, uvicorn, pillow, psutil, etc.) with version pins from the project's own declared dependencies; the wheel itself is built from the project's official GitHub release tarball with a sha256 checksum. The main concern is that pip pulls transitive dependencies from PyPI at build time without pinned hashes, but all named packages are legitimate and widely used, making this a normal (if slightly sloppy) venv-based AUR package rather than a genuine supply-chain threat.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
pip install of an external package
pip_install_external
`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:67
"$srcdir/venv/bin/python" -m pip install --upgrade pip
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Adarsh Senghani <adarsh@retainia.com>
2
#
3
# THIS is the AUR-published PKGBUILD (package: argus-tracker). It differs
4
# from packaging/arch/PKGBUILD in ONE important way: it is fully
5
# self-contained and builds from a downloaded release tarball
6
# (source=()), NOT from the surrounding repo tree. The AUR builds each
7
# package in isolation with only what source=() fetches — there is no
8
# repo checkout to copy from, so the $startdir/../.. trick used by
9
# packaging/arch/PKGBUILD (a convenience for local `makepkg -si` from a
10
# working copy) cannot work here.
11
#
12
# Everything else (venv-under-/opt rationale, --system-site-packages for
13
# PyGObject/GStreamer GI bindings, the python-SONAME-bump rebuild caveat,
14
# the argus-tracker vs argus naming) is identical — see
15
# packaging/arch/PKGBUILD's top-of-file comments for the full reasoning.
16
#
17
# On each upstream release, CI regenerates the sha256 + .SRCINFO and pushes
18
# this file to the AUR (see .github/workflows/release.yml, publish-aur job).
19
pkgname=argus-tracker
20
pkgver=0.3.0
21
pkgrel=1
22
pkgdesc="Always-on personal desktop activity tracker (KDE Plasma / Wayland)"
23
arch=('x86_64')
24
url="https://github.com/Adarsh077/argus"
25
provides=('argus')
26
conflicts=('argus')
27
replaces=('argus')
28
# license=('...') # omitted: no LICENSE file in the repo yet
29
depends=(
30
'python'
31
'python-gobject' # GI bindings — system package only, never pip
32
'gstreamer'
33
'gst-plugins-base' # videoconvert/audioconvert/audioresample/audiomixer
34
'gst-plugins-good' # mp4mux (isomp4) + pulsesrc
35
'gst-plugins-ugly' # x264enc (H.264 encode)
36
'gst-plugin-rsaudiofx' # audiornnoise (RNNoise mic denoise, preferred)
37
'gst-plugins-bad' # webrtcdsp (mic noise suppression fallback)
38
'webrtc-audio-processing' # backing library for webrtcdsp
39
'gst-libav' # avenc_aac (AAC encode)
40
'gst-plugin-pipewire'
41
'pipewire'
42
'pipewire-pulse' # pulsesrc mic + sink .monitor
43
'libpulse' # pactl for audio-device resolution
44
'xdg-desktop-portal-kde'
45
'libayatana-appindicator'
46
'kdotool' # AUR dep; paru/yay resolve it transitively
47
)
48
makedepends=('uv' 'rsync')
49
options=('!strip') # vendored third-party wheels — leave their binaries alone
50
install=argus.install
51
# GitHub tag tarball. Extracts to argus-$pkgver/ (repo name is `argus`,
52
# tag is v$pkgver). CI keeps the checksum current via updpkgsums.
53
source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz")
54
sha256sums=('ee5f78bbaad8c597e559132335494b0035976e32a7a8e3dede4df21c288c6418')
55
56
_src() { echo "$srcdir/argus-$pkgver"; }
57
58
build() {
59
cd "$(_src)"
60
rm -rf dist
61
uv build
62
63
# venv with --system-site-packages so it can see the Arch-packaged
64
# python-gobject / GStreamer GI bindings (depends= above); these are not
65
# reliably pip-installable and must never come from PyPI.
66
python -m venv --system-site-packages "$srcdir/venv"
67
"$srcdir/venv/bin/python" -m pip install --upgrade pip
68
69
# Install the built wheel with --no-deps so pip never tries to pull
70
# pygobject from PyPI, then install the pure-Python deps explicitly
71
# (mirrors pyproject [project.dependencies] minus pygobject [system] and
72
# pywin32 [Windows-only]).
73
"$srcdir/venv/bin/python" -m pip install --no-deps \
74
"$(_src)"/dist/argus-${pkgver}-py3-none-any.whl
75
"$srcdir/venv/bin/python" -m pip install \
76
'dbus-next>=0.2.3' \
77
'fastapi>=0.139.0' \
78
'httpx>=0.28.1' \
79
'jinja2>=3.1.6' \
80
'markdown>=3.10.2' \
81
'mss>=10.2.0' \
82
'opencv-python>=5.0.0.93' \
83
'pillow>=12.3.0' \
84
'platformdirs>=4.10.0' \
85
'psutil>=7.2.2' \
86
'pystray>=0.19.5' \
87
'python-multipart>=0.0.32' \
88
'tomli-w>=1.2.0' \
89
'uvicorn[standard]>=0.49.0'
90
}
91
92
package() {
93
install -dm755 "$pkgdir/opt/argus"
94
cp -a "$srcdir/venv" "$pkgdir/opt/argus/venv"
95
96
# Wrapper runs the venv interpreter on the console script directly (the
97
# script's baked shebang points at the transient build-time venv path).
98
install -Dm755 /dev/stdin "$pkgdir/usr/bin/argus" <<'EOF'
99
#!/bin/sh
100
exec /opt/argus/venv/bin/python /opt/argus/venv/bin/argus "$@"
101
EOF
102
103
# systemd --user unit, ExecStart repointed at the packaged binary.
104
install -Dm644 "$(_src)/packaging/arch/argus.service" \
105
"$pkgdir/usr/lib/systemd/user/argus.service"
106
sed -i 's#^ExecStart=.*#ExecStart=/usr/bin/argus run#' \
107
"$pkgdir/usr/lib/systemd/user/argus.service"
108
109
# Globally enable the user unit for every user's graphical session at
110
# package-install time. Pacman hooks run outside any login session (no
111
# D-Bus, no `systemctl --user enable` possible), so instead we ship the
112
# enablement symlink the way `systemctl --user enable` would create it,
113
# but in the package-owned /usr/lib tree: systemd reads
114
# <unit-dir>/<target>.wants/ for user units, so this makes argus.service
115
# start automatically on the next graphical login for all users, no
116
# manual per-user step. (Matches the unit's own WantedBy=.)
117
install -dm755 "$pkgdir/usr/lib/systemd/user/graphical-session.target.wants"
118
ln -s ../argus.service \
119
"$pkgdir/usr/lib/systemd/user/graphical-session.target.wants/argus.service"
120
121
# Tray autostart at graphical login.
122
install -Dm644 "$(_src)/packaging/arch/argus-tray.desktop" \
123
"$pkgdir/etc/xdg/autostart/argus-tray.desktop"
124
}
125
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 3 |
| 2026-07-17 00:06:16 | LOW | 3 |
| 2026-07-16 00:05:41 | LOW | 3 |
| 2026-07-15 00:09:25 | LOW | 3 |