azurlaneautoscript

maintainer vitoriapires · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The pip installs are for project dependencies from public indexes, part of normal Python packaging; the source is the official GitHub repo, and no untrusted or obfuscated payloads are involved.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip installs are for project dependencies from public indexes, part of normal Python packaging; the source is the official GitHub repo, and no untrusted or obfuscated payloads are involved.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:46 pip install --upgrade --no-cache-dir pip
PKGBUILD:48 pip install --no-cache-dir -r deploy/docker/requirements.txt
PKGBUILD:49 pip install --no-cache-dir mxnet-alas

PKGBUILD

3 offending line(s) highlighted

      1# Maintainer: Pqolk <tiangloo@outlook.com>
    
      2
    
      3pkgname=azurlaneautoscript
    
      4pkgver=2026.03.28
    
      5pkgrel=1
    
      6pkgdesc="Azur Lane bot (CN/EN/JP/TW) 碧蓝航线脚本 | 无缝委托科研，全自动大世界"
    
      7arch=('x86_64')
    
      8url="https://github.com/LmeSzinc/AzurLaneAutoScript"
    
      9license=('GPL3')
    
      10depends=(
    
      11  'android-tools'
    
      12  'git'
    
      13)
    
      14makedepends=(
    
      15  'expat' 'bzip2' 'gdbm' 'openssl' 'libffi' 'zlib' 'libnsl'
    
      16  'sqlite' 'mpdecimal' 'xz' 'tk'
    
      17)
    
      18options=(!debug !strip)
    
      19source=(
    
      20  "https://www.python.org/ftp/python/3.7.17/Python-3.7.17.tar.xz"
    
      21)
    
      22sha512sums=(
    
      23            '86ba1c953e7b4bce70445d1616cc0d428b50937f6a874811584df8bf23c3e2ba3e5d48dec00e629a47f4216f3ca50dc5389cd485fbc315f51000d8750403b5f0')
    
      24
    
      25build() {
    
      26    cd "${srcdir}"
    
      27
    
      28    # 1. 编译 Python 3.7（静态链接，快速）
    
      29    tar -xf Python-3.7.17.tar.xz
    
      30    cd Python-3.7.17
    
      31    ./configure --prefix="${srcdir}/python37" --without-ensurepip
    
      32    make -j$(nproc)
    
      33    make install
    
      34
    
      35    cd "${srcdir}"
    
      36    git clone "https://github.com/LmeSzinc/AzurLaneAutoScript.git" "${pkgname}"
    
      37
    
      38    # 2. 创建虚拟环境（--copies 保证可移植，但标准库仍需 pyvenv.cfg 指向 home）
    
      39    cd "${srcdir}/${pkgname}"
    
      40    rm -rf "${srcdir}/venv"
    
      41    "${srcdir}/python37/bin/python3.7" -m venv --copies "${srcdir}/venv"
    
      42    source "${srcdir}/venv/bin/activate"
    
      43
    
      44    # 3. 安装 pip 和项目依赖
    
      45    python -m ensurepip --upgrade
    
      46    pip install --upgrade --no-cache-dir pip
    
      47    sed -i '/^\s*av\s*==/d' deploy/docker/requirements.txt
    
      48    pip install --no-cache-dir -r deploy/docker/requirements.txt
    
      49    pip install --no-cache-dir mxnet-alas
    
      50
    
      51    # 验证
    
      52    python -c "import rich" || { echo "ERROR: rich not installed"; exit 1; }
    
      53    deactivate
    
      54
    
      55    # 清理字节码
    
      56    find "${srcdir}/venv" -type d -name "__pycache__" -exec rm -rf {} +
    
      57    find "${srcdir}/venv" -type f -name "*.pyc" -delete
    
      58}
    
      59
    
      60package() {
    
      61    cd "${srcdir}"
    
      62
    
      63    # 1. 安装整个 python37 基础解释器（提供标准库）
    
      64    install -dm755 "${pkgdir}/opt/${pkgname}/python37"
    
      65    cp -a python37/* "${pkgdir}/opt/${pkgname}/python37"
    
      66
    
      67    # 2. 安装应用代码
    
      68    install -dm755 "${pkgdir}/opt/${pkgname}/app"
    
      69    cp -a "${pkgname}/." "${pkgdir}/opt/${pkgname}/app"
    
      70
    
      71    # 3. 安装虚拟环境
    
      72    cp -a venv "${pkgdir}/opt/${pkgname}/venv"
    
      73
    
      74    # 4. 修正虚拟环境的路标文件 pyvenv.cfg，让解释器找到标准库
    
      75    sed -i "s|home = .*|home = /opt/${pkgname}/python37|" \
    
      76        "${pkgdir}/opt/${pkgname}/venv/pyvenv.cfg"
    
      77
    
      78    # 5. 修正 activate 脚本中的 VIRTUAL_ENV
    
      79    sed -i "s|VIRTUAL_ENV=.*|VIRTUAL_ENV=\"/opt/${pkgname}/venv\"|" \
    
      80        "${pkgdir}/opt/${pkgname}/venv/bin/activate"
    
      81
    
      82    # 6. 确保权限
    
      83    chmod -R u+rwX,go+rX,go-w "${pkgdir}/opt/${pkgname}"
    
      84
    
      85    # 7. 配置文件
    
      86    cp "${pkgdir}/opt/${pkgname}/app/config/deploy.template-linux.yaml" \
    
      87       "${pkgdir}/opt/${pkgname}/app/config/deploy.yaml"
    
      88    install -dm755 "${pkgdir}/etc/${pkgname}"
    
      89    ln -sf "/opt/${pkgname}/app/config/alas.json" "${pkgdir}/etc/${pkgname}/alas.json"
    
      90    ln -sf "/opt/${pkgname}/app/config/deploy.yaml" "${pkgdir}/etc/${pkgname}/deploy.yaml"
    
      91
    
      92    # 8. 启动脚本
    
      93    install -Dm755 /dev/stdin "${pkgdir}/usr/bin/${pkgname}" <<'EOF'
    
      94#!/bin/bash
    
      95source /opt/azurlaneautoscript/venv/bin/activate
    
      96exec python /opt/azurlaneautoscript/app/gui.py "$@"
    
      97EOF
    
      98    # 9. 系统服务
    
      99    install -Dm644 /dev/stdin "${pkgdir}/usr/lib/systemd/system/${pkgname}.service" <<'EOF'
    
      100[Unit]
    
      101Description=AzurLaneAutoScript Service
    
      102After=network.target
    
      103
    
      104[Service]
    
      105Type=simple
    
      106ExecStart=/usr/bin/azurlaneautoscript
    
      107Restart=on-failure
    
      108
    
      109# 限制写入权限
    
      110#ProtectSystem=strict
    
      111#ReadWritePaths=/opt/azurlaneautoscript /tmp /var/tmp /usr/bin/azurlaneautoscript
    
      112
    
      113# 限制服务运行的文件系统访问
    
      114#ProtectHome=true
    
      115#NoNewPrivileges=true
    
      116
    
      117[Install]
    
      118WantedBy=multi-user.target
    
      119
    
      120EOF
    
      121
    
      122}
    
      123

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2