azurlaneautoscript
LOW
maintainer vitoriapires
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The pip installs are for project dependencies from public indexes, part of normal Python packaging; the source is the official GitHub repo, and no untrusted or obfuscated payloads are involved.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip installs are for project dependencies from public indexes, part of normal Python packaging; the source is the official GitHub repo, and no untrusted or obfuscated payloads are involved.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
pip install of an external package
pip_install_external
`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:46
pip install --upgrade --no-cache-dir pip -
PKGBUILD:48
pip install --no-cache-dir -r deploy/docker/requirements.txt -
PKGBUILD:49
pip install --no-cache-dir mxnet-alas
PKGBUILD
3 offending line(s) highlighted
1
# Maintainer: Pqolk <tiangloo@outlook.com>
2
3
pkgname=azurlaneautoscript
4
pkgver=2026.03.28
5
pkgrel=1
6
pkgdesc="Azur Lane bot (CN/EN/JP/TW) 碧蓝航线脚本 | 无缝委托科研，全自动大世界"
7
arch=('x86_64')
8
url="https://github.com/LmeSzinc/AzurLaneAutoScript"
9
license=('GPL3')
10
depends=(
11
'android-tools'
12
'git'
13
)
14
makedepends=(
15
'expat' 'bzip2' 'gdbm' 'openssl' 'libffi' 'zlib' 'libnsl'
16
'sqlite' 'mpdecimal' 'xz' 'tk'
17
)
18
options=(!debug !strip)
19
source=(
20
"https://www.python.org/ftp/python/3.7.17/Python-3.7.17.tar.xz"
21
)
22
sha512sums=(
23
'86ba1c953e7b4bce70445d1616cc0d428b50937f6a874811584df8bf23c3e2ba3e5d48dec00e629a47f4216f3ca50dc5389cd485fbc315f51000d8750403b5f0')
24
25
build() {
26
cd "${srcdir}"
27
28
# 1. 编译 Python 3.7（静态链接，快速）
29
tar -xf Python-3.7.17.tar.xz
30
cd Python-3.7.17
31
./configure --prefix="${srcdir}/python37" --without-ensurepip
32
make -j$(nproc)
33
make install
34
35
cd "${srcdir}"
36
git clone "https://github.com/LmeSzinc/AzurLaneAutoScript.git" "${pkgname}"
37
38
# 2. 创建虚拟环境（--copies 保证可移植，但标准库仍需 pyvenv.cfg 指向 home）
39
cd "${srcdir}/${pkgname}"
40
rm -rf "${srcdir}/venv"
41
"${srcdir}/python37/bin/python3.7" -m venv --copies "${srcdir}/venv"
42
source "${srcdir}/venv/bin/activate"
43
44
# 3. 安装 pip 和项目依赖
45
python -m ensurepip --upgrade
46
pip install --upgrade --no-cache-dir pip
47
sed -i '/^\s*av\s*==/d' deploy/docker/requirements.txt
48
pip install --no-cache-dir -r deploy/docker/requirements.txt
49
pip install --no-cache-dir mxnet-alas
50
51
# 验证
52
python -c "import rich" || { echo "ERROR: rich not installed"; exit 1; }
53
deactivate
54
55
# 清理字节码
56
find "${srcdir}/venv" -type d -name "__pycache__" -exec rm -rf {} +
57
find "${srcdir}/venv" -type f -name "*.pyc" -delete
58
}
59
60
package() {
61
cd "${srcdir}"
62
63
# 1. 安装整个 python37 基础解释器（提供标准库）
64
install -dm755 "${pkgdir}/opt/${pkgname}/python37"
65
cp -a python37/* "${pkgdir}/opt/${pkgname}/python37"
66
67
# 2. 安装应用代码
68
install -dm755 "${pkgdir}/opt/${pkgname}/app"
69
cp -a "${pkgname}/." "${pkgdir}/opt/${pkgname}/app"
70
71
# 3. 安装虚拟环境
72
cp -a venv "${pkgdir}/opt/${pkgname}/venv"
73
74
# 4. 修正虚拟环境的路标文件 pyvenv.cfg，让解释器找到标准库
75
sed -i "s|home = .*|home = /opt/${pkgname}/python37|" \
76
"${pkgdir}/opt/${pkgname}/venv/pyvenv.cfg"
77
78
# 5. 修正 activate 脚本中的 VIRTUAL_ENV
79
sed -i "s|VIRTUAL_ENV=.*|VIRTUAL_ENV=\"/opt/${pkgname}/venv\"|" \
80
"${pkgdir}/opt/${pkgname}/venv/bin/activate"
81
82
# 6. 确保权限
83
chmod -R u+rwX,go+rX,go-w "${pkgdir}/opt/${pkgname}"
84
85
# 7. 配置文件
86
cp "${pkgdir}/opt/${pkgname}/app/config/deploy.template-linux.yaml" \
87
"${pkgdir}/opt/${pkgname}/app/config/deploy.yaml"
88
install -dm755 "${pkgdir}/etc/${pkgname}"
89
ln -sf "/opt/${pkgname}/app/config/alas.json" "${pkgdir}/etc/${pkgname}/alas.json"
90
ln -sf "/opt/${pkgname}/app/config/deploy.yaml" "${pkgdir}/etc/${pkgname}/deploy.yaml"
91
92
# 8. 启动脚本
93
install -Dm755 /dev/stdin "${pkgdir}/usr/bin/${pkgname}" <<'EOF'
94
#!/bin/bash
95
source /opt/azurlaneautoscript/venv/bin/activate
96
exec python /opt/azurlaneautoscript/app/gui.py "$@"
97
EOF
98
# 9. 系统服务
99
install -Dm644 /dev/stdin "${pkgdir}/usr/lib/systemd/system/${pkgname}.service" <<'EOF'
100
[Unit]
101
Description=AzurLaneAutoScript Service
102
After=network.target
103
104
[Service]
105
Type=simple
106
ExecStart=/usr/bin/azurlaneautoscript
107
Restart=on-failure
108
109
# 限制写入权限
110
#ProtectSystem=strict
111
#ReadWritePaths=/opt/azurlaneautoscript /tmp /var/tmp /usr/bin/azurlaneautoscript
112
113
# 限制服务运行的文件系统访问
114
#ProtectHome=true
115
#NoNewPrivileges=true
116
117
[Install]
118
WantedBy=multi-user.target
119
120
EOF
121
122
}
123
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |