changedetection.io

maintainer tbh · 3 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs two Python packages, 'panzi-json-logic' and 'janus', via pip from external sources during packaging, which are not in the declared dependencies and could introduce supply-chain risks if the sources are compromised.

Triggered rules

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:73 PIP_CONFIG_FILE=/dev/null pip install --isolated --target="$pkgdir/usr/lib/changedetection.io" --ignore-installed --no-deps panzi-json-logic janus

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package installs two Python packages, 'panzi-json-logic' and 'janus', via pip from external sources during packaging, which are not in the declared dependencies and could introduce supply-chain risks if the sources are compromised.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Tristan Hill
    
      2
    
      3pkgname=changedetection.io
    
      4pkgver=0.55.8
    
      5pkgrel=1
    
      6pkgdesc='change monitoring of web pages'
    
      7arch=(any)
    
      8url='https://github.com/dgtlmoon/changedetection.io'
    
      9license=('Apache 2.0')
    
      10makedepends=(python-setuptools python-pip)
    
      11depends=(# ordered per https://github.com/dgtlmoon/changedetection.io/blob/master/requirements.txt
    
       python-pyee
    
       python-flask-compress
    
       python-eventlet
    
       python-validators
    
       python-timeago
    
       python-inscriptis
    
       python-feedgen
    
       python-flask-compress
    
       python-flask-login
    
       python-flask-paginate
    
       python-flask-expects-json
    
       python-flask-restful
    
       python-flask-cors
    
       # python-janus # not working without janus 2
    
       python-flask-wtf
    
       python-flask
    
       python-flask-socketio
    
       python-pytz
    
       python-requests
    
       python-urllib3
    
       python-chardet
    
       python-wtforms
    
       python-jsonpath-ng
    
       python-jq
    
       apprise
    
       python-paho-mqtt
    
       python-cryptography
    
       python-beautifulsoup4 
    
       python-lxml
    
       python-elementpath
    
       python-werkzeug
    
       python-jinja-time
    
       python-types-python-dateutil # required by jinja-time
    
       python-openpyxl
    
       python-pillow
    
       python-openapi-core
    
       python-loguru
    
       python-extruct
    
       python-babel
    
       python-price-parser
    
       python-puremagic
    
       python-pluggy
    
       python-pysocks
    
       python-markupsafe)
    
      56optdepends=('python-playwright: for fetching pages with javascript')
    
      57source=(https://github.com/dgtlmoon/changedetection.io/archive/refs/tags/$pkgver.tar.gz
    
      sysusers
    
      tmpfiles
    
      service
    
      chromium.service)
    
      62sha512sums=('0589a8bd5da2c6291ffb1682718e5d5f18e536784e2e509e202811a9438b227fb7becd513447b528548ff55ff455a7a9429d6a214e6db3e90ffcd867a419dc99'
    
          '5ef8b215bddc02b04d55d3699f27ad043461d8771591be2ebf0ed6390c58ab881426214173c8e1cc8bb36ecd7acebc5d69d760fc65b8a3b191b2116150748f53'
    
          '92b0921bd7d2d297087238366ece919272c8cf1f6685631bbbb8a6ad3817f6c4d9fd95ed626991ac12284aff93c66c3f8c6e9b4b77e959c91c1646dca39b8212'
    
          'eecd4b25411f6f47b81dd6849aae233b0928e19342818b9c7857bf291850b2cefb33cd35aa5877be1675c9642a8feee53b35d2e318a255547ef4ce07a30c9e1b'
    
          '3eb76f394f629e3c7dd49001654075be4cdcb3fb1d5014ff3f9e0174a8e013fb6e79f9538eeed6bf2169bd03827c5573dee4abe3fd551cf1477fcefe234f40c0')
    
      67
    
      68package() {
    
cd "$srcdir/$pkgname-$pkgver"
    
sed -i 's/[>~=]=.*//; /pyppeteer/d' requirements.txt
    
python setup.py install --root="$pkgdir" --optimize=1
    
# command per https://wiki.archlinux.org/title/Python_package_guidelines (now removed from page?)
    
PIP_CONFIG_FILE=/dev/null pip install --isolated --target="$pkgdir/usr/lib/changedetection.io" --ignore-installed --no-deps panzi-json-logic janus
    
python -O -m compileall -s ${pkgdir} "${pkgdir}/usr/lib/changedetection.io"
    
install -Dm644 "${srcdir}/sysusers" "${pkgdir}/usr/lib/sysusers.d/changedetection.io.conf"
    
install -Dm644 "${srcdir}/tmpfiles" "${pkgdir}/usr/lib/tmpfiles.d/changedetection.io.conf"
    
install -Dm644 "${srcdir}/service" "${pkgdir}/usr/lib/systemd/system/changedetection.io.service"
    
install -Dm644 "${srcdir}/chromium.service" "${pkgdir}/usr/lib/systemd/system/changedetection.io-chromium.service"
    
      79}
    
      80

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2