dupeguru

maintainer fuan_k · 107 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The pip install runs on requirements.txt from the project's own source, which is a normal build step for Python projects and not an external untrusted package.

Triggered rules

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is LOW (confidence 95%): The pip install runs on requirements.txt from the project's own source, which is a normal build step for Python projects and not an external untrusted package.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:41 python3 -m pip install -r requirements.txt

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: fuan_k <rrkay at posteo dot net>
    
      2# Contributor: Bijaya Dangol <dangoldbj23@gmail.com>
    
      3# Contributor: Virgil Dupras <hsoft@hardcoded.net>
    
      4pkgname=dupeguru
    
      5pkgver=4.3.1
    
      6pkgrel=3
    
      7pkgdesc="Find duplicate files with various contents, using perceptual diff for pictures"
    
      8arch=('any')
    
      9url="https://dupeguru.voltaicideas.net/"
    
      10license=('GPL3')
    
      11depends=('python' 'python-pip' 'python-pyqt5' 'python-polib'
    
      12         'python-semantic-version' 'python-xxhash'
    
      13         'python-mutagen' 'python-send2trash' 'libxkbcommon-x11')
    
      14makedepends=('python-distro' 'python-sphinx' 'python-setuptools')
    
      15source=("https://github.com/arsenetar/${pkgname}/archive/refs/tags/${pkgver}.tar.gz"
    
      16	'0001-fix-Replace-use-of-imp-with-importlib.patch'
    
      17  '0002-setuptools-sandbox-deprecation.patch'
    
      18)
    
      19md5sums=('996f2a9bab1541c188f823e9647f341c'
    
      20	'd6874bc038efd92420517407665c7f69'
    
      21  '479f7be4a4bf64b92baff59dff20b1fd'
    
      22)
    
      23provides=('dupeguru')
    
      24conflicts=('dupeguru-git' 'dupeguru-se' 'dupeguru-pe' 'dupeguru-me')
    
      25
    
      26prepare() {
    
      27  cd "${srcdir}/${pkgname}-${pkgver}"
    
      28  sed -i -E 's/polib.*/polib>=1.1.0/g' requirements.txt
    
      29  sed -i -E '125s/.*/    packages = ["hscommon", "core", "qt"]/' package.py
    
      30  # Replace use of `imp` with `importlib`
    
      31  patch -p1 < "${srcdir}"/0001-fix-Replace-use-of-imp-with-importlib.patch
    
      32  # Workaround for setuptools sandbox deprecation
    
      33  patch -p1 < "${srcdir}"/0002-setuptools-sandbox-deprecation.patch
    
      34}
    
      35
    
      36build() {
    
      37  cd "${pkgname}-${pkgver}"
    
      38  # Instead of doing the full ./bootstrap.sh
    
      39  python3 -m venv env --system-site-packages
    
      40  source env/bin/activate
    
      41  python3 -m pip install -r requirements.txt
    
      42  msg "Starting build..."
    
      43  python build.py --clean
    
      44}
    
      45
    
      46package() {
    
      47  cd "${pkgname}-${pkgver}"
    
      48  
    
      49  cp -R "help" "build"
    
      50  cp -R "locale" "build"
    
      51  python package.py --arch-pkg
    
      52  cd "build/${pkgname}-arch"
    
      53
    
      54  mkdir -p "${pkgdir}/usr/share/applications"
    
      55  mv ${pkgname}.desktop "${pkgdir}/usr/share/applications"
    
      56  
    
      57  mkdir -p "${pkgdir}/usr/share/${pkgname}"
    
      58  cp -a -- * "${pkgdir}/usr/share/${pkgname}/"
    
      59  chmod a+x "${pkgdir}/usr/share/${pkgname}/run.py"
    
      60  
    
      61  mkdir -p "${pkgdir}/usr/share/pixmaps"
    
      62  ln -s "/usr/share/${pkgname}/dgse_logo_128.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
    
      63  mkdir -p "${pkgdir}/usr/bin"
    
      64  ln -s ../share/${pkgname}/run.py "${pkgdir}/usr/bin/${pkgname}"
    
      65}
    
      66

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2