easyabc

maintainer mattski · 3 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The PKGBUILD installs Python dependencies (wxpython, pyparsing, pygame) via pip from PyPI into a venv during the package() phase. While this is non-standard Arch packaging practice (dependencies should come from pacman), all three packages are well-known, legitimate PyPI packages with large user bases and active maintainers. wxpython is pinned to 4.1.1; pyparsing and pygame are unpinned but are extremely well-known packages unlikely to be typosquatted or substituted. The source itself comes from the official upstream GitHub repository. The main concern is sloppy packaging (pip in package(), no version pinning for two deps, venv installed into /opt) rather than a genuine supply-chain attack vector. This is a low-severity packaging quality issue, not a medium supply-chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 72%): The PKGBUILD installs Python dependencies (wxpython, pyparsing, pygame) via pip from PyPI into a venv during the package() phase. While this is non-standard Arch packaging practice (dependencies should come from pacman), all three packages are well-known, legitimate PyPI packages with large user bases and active maintainers. wxpython is pinned to 4.1.1; pyparsing and pygame are unpinned but are extremely well-known packages unlikely to be typosquatted or substituted. The source itself comes from the official upstream GitHub repository. The main concern is sloppy packaging (pip in package(), no version pinning for two deps, venv installed into /opt) rather than a genuine supply-chain attack vector. This is a low-severity packaging quality issue, not a medium supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:48 pip install --upgrade pip
PKGBUILD:49 pip install wxpython==4.1.1 --use-pep517
PKGBUILD:50 pip install pyparsing
PKGBUILD:51 pip install pygame

PKGBUILD

4 offending line(s) highlighted

      1# Maintainer: mattski <redmattski at gmail dot com>
    
      2# Contributor: Lex Black <autumn-wind@web.de>
    
      3# Contributor: Simon Thorpe <simon@hivetechnology.com.au>
    
      4
    
      5pkgname=easyabc
    
      6pkgver=305
    
      7pkgrel=1
    
      8pkgdesc="A graphical music notation editor for the ABC music notation language"
    
      9arch=('any')
    
      10url="https://github.com/jwdj/EasyABC"
    
      11license=('GPL')
    
      12#depends=('python-wxpython' 'python-pyparsing' 'python-pygame' 'abcmidi' 'abcm2ps' 'ghostscript')
    
      13depends=('python39' 'abcmidi' 'abcm2ps' 'ghostscript')
    
      14makedepends=('gendesk' 'git')
    
      15provides=($pkgname)
    
      16conflicts=($pkgname)
    
      17source=("$pkgname::git+https://github.com/jwdj/EasyABC.git")
    
      18md5sums=('SKIP')
    
      19
    
      20prepare(){
    
      21  gendesk -f -n --pkgname "$pkgname" --pkgdesc "$pkgdesc" \
    
      22    --name='EasyABC' \
    
      23    --mimetype='text/vnd.abc' \
    
      24    --categories 'Audio;Sequencer;Midi;AudioVideoEditing;Music;AudioVideo;'
    
      25}
    
      26
    
      27pkgver(){
    
      28  cd $pkgname
    
      29  git log --pretty=format: | wc -l
    
      30}
    
      31
    
      32package(){
    
      33  mkdir -p "$pkgdir"/usr/share
    
      34  mkdir -p "$pkgdir"/usr/bin
    
      35  mkdir -p "$pkgdir"/opt/easyabc/bin
    
      36
    
      37  install -dm755 "$pkgdir"/opt/easyabc
    
      38  cp -dpr --no-preserve=ownership "${pkgname}" $pkgdir/opt/
    
      39  echo -e '#!/bin/bash\n/opt/easyabc/bin/python /opt/easyabc/easy_abc.py "$@"' > $pkgdir/usr/bin/easyabc
    
      40  chmod +x $pkgdir/usr/bin/easyabc
    
      41  install -Dm644 "${pkgname}/img/logo64.png" "$pkgdir/usr/share/pixmaps/$pkgname.png"
    
      42  install -Dm644 "$pkgname.desktop" "$pkgdir/usr/share/applications/$pkgname.desktop"
    
      43
    
      44
    
      45  cd "$pkgdir"/opt
    
      46  python3.9 -m venv easyabc
    
      47  source easyabc/bin/activate
    
      48  pip install --upgrade pip
    
      49  pip install wxpython==4.1.1 --use-pep517
    
      50  pip install pyparsing
    
      51  pip install pygame
    
      52
    
      53  ln -s /usr/bin/abc2abc $pkgdir/opt/easyabc/bin/
    
      54  ln -s /usr/bin/abc2midi $pkgdir/opt/easyabc/bin/
    
      55  ln -s /usr/bin/abcm2ps $pkgdir/opt/easyabc/bin/
    
      56}
    
      57

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2