erpnext
LOW
maintainer Spixmaster
3 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The pip install is used to install editable Python packages (frappe and erpnext) from the locally built source, which is downloaded from the project's official GitHub repository, posing minimal supply-chain risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install is used to install editable Python packages (frappe and erpnext) from the locally built source, which is downloaded from the project's official GitHub repository, posing minimal supply-chain risk.
-
PKGBUILD:67
"${pkgdir}"/usr/share/webapps/"${pkgname}"/env/bin/python -m pip install -e "${_path}"
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
pip install of an external package
pip_install_external
`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:64
"${pkgdir}"/usr/share/webapps/"${pkgname}"/env/bin/python -m pip install wheel
PKGBUILD
2 offending line(s) highlighted
1
#!/usr/bin/env bash
2
# shellcheck disable=SC2034
3
# shellcheck disable=SC2154
4
# The PKGBUILD for ERPNext.
5
# Maintainer: Matheus <matheusgwdl@protonmail.com>
6
# Contributor: Matheus <matheusgwdl@protonmail.com>
7
8
readonly _version_frappe="v16.54.0"
9
10
pkgname="erpnext"
11
pkgver="16.52.1"
12
pkgrel="1"
13
pkgdesc="Free and open source Enterprise Resource Planning (ERP)."
14
arch=("x86_64")
15
url="https://github.com/frappe/${pkgname}"
16
license=("GPL-3.0-or-later")
17
depends=("frappe-bench" "libmaxminddb" "mariadb" "nodejs" "python" "python-pycups" "wkhtmltopdf")
18
makedepends=("npm" "python-build" "python-installer" "python-flit-core" "python-virtualenv" "python-wheel")
19
optdepends=("apache: HTTP server"
20
"certbot: Creates SSL certificates."
21
"nginx: HTTP server"
22
"redisearch: Faster database reading.")
23
install="${pkgname}.install"
24
source=("${pkgname}-v${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz"
25
"${pkgname}.sh"
26
"${pkgname}.sysusers"
27
"${pkgname}.tmpfiles")
28
sha512sums=("b4b8953f23f8e7f0299b7ebfffa4ed5c3fecad40736b0ae6c3aa11439d704cddae2b6bfd4a0adca9c19b8eb9c552d9a55392f2580f50312bf54bfec5827af2ca"
29
"70baf45505c3cd21886fd7c820b528c655c5fa8c382f7991092ea14846eb42f43a8899232610f2dc213ea6a3cc6ead43130c083de676ecd4c93caca9283aa36e"
30
"d8614473bd72404bec058981d2c9c3a91ed08b931539236a5d22209e5fdc6dc044ea719c8ed336bd8e64a49508cd290a5431bf339b87b0331bd9ede1d055e8ce"
31
"661ca81b73544884c3024ec2c5fad689101c72f7467cf7720934bdded67eecdb666096365c4f8abe20c2fd13a1a5c831a990490872024fe3093e35459be8d47b")
32
33
build()
34
{
35
cd "${srcdir}"/ || exit 1
36
bench init --frappe-branch "${_version_frappe}" "${pkgname}"
37
cd "${srcdir}"/"${pkgname}"/ || exit 1
38
bench get --branch v"${pkgver}" --resolve-deps "${pkgname}" "${url}.git"
39
bench new-site --db-name "${pkgname}" --set-default "${pkgname}"
40
bench --site "${pkgname}" install-app "${pkgname}"
41
}
42
43
package()
44
{
45
# Assure that the directories exist.
46
mkdir -p "${pkgdir}"/usr/bin/
47
mkdir -p "${pkgdir}"/usr/lib/sysusers.d/
48
mkdir -p "${pkgdir}"/usr/share/doc/"${pkgname}"/
49
mkdir -p "${pkgdir}"/usr/share/webapps/"${pkgname}"/
50
51
# Install the software.
52
cp -r "${srcdir}"/"${pkgname}"/* "${pkgdir}"/usr/share/webapps/"${pkgname}"/
53
install -Dm755 "${srcdir}"/"${pkgname}".sh "${pkgdir}"/usr/bin/"${pkgname}"
54
install -Dm644 "${srcdir}"/"${pkgname}".sysusers "${pkgdir}"/usr/lib/sysusers.d/"${pkgname}".conf
55
install -Dm644 "${srcdir}"/"${pkgname}".tmpfiles "${pkgdir}"/usr/lib/tmpfiles.d/"${pkgname}".conf
56
57
## Edit paths which were written during the build process. Configuration files are going to be altered as well as .pyc.
58
declare -r _files=$(grep -lr "${srcdir}"/"${pkgname}/" "${pkgdir}"/usr/share/webapps/"${pkgname}"/)
59
echo "${_files}" | xargs sed -i "s|${srcdir}/${pkgname}/|/usr/share/webapps/${pkgname}/|g"
60
61
## Rebuild the software since their contents were manipulated.
62
rm -r "${pkgdir}"/usr/share/webapps/"${pkgname}"/env/
63
python -m venv "${pkgdir}"/usr/share/webapps/"${pkgname}"/env/
64
"${pkgdir}"/usr/share/webapps/"${pkgname}"/env/bin/python -m pip install wheel
65
66
for _path in "${pkgdir}/usr/share/webapps/${pkgname}/apps/frappe/" "${pkgdir}/usr/share/webapps/${pkgname}/apps/erpnext/"; do
67
"${pkgdir}"/usr/share/webapps/"${pkgname}"/env/bin/python -m pip install -e "${_path}"
68
cd "${_path}" || exit 1
69
yarn install
70
yarn --check-files
71
done
72
73
cd "${pkgdir}"/usr/share/webapps/"${pkgname}"/ || exit 1
74
bench build --hard-link --production
75
bench build --app "${pkgname}" --hard-link --production
76
77
## Edit the paths for Python modules.
78
echo "/usr/share/webapps/${pkgname}/apps/erpnext/" > "${pkgdir}"/usr/share/webapps/"${pkgname}"/env/lib/python3.11/site-packages/erpnext.pth
79
echo "/usr/share/webapps/${pkgname}/apps/frappe/" > "${pkgdir}"/usr/share/webapps/"${pkgname}"/env/lib/python3.11/site-packages/frappe.pth
80
81
## Correct symlinks.
82
rm "${pkgdir}"/usr/share/webapps/"${pkgname}"/apps/erpnext/erpnext/public/node_modules
83
ln -s /usr/share/webapps/"${pkgname}"/apps/erpnext/node_modules/ "${pkgdir}"/usr/share/webapps/"${pkgname}"/apps/erpnext/erpnext/public/node_modules
84
85
rm "${pkgdir}"/usr/share/webapps/"${pkgname}"/apps/frappe/frappe/public/node_modules
86
ln -s /usr/share/webapps/"${pkgname}"/apps/frappe/node_modules/ "${pkgdir}"/usr/share/webapps/"${pkgname}"/apps/frappe/frappe/public/node_modules
87
88
# Install the documentation.
89
install -Dm644 "${srcdir}"/"${pkgname}"-"${pkgver}"/README.md "${pkgdir}"/usr/share/doc/"${pkgname}"/
90
}
91
Changes since previous scan
--- PKGBUILD @ 2026-10-29 00:13+++ PKGBUILD @ 2026-11-01 00:21@@ -5,7 +5,7 @@ # Maintainer: Matheus <matheusgwdl@protonmail.com> # Contributor: Matheus <matheusgwdl@protonmail.com> -readonly _version_frappe="v16.53.0"+readonly _version_frappe="v16.54.0" pkgname="erpnext" pkgver="16.52.1"Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 03:51:44 | Medium | 1 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 03:49:04 | Medium | 1 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 07:37:02 | Medium | 1 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 17:35:31 | Medium | 1 |
| 2026-10-22 01:33:44 | Medium | 1 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |