erpnext

maintainer Spixmaster · 3 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The pip install is used to install editable Python packages (frappe and erpnext) from the locally built source, which is downloaded from the project's official GitHub repository, representing normal build behavior for the application rather than installation of untrusted external packages.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install is used to install editable Python packages (frappe and erpnext) from the locally built source, which is downloaded from the project's official GitHub repository, representing normal build behavior for the application rather than installation of untrusted external packages.

PKGBUILD:67 "${pkgdir}"/usr/share/webapps/"${pkgname}"/env/bin/python -m pip install -e "${_path}"

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:64 "${pkgdir}"/usr/share/webapps/"${pkgname}"/env/bin/python -m pip install wheel

PKGBUILD

2 offending line(s) highlighted

      1#!/usr/bin/env bash
    
      2# shellcheck disable=SC2034
    
      3# shellcheck disable=SC2154
    
      4# The PKGBUILD for ERPNext.
    
      5# Maintainer: Matheus <matheusgwdl@protonmail.com>
    
      6# Contributor: Matheus <matheusgwdl@protonmail.com>
    
      7
    
      8readonly _version_frappe="v16.29.0"
    
      9
    
      10pkgname="erpnext"
    
      11pkgver="16.30.0"
    
      12pkgrel="1"
    
      13pkgdesc="Free and open source Enterprise Resource Planning (ERP)."
    
      14arch=("x86_64")
    
      15url="https://github.com/frappe/${pkgname}"
    
      16license=("GPL-3.0-or-later")
    
      17depends=("frappe-bench" "libmaxminddb" "mariadb" "nodejs" "python" "python-pycups" "wkhtmltopdf")
    
      18makedepends=("npm" "python-build" "python-installer" "python-flit-core" "python-virtualenv" "python-wheel")
    
      19optdepends=("apache: HTTP server"
    
      20    "certbot: Creates SSL certificates."
    
      21    "nginx: HTTP server"
    
      22    "redisearch: Faster database reading.")
    
      23install="${pkgname}.install"
    
      24source=("${pkgname}-v${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz"
    
      25    "${pkgname}.sh"
    
      26    "${pkgname}.sysusers"
    
      27    "${pkgname}.tmpfiles")
    
      28sha512sums=("20062efe43b1fe39db2915e765aebcaa55a3d64072ac4d713a1b247349358b00fc3a358f4def98d2daba2ff21a44b44ffaf4d4dfabfa9b204a0cebccbad80eec"
    
      29    "70baf45505c3cd21886fd7c820b528c655c5fa8c382f7991092ea14846eb42f43a8899232610f2dc213ea6a3cc6ead43130c083de676ecd4c93caca9283aa36e"
    
      30    "d8614473bd72404bec058981d2c9c3a91ed08b931539236a5d22209e5fdc6dc044ea719c8ed336bd8e64a49508cd290a5431bf339b87b0331bd9ede1d055e8ce"
    
      31    "661ca81b73544884c3024ec2c5fad689101c72f7467cf7720934bdded67eecdb666096365c4f8abe20c2fd13a1a5c831a990490872024fe3093e35459be8d47b")
    
      32
    
      33build()
    
      34{
    
      35    cd "${srcdir}"/ || exit 1
    
      36    bench init --frappe-branch "${_version_frappe}" "${pkgname}"
    
      37    cd "${srcdir}"/"${pkgname}"/ || exit 1
    
      38    bench get --branch v"${pkgver}" --resolve-deps "${pkgname}" "${url}.git"
    
      39    bench new-site --db-name "${pkgname}" --set-default "${pkgname}"
    
      40    bench --site "${pkgname}" install-app "${pkgname}"
    
      41}
    
      42
    
      43package()
    
      44{
    
      45    # Assure that the directories exist.
    
      46    mkdir -p "${pkgdir}"/usr/bin/
    
      47    mkdir -p "${pkgdir}"/usr/lib/sysusers.d/
    
      48    mkdir -p "${pkgdir}"/usr/share/doc/"${pkgname}"/
    
      49    mkdir -p "${pkgdir}"/usr/share/webapps/"${pkgname}"/
    
      50
    
      51    # Install the software.
    
      52    cp -r "${srcdir}"/"${pkgname}"/* "${pkgdir}"/usr/share/webapps/"${pkgname}"/
    
      53    install -Dm755 "${srcdir}"/"${pkgname}".sh "${pkgdir}"/usr/bin/"${pkgname}"
    
      54    install -Dm644 "${srcdir}"/"${pkgname}".sysusers "${pkgdir}"/usr/lib/sysusers.d/"${pkgname}".conf
    
      55    install -Dm644 "${srcdir}"/"${pkgname}".tmpfiles "${pkgdir}"/usr/lib/tmpfiles.d/"${pkgname}".conf
    
      56
    
      57    ## Edit paths which were written during the build process. Configuration files are going to be altered as well as .pyc.
    
      58    declare -r _files=$(grep -lr "${srcdir}"/"${pkgname}/" "${pkgdir}"/usr/share/webapps/"${pkgname}"/)
    
      59    echo "${_files}" | xargs sed -i "s|${srcdir}/${pkgname}/|/usr/share/webapps/${pkgname}/|g"
    
      60
    
      61    ## Rebuild the software since their contents were manipulated.
    
      62    rm -r "${pkgdir}"/usr/share/webapps/"${pkgname}"/env/
    
      63    python -m venv "${pkgdir}"/usr/share/webapps/"${pkgname}"/env/
    
      64    "${pkgdir}"/usr/share/webapps/"${pkgname}"/env/bin/python -m pip install wheel
    
      65
    
      66    for _path in "${pkgdir}/usr/share/webapps/${pkgname}/apps/frappe/" "${pkgdir}/usr/share/webapps/${pkgname}/apps/erpnext/"; do
    
      67        "${pkgdir}"/usr/share/webapps/"${pkgname}"/env/bin/python -m pip install -e "${_path}"
    
      68        cd "${_path}" || exit 1
    
      69        yarn install
    
      70        yarn --check-files
    
      71    done
    
      72
    
      73    cd "${pkgdir}"/usr/share/webapps/"${pkgname}"/ || exit 1
    
      74    bench build --hard-link --production
    
      75    bench build --app "${pkgname}" --hard-link --production
    
      76
    
      77    ## Edit the paths for Python modules.
    
      78    echo "/usr/share/webapps/${pkgname}/apps/erpnext/" > "${pkgdir}"/usr/share/webapps/"${pkgname}"/env/lib/python3.11/site-packages/erpnext.pth
    
      79    echo "/usr/share/webapps/${pkgname}/apps/frappe/" > "${pkgdir}"/usr/share/webapps/"${pkgname}"/env/lib/python3.11/site-packages/frappe.pth
    
      80
    
      81    ## Correct symlinks.
    
      82    rm "${pkgdir}"/usr/share/webapps/"${pkgname}"/apps/erpnext/erpnext/public/node_modules
    
      83    ln -s /usr/share/webapps/"${pkgname}"/apps/erpnext/node_modules/ "${pkgdir}"/usr/share/webapps/"${pkgname}"/apps/erpnext/erpnext/public/node_modules
    
      84
    
      85    rm "${pkgdir}"/usr/share/webapps/"${pkgname}"/apps/frappe/frappe/public/node_modules
    
      86    ln -s /usr/share/webapps/"${pkgname}"/apps/frappe/node_modules/ "${pkgdir}"/usr/share/webapps/"${pkgname}"/apps/frappe/frappe/public/node_modules
    
      87
    
      88    # Install the documentation.
    
      89    install -Dm644 "${srcdir}"/"${pkgname}"-"${pkgver}"/README.md "${pkgdir}"/usr/share/doc/"${pkgname}"/
    
      90}
    
      91

Changes since previous scan

--- PKGBUILD @ 2026-07-29 00:25
+++ PKGBUILD @ 2026-08-03 00:08
@@ -5,10 +5,10 @@
 # Maintainer: Matheus <matheusgwdl@protonmail.com>
 # Contributor: Matheus <matheusgwdl@protonmail.com>
 
-readonly _version_frappe="v16.28.0"
+readonly _version_frappe="v16.29.0"
 
 pkgname="erpnext"
-pkgver="16.29.0"
+pkgver="16.30.0"
 pkgrel="1"
 pkgdesc="Free and open source Enterprise Resource Planning (ERP)."
 arch=("x86_64")
@@ -25,7 +25,7 @@
     "${pkgname}.sh"
     "${pkgname}.sysusers"
     "${pkgname}.tmpfiles")
-sha512sums=("794f899c59bb969e1864156c735a8bf878d20845fdf3918f8633e4c5334625c180357f7f30f2d9a6f1cf9ea5f5d20cff41d4cdf09ee4b7622b87b68046577e60"
+sha512sums=("20062efe43b1fe39db2915e765aebcaa55a3d64072ac4d713a1b247349358b00fc3a358f4def98d2daba2ff21a44b44ffaf4d4dfabfa9b204a0cebccbad80eec"
     "70baf45505c3cd21886fd7c820b528c655c5fa8c382f7991092ea14846eb42f43a8899232610f2dc213ea6a3cc6ead43130c083de676ecd4c93caca9283aa36e"
     "d8614473bd72404bec058981d2c9c3a91ed08b931539236a5d22209e5fdc6dc044ea719c8ed336bd8e64a49508cd290a5431bf339b87b0331bd9ede1d055e8ce"
     "661ca81b73544884c3024ec2c5fad689101c72f7467cf7720934bdded67eecdb666096365c4f8abe20c2fd13a1a5c831a990490872024fe3093e35459be8d47b")

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 01:40:32	MEDIUM	1
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 17:21:24	MEDIUM	1
2026-07-22 03:18:55	MEDIUM	1
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2