firestorm

LOW

maintainer Wolfspirit 19 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The pip install is part of building the project from source using a local venv and requirements.txt from the project's own repository, which is a normal and safe AUR practice for projects requiring Python build tools.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The pip install is part of building the project from source using a local venv and requirements.txt from the project's own repository, which is a normal and safe AUR practice for projects requiring Python build tools.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:112 python -m pip install --upgrade pip
PKGBUILD:113 pip install -r requirements.txt

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Wolfspirit Magic <wolfspirit at wolfspirit dot eu>
    
      2pkgname=firestorm
    
      3pkgver=7.2.5.81788
    
      4_src=Firestorm_Release_$pkgver
    
      5_extension=os
    
      6pkgrel=1
    
      7pkgdesc="Feature-packed third-party viewer for Second Life and OpenSim grids ($_extension version)"
    
      8arch=('x86_64')
    
      9url=https://www.firestormviewer.org
    
      10license=('LGPL-2.1-only')
    
      11install='firestorm.install'
    
      12# Packaging release notes. Shown by AUR helpers before updating and by "pacman -Qc firestorm".
    
      13changelog='firestorm.changelog'
    
      14# Libraries the packaged binaries link against directly. Everything else
    
      15# (APR, OpenAL, ALUT, SDL2, libsndfile, CEF, ...) is bundled by the build.
    
      16depends=(alsa-lib at-spi2-core cairo dbus expat fontconfig glib2 glu
    
      17         libcups libgl libx11 libxcb libxcomposite libxcrypt-compat
    
      18         libxdamage libxext libxfixes libxkbcommon libxrandr mesa nspr
    
      19         nss pango systemd-libs util-linux-libs hicolor-icon-theme)
    
      20# Libraries loaded at runtime only if present, plus the 32-bit runtime
    
      21# for the Vivox voice client (SLVoice), which is only used on OpenSim grids.
    
      22# Second Life voice uses the 64-bit WebRTC library instead.
    
      23optdepends=(
    
      24  'gst-plugins-good: for in-world media playback (GStreamer)'
    
      25  'gst-plugins-bad: additional media codecs'
    
      26  'gst-plugins-ugly: additional media codecs'
    
      27  'gst-libav: additional media codecs'
    
      28  'libpulse: for PulseAudio audio support'
    
      29  'pipewire: for PipeWire audio support'
    
      30  'jack: for JACK audio support'
    
      31  'libnotify: for desktop notifications'
    
      32  'gtk3: for the native file picker'
    
      33  'xdg-utils: for opening links in your web browser'
    
      34  'lib32-glibc: for OpenSim voice (Vivox)'
    
      35  'lib32-gcc-libs: for OpenSim voice (Vivox)'
    
      36  'lib32-util-linux: for OpenSim voice (Vivox)'
    
      37  'lib32-zlib: for OpenSim voice (Vivox)'
    
      38  'lib32-libidn11: for OpenSim voice (Vivox, AUR)'
    
      39)
    
      40# libxinerama and libpulse are only checked for at configure time (indra/cmake/OpenGL.cmake,
    
      41# MediaPluginBase.cmake); the packaged binaries don't link against them.
    
      42makedepends=('cmake' 'python-pip' 'git' 'xz' 'libxinerama' 'libpulse')
    
      43conflicts=()
    
      44provides=('firestorm-os')
    
      45source=(
    
      46  "$pkgname"::"git+https://github.com/FirestormViewer/phoenix-firestorm#tag=${_src}"
    
      47  "fs-build-variables"::'git+https://github.com/FirestormViewer/fs-build-variables'
    
      48  'firestorm.desktop'
    
      49  'firestorm.launcher'
    
      50# This patch fixes the fortify check. Arch defines _FORTIFY_SOURCE by default, 
    
      51# These are in CMAKE_CXX_FLAGS and not in CMAKE_CXX_COMPILER_ARG1, 
    
      52# so the check for _FORTIFY_SOURCE in CMAKE_CXX_COMPILER_ARG1 fails and the fortify check is not disabled, 
    
      53# which causes build failures.
    
      54  '001-fix-fortify-check.patch'
    
      55
    
      56# We want to be able to use the OS version together with the official firestorm-bin version so we want a different config directory for the OS version.
    
      57# This patch changes the default config directory to ~/.firestorm_x64-os instead of ~/.firestorm_x64
    
      58  '002-set-different-config-dir.patch'
    
      59
    
      60# GCC 16 introduced -Wsfinae-incomplete which triggers on valid SFINAE patterns used in llinitparam.h.
    
      61# This patch disables that warning-as-error for GCC 16+.
    
      62  '003-fix-sfinae-incomplete-gcc16.patch'
    
      63
    
      64# libwebrtc.a bundles protobuf/protozero build-tool plugins (cppgen_plugin.o, protozero_plugin.o)
    
      65# that both define main. Newer ld rejects multiple definitions even when building a shared library.
    
      66  '004-fix-webrtc-multiple-definition.patch'
    
      67
    
      68# The D-Bus SLURL handoff never replied and its sender ignored the result. Check for a running viewer
    
      69# by bus name owner instead; otherwise opening a link without a running viewer made it quit.
    
      70  '005-fix-slurl-handoff-without-running-viewer.patch'
    
      71)
    
      72sha256sums=('801a58c9b348cd913546c507f00611d23352e45677b1390342f7015c6b288d3e'
    
      73            'SKIP'
    
      74            '785af910134b3f221290e5a6b3341da040e48f6c9f12cb944761df0d1e59a974'
    
      75            'eb225e8886f347ad8708cd7c3c42f0761d23f11ed7b2164538782ecc5c4b4548'
    
      76            'cbef822d5ce2b1b9eb3bc88bfcaa59dfb2eec2cc698bdcb391b1c332a7ed93fb'
    
      77            '5eec78e0196e51d58e45078b84dc277353ef635ff160ff61ac58ab5966245011'
    
      78            '761502b9fe2a12d160b463b3dbe42d05cfa863b6ffde1fae8305c37f7eaa414c'
    
      79            'cc754541b0ed40f80acee048ca038d32eccf5452e409d373638c055ccdb82dda'
    
      80            'c09a364743107a5cda971407a82fb714c4c4e17bec784de9a3a81aec8ec9d1af')
    
      81# The binaries are already stripped in the build system, so no separate debug package either.
    
      82options=(!strip !debug)
    
      83
    
      84prepare() {
    
      85  cd "$srcdir/$pkgname"
    
      86
    
      87  for p in "$srcdir"/*.patch; do
    
      88
    
      89    # Replace [EXTENSION] with the actual extension in the patch file
    
      90    sed -i "s/\[EXTENSION\]/$_extension/g" "$p"
    
      91    echo "Applying patch $(basename "$p")"
    
      92    patch -Np1 -i "$p" || exit 1
    
      93  done
    
      94}
    
      95
    
      96build() {
    
      97  # Rename _GLIBCXX_ASSERTIONS to _NO_GLIBCXX_ASSERTION if defined
    
      98  # The problem is that makepkg might define -D_GLIBCXX_ASSERTIONS.
    
      99  # There is a bug in FS right now that causes the assertion to trigger a crash so we rename it to NO_GLIBCXX_ASSERTIONS to disable the assertions.
    
      100  # This is not ideal but it is a workaround until the underlying issue in FS is fixed.
    
      101  CPPFLAGS=${CPPFLAGS//_GLIBCXX_ASSERTIONS/_NO_GLIBCXX_ASSERTIONS}
    
      102  CXXFLAGS=${CXXFLAGS//_GLIBCXX_ASSERTIONS/_NO_GLIBCXX_ASSERTIONS}
    
      103  export CPPFLAGS CXXFLAGS
    
      104
    
      105
    
      106  cd "$pkgname"
    
      107  export AUTOBUILD_VARIABLES_FILE="$srcdir/fs-build-variables/variables"
    
      108  
    
      109  # Install Autobuild + python deps into an isolated venv
    
      110  python -m venv .venv
    
      111  source .venv/bin/activate
    
      112  python -m pip install --upgrade pip
    
      113  pip install -r requirements.txt
    
      114
    
      115  case "$_extension" in
    
      116    os)
    
      117      channel="ReleaseOSArchx64"
    
      118      ;;
    
      119    beta)
    
      120      channel="BetaOSArchx64"
    
      121      ;;
    
      122    *)
    
      123      channel="DevOSArchx64"
    
      124      ;;
    
      125  esac
    
      126
    
      127  # Build the project using Autobuild with the specified options:
    
      128  # - Package the output for installation to /opt/firestorm-$_extension
    
      129  # - Enable AVX2 optimizations
    
      130  # - Don't use Kakadu for JPEG2000 support. KDU Requires license. Falling back to OpenJPEG for JPEG2000 support.
    
      131  # - Don't use FMOD Studio for audio. FMOD Studio requires an account to download the API. Falling back to OpenAL for audio support.
    
      132  # - Don't use Havok for physics. Havok requires license. This only affects Mesh uploads.
    
      133  # - Enable OpenSim support
    
      134  # - Pass --fresh to cmake to ensure flags are up to date
    
      135
    
      136  autobuild build -A 64 -c ReleaseFS -- --chan "$channel" \
    
      137    --package \
    
      138    --avx2 \
    
      139    -DUSE_KDU:BOOL=OFF \
    
      140    -DUSE_FMODSTUDIO:BOOL=OFF \
    
      141    -DHAVOK_TPV:BOOL=OFF \
    
      142    -DOPENSIM:BOOL=ON \
    
      143    --fresh
    
      144  
    
      145  # Deactivate the virtual environment after the build is complete
    
      146  deactivate
    
      147}
    
      148
    
      149
    
      150package() {
    
      151  mkdir -p "$pkgdir/opt"
    
      152  mkdir -p "$pkgdir/usr/share/applications"
    
      153  mkdir -p "$pkgdir/usr/share/icons/hicolor/512x512/apps"
    
      154
    
      155  # Install the packaged output to /opt/firestorm-$_extension
    
      156  cp -a --reflink=auto "$pkgname/build-linux-x86_64/newview/packaged" "$pkgdir/opt/firestorm-$_extension"
    
      157
    
      158  install -Dm755 "firestorm.launcher" "$pkgdir/usr/bin/firestorm-$_extension"
    
      159  install -Dm644 "firestorm.desktop" "$pkgdir/usr/share/applications/firestorm-$_extension.desktop"
    
      160
    
      161  # Replace [EXTENSION] with the actual extension in the launcher and desktop file
    
      162  sed -i "s/\[EXTENSION\]/$_extension/g" "$pkgdir/usr/bin/firestorm-$_extension"
    
      163  sed -i "s/\[EXTENSION\]/$_extension/g" "$pkgdir/usr/share/applications/firestorm-$_extension.desktop"
    
      164
    
      165  install -Dm644 "$pkgdir/opt/firestorm-$_extension/firestorm_icon.png" "$pkgdir/usr/share/icons/hicolor/512x512/apps/firestorm-$_extension.png"
    
      166
    
      167  # rename "do-not-directly-run-firestorm-bin" to "do-not-directly-run-firestorm-$_extension" in the bin directory
    
      168  # firestorm uses that as the class name.
    
      169  # This allows us to have both the OS version and the official version installed at the same time
    
      170  # The .desktop file needs to match this name in the StartupWMClass field to work properly with the window manager.
    
      171  mv "$pkgdir/opt/firestorm-$_extension/bin/do-not-directly-run-firestorm-bin" "$pkgdir/opt/firestorm-$_extension/bin/do-not-directly-run-firestorm-$_extension"
    
      172
    
      173  # replace "do-not-directly-run-firestorm-bin" with "do-not-directly-run-firestorm-$_extension" in the "firestorm" script
    
      174  sed -i "s/do-not-directly-run-firestorm-bin/do-not-directly-run-firestorm-$_extension/g" "$pkgdir/opt/firestorm-$_extension/firestorm"
    
      175}
    
      176
    
      177

Changes since previous scan

--- PKGBUILD @ 2026-10-28 00:06
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,30 +1,45 @@
 # Maintainer: Wolfspirit Magic <wolfspirit at wolfspirit dot eu>
 pkgname=firestorm
-pkgver=7.2.4.80712
+pkgver=7.2.5.81788
 _src=Firestorm_Release_$pkgver
 _extension=os
 pkgrel=1
-pkgdesc="Firestorm is a feature-packed third-party viewer for Second Life  and OpenSim grids ($_extension version)"
+pkgdesc="Feature-packed third-party viewer for Second Life and OpenSim grids ($_extension version)"
 arch=('x86_64')
 url=https://www.firestormviewer.org
-license=('LGPL')
+license=('LGPL-2.1-only')
 install='firestorm.install'
-depends=(apr-util dbus-glib glu gtk2 lib32-libidn lib32-libsndfile
-         lib32-util-linux lib32-zlib libbsd libgl libidn libjpeg-turbo
-         libpng libxcrypt-compat libxss libxml2 mesa nss openal sdl
-         vlc zlib)
+# Packaging release notes. Shown by AUR helpers before updating and by "pacman -Qc firestorm".
+changelog='firestorm.changelog'
+# Libraries the packaged binaries link against directly. Everything else
+# (APR, OpenAL, ALUT, SDL2, libsndfile, CEF, ...) is bundled by the build.
+depends=(alsa-lib at-spi2-core cairo dbus expat fontconfig glib2 glu
+         libcups libgl libx11 libxcb libxcomposite libxcrypt-compat
+         libxdamage libxext libxfixes libxkbcommon libxrandr mesa nspr
+         nss pango systemd-libs util-linux-libs hicolor-icon-theme)
+# Libraries loaded at runtime only if present, plus the 32-bit runtime
+# for the Vivox voice client (SLVoice), which is only used on OpenSim grids.
+# Second Life voice uses the 64-bit WebRTC library instead.
 optdepends=(
-  'alsa-lib: for ALSA support'
-  'pepper-flash: for inworld Flash support'
-  'freealut: for OpenAL support'
-  'lib32-gst-plugins-good: for voice support'
-  'lib32-libidn11: for voice support'
-  'libpulse: for PulseAudio support'
-  'mesa-libgl: For Intel, Radeon, Nouveau support'
-  'nvidia-libgl: for NVIDIA support'
-  'nvidia-utils: for NVIDIA support'
+  'gst-plugins-good: for in-world media playback (GStreamer)'
+  'gst-plugins-bad: additional media codecs'
+  'gst-plugins-ugly: additional media codecs'
+  'gst-libav: additional media codecs'
+  'libpulse: for PulseAudio audio support'
+  'pipewire: for PipeWire audio support'
+  'jack: for JACK audio support'
+  'libnotify: for desktop notifications'
+  'gtk3: for the native file picker'
+  'xdg-utils: for opening links in your web browser'
+  'lib32-glibc: for OpenSim voice (Vivox)'
+  'lib32-gcc-libs: for OpenSim voice (Vivox)'
+  'lib32-util-linux: for OpenSim voice (Vivox)'
+  'lib32-zlib: for OpenSim voice (Vivox)'
+  'lib32-libidn11: for OpenSim voice (Vivox, AUR)'
 )
-makedepends=('cmake' 'python-pip' 'git' 'boost' 'xz')
+# libxinerama and libpulse are only checked for at configure time (indra/cmake/OpenGL.cmake,
+# MediaPluginBase.cmake); the packaged binaries don't link against them.
+makedepends=('cmake' 'python-pip' 'git' 'xz' 'libxinerama' 'libpulse')
 conflicts=()
 provides=('firestorm-os')
 source=(
@@ -49,17 +64,22 @@
 # libwebrtc.a bundles protobuf/protozero build-tool plugins (cppgen_plugin.o, protozero_plugin.o)
 # that both define main. Newer ld rejects multiple definitions even when building a shared library.
   '004-fix-webrtc-multiple-definition.patch'
+
+# The D-Bus SLURL handoff never replied and its sender ignored the result. Check for a running viewer
+# by bus name owner instead; otherwise opening a link without a running viewer made it quit.
+  '005-fix-slurl-handoff-without-running-viewer.patch'
 )
-sha256sums=('220060b5da6f3096bbb479efe40597148a5eee818dc0747dd32eba8f66e1ced8'
+sha256sums=('801a58c9b348cd913546c507f00611d23352e45677b1390342f7015c6b288d3e'
             'SKIP'
-            'db34a50f4b7fda4a465cd0536f17a0f6040ff6b2e40c32594b1f244ebe8e2d60'
-            '465f1611c17f90bba8bc7e7cc3e05ffe8cf20fb9c1b7df59053f54a6bceb8283'
+            '785af910134b3f221290e5a6b3341da040e48f6c9f12cb944761df0d1e59a974'
+            'eb225e8886f347ad8708cd7c3c42f0761d23f11ed7b2164538782ecc5c4b4548'
             'cbef822d5ce2b1b9eb3bc88bfcaa59dfb2eec2cc698bdcb391b1c332a7ed93fb'
             '5eec78e0196e51d58e45078b84dc277353ef635ff160ff61ac58ab5966245011'
             '761502b9fe2a12d160b463b3dbe42d05cfa863b6ffde1fae8305c37f7eaa414c'
-            'cc754541b0ed40f80acee048ca038d32eccf5452e409d373638c055ccdb82dda')
-# The binaries are already stripped in the build system.
-options=(!strip)
+            'cc754541b0ed40f80acee048ca038d32eccf5452e409d373638c055ccdb82dda'
+            'c09a364743107a5cda971407a82fb714c4c4e17bec784de9a3a81aec8ec9d1af')
+# The binaries are already stripped in the build system, so no separate debug package either.
+options=(!strip !debug)
 
 prepare() {
   cd "$srcdir/$pkgname"

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 23:51:05	Medium	1
2026-10-28 00:06:54	Low	2
2026-10-27 21:48:49	Medium	1
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2