firestorm

maintainer Wolfspirit · 19 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The pip install is part of a project's own build system (Autobuild) inside an isolated virtual environment, installing declared Python dependencies from a requirements.txt; this is normal and safe for building the project from source.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The pip install is part of a project's own build system (Autobuild) inside an isolated virtual environment, installing declared Python dependencies from a requirements.txt; this is normal and safe for building the project from source.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:92 python -m pip install --upgrade pip
PKGBUILD:93 pip install -r requirements.txt

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Wolfspirit Magic <wolfspirit at wolfspirit dot eu>
    
      2pkgname=firestorm
    
      3pkgver=7.2.4.80712
    
      4_src=Firestorm_Release_$pkgver
    
      5_extension=os
    
      6pkgrel=1
    
      7pkgdesc="Firestorm is a feature-packed third-party viewer for Second Life  and OpenSim grids ($_extension version)"
    
      8arch=('x86_64')
    
      9url=https://www.firestormviewer.org
    
      10license=('LGPL')
    
      11install='firestorm.install'
    
      12depends=(apr-util dbus-glib glu gtk2 lib32-libidn lib32-libsndfile
    
      13         lib32-util-linux lib32-zlib libbsd libgl libidn libjpeg-turbo
    
      14         libpng libxcrypt-compat libxss libxml2 mesa nss openal sdl
    
      15         vlc zlib)
    
      16optdepends=(
    
      17  'alsa-lib: for ALSA support'
    
      18  'pepper-flash: for inworld Flash support'
    
      19  'freealut: for OpenAL support'
    
      20  'lib32-gst-plugins-good: for voice support'
    
      21  'lib32-libidn11: for voice support'
    
      22  'libpulse: for PulseAudio support'
    
      23  'mesa-libgl: For Intel, Radeon, Nouveau support'
    
      24  'nvidia-libgl: for NVIDIA support'
    
      25  'nvidia-utils: for NVIDIA support'
    
      26)
    
      27makedepends=('cmake' 'python-pip' 'git' 'boost' 'xz')
    
      28conflicts=()
    
      29provides=('firestorm-os')
    
      30source=(
    
      31  "$pkgname"::"git+https://github.com/FirestormViewer/phoenix-firestorm#tag=${_src}"
    
      32  "fs-build-variables"::'git+https://github.com/FirestormViewer/fs-build-variables'
    
      33  'firestorm.desktop'
    
      34  'firestorm.launcher'
    
      35# This patch fixes the fortify check. Arch defines _FORTIFY_SOURCE by default, 
    
      36# These are in CMAKE_CXX_FLAGS and not in CMAKE_CXX_COMPILER_ARG1, 
    
      37# so the check for _FORTIFY_SOURCE in CMAKE_CXX_COMPILER_ARG1 fails and the fortify check is not disabled, 
    
      38# which causes build failures.
    
      39  '001-fix-fortify-check.patch'
    
      40
    
      41# We want to be able to use the OS version together with the official firestorm-bin version so we want a different config directory for the OS version.
    
      42# This patch changes the default config directory to ~/.firestorm_x64-os instead of ~/.firestorm_x64
    
      43  '002-set-different-config-dir.patch'
    
      44
    
      45# GCC 16 introduced -Wsfinae-incomplete which triggers on valid SFINAE patterns used in llinitparam.h.
    
      46# This patch disables that warning-as-error for GCC 16+.
    
      47  '003-fix-sfinae-incomplete-gcc16.patch'
    
      48
    
      49# libwebrtc.a bundles protobuf/protozero build-tool plugins (cppgen_plugin.o, protozero_plugin.o)
    
      50# that both define main. Newer ld rejects multiple definitions even when building a shared library.
    
      51  '004-fix-webrtc-multiple-definition.patch'
    
      52)
    
      53sha256sums=('220060b5da6f3096bbb479efe40597148a5eee818dc0747dd32eba8f66e1ced8'
    
      54            'SKIP'
    
      55            'db34a50f4b7fda4a465cd0536f17a0f6040ff6b2e40c32594b1f244ebe8e2d60'
    
      56            '465f1611c17f90bba8bc7e7cc3e05ffe8cf20fb9c1b7df59053f54a6bceb8283'
    
      57            'cbef822d5ce2b1b9eb3bc88bfcaa59dfb2eec2cc698bdcb391b1c332a7ed93fb'
    
      58            '5eec78e0196e51d58e45078b84dc277353ef635ff160ff61ac58ab5966245011'
    
      59            '761502b9fe2a12d160b463b3dbe42d05cfa863b6ffde1fae8305c37f7eaa414c'
    
      60            'cc754541b0ed40f80acee048ca038d32eccf5452e409d373638c055ccdb82dda')
    
      61# The binaries are already stripped in the build system.
    
      62options=(!strip)
    
      63
    
      64prepare() {
    
      65  cd "$srcdir/$pkgname"
    
      66
    
      67  for p in "$srcdir"/*.patch; do
    
      68
    
      69    # Replace [EXTENSION] with the actual extension in the patch file
    
      70    sed -i "s/\[EXTENSION\]/$_extension/g" "$p"
    
      71    echo "Applying patch $(basename "$p")"
    
      72    patch -Np1 -i "$p" || exit 1
    
      73  done
    
      74}
    
      75
    
      76build() {
    
      77  # Rename _GLIBCXX_ASSERTIONS to _NO_GLIBCXX_ASSERTION if defined
    
      78  # The problem is that makepkg might define -D_GLIBCXX_ASSERTIONS.
    
      79  # There is a bug in FS right now that causes the assertion to trigger a crash so we rename it to NO_GLIBCXX_ASSERTIONS to disable the assertions.
    
      80  # This is not ideal but it is a workaround until the underlying issue in FS is fixed.
    
      81  CPPFLAGS=${CPPFLAGS//_GLIBCXX_ASSERTIONS/_NO_GLIBCXX_ASSERTIONS}
    
      82  CXXFLAGS=${CXXFLAGS//_GLIBCXX_ASSERTIONS/_NO_GLIBCXX_ASSERTIONS}
    
      83  export CPPFLAGS CXXFLAGS
    
      84
    
      85
    
      86  cd "$pkgname"
    
      87  export AUTOBUILD_VARIABLES_FILE="$srcdir/fs-build-variables/variables"
    
      88  
    
      89  # Install Autobuild + python deps into an isolated venv
    
      90  python -m venv .venv
    
      91  source .venv/bin/activate
    
      92  python -m pip install --upgrade pip
    
      93  pip install -r requirements.txt
    
      94
    
      95  case "$_extension" in
    
      96    os)
    
      97      channel="ReleaseOSArchx64"
    
      98      ;;
    
      99    beta)
    
      100      channel="BetaOSArchx64"
    
      101      ;;
    
      102    *)
    
      103      channel="DevOSArchx64"
    
      104      ;;
    
      105  esac
    
      106
    
      107  # Build the project using Autobuild with the specified options:
    
      108  # - Package the output for installation to /opt/firestorm-$_extension
    
      109  # - Enable AVX2 optimizations
    
      110  # - Don't use Kakadu for JPEG2000 support. KDU Requires license. Falling back to OpenJPEG for JPEG2000 support.
    
      111  # - Don't use FMOD Studio for audio. FMOD Studio requires an account to download the API. Falling back to OpenAL for audio support.
    
      112  # - Don't use Havok for physics. Havok requires license. This only affects Mesh uploads.
    
      113  # - Enable OpenSim support
    
      114  # - Pass --fresh to cmake to ensure flags are up to date
    
      115
    
      116  autobuild build -A 64 -c ReleaseFS -- --chan "$channel" \
    
      117    --package \
    
      118    --avx2 \
    
      119    -DUSE_KDU:BOOL=OFF \
    
      120    -DUSE_FMODSTUDIO:BOOL=OFF \
    
      121    -DHAVOK_TPV:BOOL=OFF \
    
      122    -DOPENSIM:BOOL=ON \
    
      123    --fresh
    
      124  
    
      125  # Deactivate the virtual environment after the build is complete
    
      126  deactivate
    
      127}
    
      128
    
      129
    
      130package() {
    
      131  mkdir -p "$pkgdir/opt"
    
      132  mkdir -p "$pkgdir/usr/share/applications"
    
      133  mkdir -p "$pkgdir/usr/share/icons/hicolor/512x512/apps"
    
      134
    
      135  # Install the packaged output to /opt/firestorm-$_extension
    
      136  cp -a --reflink=auto "$pkgname/build-linux-x86_64/newview/packaged" "$pkgdir/opt/firestorm-$_extension"
    
      137
    
      138  install -Dm755 "firestorm.launcher" "$pkgdir/usr/bin/firestorm-$_extension"
    
      139  install -Dm644 "firestorm.desktop" "$pkgdir/usr/share/applications/firestorm-$_extension.desktop"
    
      140
    
      141  # Replace [EXTENSION] with the actual extension in the launcher and desktop file
    
      142  sed -i "s/\[EXTENSION\]/$_extension/g" "$pkgdir/usr/bin/firestorm-$_extension"
    
      143  sed -i "s/\[EXTENSION\]/$_extension/g" "$pkgdir/usr/share/applications/firestorm-$_extension.desktop"
    
      144
    
      145  install -Dm644 "$pkgdir/opt/firestorm-$_extension/firestorm_icon.png" "$pkgdir/usr/share/icons/hicolor/512x512/apps/firestorm-$_extension.png"
    
      146
    
      147  # rename "do-not-directly-run-firestorm-bin" to "do-not-directly-run-firestorm-$_extension" in the bin directory
    
      148  # firestorm uses that as the class name.
    
      149  # This allows us to have both the OS version and the official version installed at the same time
    
      150  # The .desktop file needs to match this name in the StartupWMClass field to work properly with the window manager.
    
      151  mv "$pkgdir/opt/firestorm-$_extension/bin/do-not-directly-run-firestorm-bin" "$pkgdir/opt/firestorm-$_extension/bin/do-not-directly-run-firestorm-$_extension"
    
      152
    
      153  # replace "do-not-directly-run-firestorm-bin" with "do-not-directly-run-firestorm-$_extension" in the "firestorm" script
    
      154  sed -i "s/do-not-directly-run-firestorm-bin/do-not-directly-run-firestorm-$_extension/g" "$pkgdir/opt/firestorm-$_extension/firestorm"
    
      155}
    
      156
    
      157

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2