firestorm-git

LOW

maintainer Wolfspirit 1 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The pip install is part of the project's own build process within an isolated virtual environment, using requirements.txt from the official source repository, which is a normal and safe practice for building the software.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install is part of the project's own build process within an isolated virtual environment, using requirements.txt from the official source repository, which is a normal and safe practice for building the software.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:122 python -m pip install --upgrade pip
PKGBUILD:123 pip install -r requirements.txt

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Wolfspirit Magic <wolfspirit at wolfspirit dot eu>
    
      2pkgname=firestorm-git
    
      3_src=master
    
      4_extension=dev
    
      5pkgver=7.3.0.82757
    
      6pkgrel=1
    
      7pkgdesc="Feature-packed third-party viewer for Second Life and OpenSim grids ($_extension version)"
    
      8arch=('x86_64')
    
      9url=https://www.firestormviewer.org
    
      10license=('LGPL-2.1-only')
    
      11install='firestorm.install'
    
      12# Packaging release notes. Shown by AUR helpers before updating and by "pacman -Qc firestorm-git".
    
      13changelog='firestorm.changelog'
    
      14# Libraries the packaged binaries link against directly. Everything else
    
      15# (APR, OpenAL, ALUT, SDL3, libsndfile, CEF, ...) is bundled by the build.
    
      16depends=(alsa-lib at-spi2-core cairo dbus expat fontconfig glib2 glu
    
      17         libcups libdecor libgl libvlc libx11 libxcb libxcomposite
    
      18         libxcrypt-compat libxcursor libxdamage libxext libxfixes
    
      19         libxkbcommon libxrandr mesa nspr nss pango systemd-libs
    
      20         util-linux-libs hicolor-icon-theme)
    
      21# Libraries loaded at runtime only if present, plus the 32-bit runtime
    
      22# for the Vivox voice client (SLVoice), which is only used on OpenSim grids.
    
      23# Second Life voice uses the 64-bit WebRTC library instead.
    
      24optdepends=(
    
      25  'gst-plugins-good: for in-world media playback (GStreamer)'
    
      26  'gst-plugins-bad: additional media codecs'
    
      27  'gst-plugins-ugly: additional media codecs'
    
      28  'gst-libav: additional media codecs'
    
      29  'libpulse: for PulseAudio audio support'
    
      30  'pipewire: for PipeWire audio support'
    
      31  'jack: for JACK audio support'
    
      32  'libnotify: for desktop notifications'
    
      33  'gtk3: for the native file picker'
    
      34  'xdg-utils: for opening links in your web browser'
    
      35  'lib32-glibc: for OpenSim voice (Vivox)'
    
      36  'lib32-gcc-libs: for OpenSim voice (Vivox)'
    
      37  'lib32-util-linux: for OpenSim voice (Vivox)'
    
      38  'lib32-zlib: for OpenSim voice (Vivox)'
    
      39  'lib32-libidn11: for OpenSim voice (Vivox, AUR)'
    
      40)
    
      41# libxinerama and libpulse are only checked for at configure time (indra/cmake/OpenGL.cmake,
    
      42# MediaPluginBase.cmake); the packaged binaries don't link against them.
    
      43# libvlc is in depends: upstream master builds and ships the VLC media plugin on Linux.
    
      44# GStreamer and PipeWire headers are needed by the media plugins, which load the libraries at runtime.
    
      45# wayland-client headers enable the viewer's Wayland support.
    
      46makedepends=('cmake' 'python-pip' 'git' 'xz' 'libxinerama' 'libpulse'
    
      47             'gstreamer' 'gst-plugins-base-libs' 'libpipewire' 'wayland')
    
      48conflicts=()
    
      49provides=("firestorm-$_extension")
    
      50source=(
    
      51  "$pkgname"::"git+https://github.com/FirestormViewer/phoenix-firestorm#branch=${_src}"
    
      52  "fs-build-variables"::'git+https://github.com/FirestormViewer/fs-build-variables'
    
      53  'firestorm.desktop'
    
      54  'firestorm.launcher'
    
      55# Arch defines _FORTIFY_SOURCE in CXXFLAGS by default. Upstream master defines it again for Release builds,
    
      56# which causes build failures. This patch only defines it when CMAKE_CXX_FLAGS doesn't already.
    
      57  '001-fix-fortify-check.patch'
    
      58
    
      59# We want to be able to use the OS version together with the official firestorm-bin version so we want a different config directory for this version.
    
      60# This patch changes the default config directory to ~/.firestorm_x64-dev instead of ~/.firestorm_x64
    
      61  '002-set-different-config-dir.patch'
    
      62
    
      63# GCC 16 introduced -Wsfinae-incomplete which triggers on valid SFINAE patterns used in llinitparam.h.
    
      64# This patch disables that warning-as-error for GCC 16+.
    
      65  '003-fix-sfinae-incomplete-gcc16.patch'
    
      66
    
      67# libwebrtc.a bundles protobuf/protozero build-tool plugins (cppgen_plugin.o, protozero_plugin.o)
    
      68# that both define main. Newer ld rejects multiple definitions even when building a shared library.
    
      69  '004-fix-webrtc-multiple-definition.patch'
    
      70
    
      71# The D-Bus SLURL handoff never replied and its sender ignored the result. Check for a running viewer
    
      72# by bus name owner instead; otherwise opening a link without a running viewer made it quit.
    
      73  '005-fix-slurl-handoff-without-running-viewer.patch'
    
      74)
    
      75sha256sums=('SKIP'
    
      76            'SKIP'
    
      77            '785af910134b3f221290e5a6b3341da040e48f6c9f12cb944761df0d1e59a974'
    
      78            'eb225e8886f347ad8708cd7c3c42f0761d23f11ed7b2164538782ecc5c4b4548'
    
      79            'a949492f28a5a8a01969d214aa983a3f5985c509c31a8f85d628dd5aba8c8a2d'
    
      80            '5eec78e0196e51d58e45078b84dc277353ef635ff160ff61ac58ab5966245011'
    
      81            '761502b9fe2a12d160b463b3dbe42d05cfa863b6ffde1fae8305c37f7eaa414c'
    
      82            'cc754541b0ed40f80acee048ca038d32eccf5452e409d373638c055ccdb82dda'
    
      83            'c09a364743107a5cda971407a82fb714c4c4e17bec784de9a3a81aec8ec9d1af')
    
      84# The binaries are already stripped in the build system, so no separate debug package either.
    
      85options=(!strip !debug)
    
      86
    
      87pkgver() {
    
      88	_pkgver=$(cat "$srcdir/$pkgname/indra/newview/VIEWER_VERSION_FS.txt")
    
      89	cd "$srcdir/$pkgname"
    
      90	_revnum=$(git rev-list --count HEAD)
    
      91	printf "%s.%s" $_pkgver $_revnum
    
      92}
    
      93
    
      94prepare() {
    
      95  cd "$srcdir/$pkgname"
    
      96
    
      97  for p in "$srcdir"/*.patch; do
    
      98
    
      99    # Replace [EXTENSION] with the actual extension in the patch file
    
      100    sed -i "s/\[EXTENSION\]/$_extension/g" "$p"
    
      101    echo "Applying patch $(basename "$p")"
    
      102    patch -Np1 -i "$p" || exit 1
    
      103  done
    
      104}
    
      105
    
      106build() {
    
      107  # Rename _GLIBCXX_ASSERTIONS to _NO_GLIBCXX_ASSERTION if defined
    
      108  # The problem is that makepkg might define -D_GLIBCXX_ASSERTIONS.
    
      109  # There is a bug in FS right now that causes the assertion to trigger a crash so we rename it to NO_GLIBCXX_ASSERTIONS to disable the assertions.
    
      110  # This is not ideal but it is a workaround until the underlying issue in FS is fixed.
    
      111  CPPFLAGS=${CPPFLAGS//_GLIBCXX_ASSERTIONS/_NO_GLIBCXX_ASSERTIONS}
    
      112  CXXFLAGS=${CXXFLAGS//_GLIBCXX_ASSERTIONS/_NO_GLIBCXX_ASSERTIONS}
    
      113  export CPPFLAGS CXXFLAGS
    
      114
    
      115
    
      116  cd "$pkgname"
    
      117  export AUTOBUILD_VARIABLES_FILE="$srcdir/fs-build-variables/variables"
    
      118  
    
      119  # Install Autobuild + python deps into an isolated venv
    
      120  python -m venv .venv
    
      121  source .venv/bin/activate
    
      122  python -m pip install --upgrade pip
    
      123  pip install -r requirements.txt
    
      124
    
      125  case "$_extension" in
    
      126    os)
    
      127      channel="ReleaseOSArchx64"
    
      128      ;;
    
      129    beta)
    
      130      channel="BetaOSArchx64"
    
      131      ;;
    
      132    *)
    
      133      channel="DevOSArchx64"
    
      134      ;;
    
      135  esac
    
      136
    
      137  # Build the project using Autobuild with the specified options:
    
      138  # - Package the output for installation to /opt/firestorm-$_extension
    
      139  # - Enable AVX2 optimizations
    
      140  # - Don't use Kakadu for JPEG2000 support. KDU Requires license. Falling back to OpenJPEG for JPEG2000 support.
    
      141  # - Don't use FMOD Studio for audio. FMOD Studio requires an account to download the API. Falling back to OpenAL for audio support.
    
      142  # - Don't use Havok for physics. Havok requires license. This only affects Mesh uploads.
    
      143  # - Enable OpenSim support
    
      144  # - Pass --fresh to cmake to ensure flags are up to date
    
      145
    
      146  autobuild build -A 64 -c ReleaseFS -- --chan "$channel" \
    
      147    --package \
    
      148    --avx2 \
    
      149    -DUSE_KDU:BOOL=OFF \
    
      150    -DUSE_FMODSTUDIO:BOOL=OFF \
    
      151    -DHAVOK_TPV:BOOL=OFF \
    
      152    -DOPENSIM:BOOL=ON \
    
      153    --fresh
    
      154  
    
      155  # Deactivate the virtual environment after the build is complete
    
      156  deactivate
    
      157}
    
      158
    
      159
    
      160package() {
    
      161  mkdir -p "$pkgdir/opt"
    
      162  mkdir -p "$pkgdir/usr/share/applications"
    
      163  mkdir -p "$pkgdir/usr/share/icons/hicolor/512x512/apps"
    
      164
    
      165  # Install the packaged output to /opt/firestorm-$_extension
    
      166  cp -a --reflink=auto "$pkgname/build-linux-x86_64/newview/packaged" "$pkgdir/opt/firestorm-$_extension"
    
      167
    
      168  install -Dm755 "firestorm.launcher" "$pkgdir/usr/bin/firestorm-$_extension"
    
      169  install -Dm644 "firestorm.desktop" "$pkgdir/usr/share/applications/firestorm-$_extension.desktop"
    
      170
    
      171  # Replace [EXTENSION] with the actual extension in the launcher and desktop file
    
      172  sed -i "s/\[EXTENSION\]/$_extension/g" "$pkgdir/usr/bin/firestorm-$_extension"
    
      173  sed -i "s/\[EXTENSION\]/$_extension/g" "$pkgdir/usr/share/applications/firestorm-$_extension.desktop"
    
      174
    
      175  install -Dm644 "$pkgdir/opt/firestorm-$_extension/firestorm_icon.png" "$pkgdir/usr/share/icons/hicolor/512x512/apps/firestorm-$_extension.png"
    
      176
    
      177  # rename "do-not-directly-run-firestorm-bin" to "do-not-directly-run-firestorm-$_extension" in the bin directory
    
      178  # firestorm uses that as the class name.
    
      179  # This allows us to have both the OS version and the official version installed at the same time
    
      180  # The .desktop file needs to match this name in the StartupWMClass field to work properly with the window manager.
    
      181  mv "$pkgdir/opt/firestorm-$_extension/bin/do-not-directly-run-firestorm-bin" "$pkgdir/opt/firestorm-$_extension/bin/do-not-directly-run-firestorm-$_extension"
    
      182
    
      183  # replace "do-not-directly-run-firestorm-bin" with "do-not-directly-run-firestorm-$_extension" in the "firestorm" script
    
      184  sed -i "s/do-not-directly-run-firestorm-bin/do-not-directly-run-firestorm-$_extension/g" "$pkgdir/opt/firestorm-$_extension/firestorm"
    
      185}
    
      186
    
      187

Changes since previous scan

--- PKGBUILD @ 2026-10-28 00:06
+++ PKGBUILD @ 2026-11-01 00:21
@@ -2,29 +2,49 @@
 pkgname=firestorm-git
 _src=master
 _extension=dev
-pkgver=7.2.4.80358
+pkgver=7.3.0.82757
 pkgrel=1
-pkgdesc="Firestorm is a feature-packed third-party viewer for Second Life  and OpenSim grids ($_extension version)"
+pkgdesc="Feature-packed third-party viewer for Second Life and OpenSim grids ($_extension version)"
 arch=('x86_64')
 url=https://www.firestormviewer.org
-license=('LGPL')
+license=('LGPL-2.1-only')
 install='firestorm.install'
-depends=(apr-util dbus-glib glu gtk2 lib32-libidn lib32-libsndfile
-         lib32-util-linux lib32-zlib libbsd libgl libidn libjpeg-turbo
-         libpng libxcrypt-compat libxss libxml2 mesa nss openal sdl
-         vlc zlib)
+# Packaging release notes. Shown by AUR helpers before updating and by "pacman -Qc firestorm-git".
+changelog='firestorm.changelog'
+# Libraries the packaged binaries link against directly. Everything else
+# (APR, OpenAL, ALUT, SDL3, libsndfile, CEF, ...) is bundled by the build.
+depends=(alsa-lib at-spi2-core cairo dbus expat fontconfig glib2 glu
+         libcups libdecor libgl libvlc libx11 libxcb libxcomposite
+         libxcrypt-compat libxcursor libxdamage libxext libxfixes
+         libxkbcommon libxrandr mesa nspr nss pango systemd-libs
+         util-linux-libs hicolor-icon-theme)
+# Libraries loaded at runtime only if present, plus the 32-bit runtime
+# for the Vivox voice client (SLVoice), which is only used on OpenSim grids.
+# Second Life voice uses the 64-bit WebRTC library instead.
 optdepends=(
-  'alsa-lib: for ALSA support'
-  'pepper-flash: for inworld Flash support'
-  'freealut: for OpenAL support'
-  'lib32-gst-plugins-good: for voice support'
-  'lib32-libidn11: for voice support'
-  'libpulse: for PulseAudio support'
-  'mesa-libgl: For Intel, Radeon, Nouveau support'
-  'nvidia-libgl: for NVIDIA support'
-  'nvidia-utils: for NVIDIA support'
+  'gst-plugins-good: for in-world media playback (GStreamer)'
+  'gst-plugins-bad: additional media codecs'
+  'gst-plugins-ugly: additional media codecs'
+  'gst-libav: additional media codecs'
+  'libpulse: for PulseAudio audio support'
+  'pipewire: for PipeWire audio support'
+  'jack: for JACK audio support'
+  'libnotify: for desktop notifications'
+  'gtk3: for the native file picker'
+  'xdg-utils: for opening links in your web browser'
+  'lib32-glibc: for OpenSim voice (Vivox)'
+  'lib32-gcc-libs: for OpenSim voice (Vivox)'
+  'lib32-util-linux: for OpenSim voice (Vivox)'
+  'lib32-zlib: for OpenSim voice (Vivox)'
+  'lib32-libidn11: for OpenSim voice (Vivox, AUR)'
 )
-makedepends=('cmake' 'python-pip' 'git' 'boost' 'xz')
+# libxinerama and libpulse are only checked for at configure time (indra/cmake/OpenGL.cmake,
+# MediaPluginBase.cmake); the packaged binaries don't link against them.
+# libvlc is in depends: upstream master builds and ships the VLC media plugin on Linux.
+# GStreamer and PipeWire headers are needed by the media plugins, which load the libraries at runtime.
+# wayland-client headers enable the viewer's Wayland support.
+makedepends=('cmake' 'python-pip' 'git' 'xz' 'libxinerama' 'libpulse'
+             'gstreamer' 'gst-plugins-base-libs' 'libpipewire' 'wayland')
 conflicts=()
 provides=("firestorm-$_extension")
 source=(
@@ -32,24 +52,37 @@
   "fs-build-variables"::'git+https://github.com/FirestormViewer/fs-build-variables'
   'firestorm.desktop'
   'firestorm.launcher'
-# This patch fixes the fortify check. Arch defines _FORTIFY_SOURCE by default, 
-# These are in CMAKE_CXX_FLAGS and not in CMAKE_CXX_COMPILER_ARG1, 
-# so the check for _FORTIFY_SOURCE in CMAKE_CXX_COMPILER_ARG1 fails and the fortify check is not disabled, 
-# which causes build failures.
+# Arch defines _FORTIFY_SOURCE in CXXFLAGS by default. Upstream master defines it again for Release builds,
+# which causes build failures. This patch only defines it when CMAKE_CXX_FLAGS doesn't already.
   '001-fix-fortify-check.patch'
 
-# We want to be able to use the OS version together with the official firestorm-bin version so we want a different config directory for the OS version.
-# This patch changes the default config directory to ~/.firestorm_x64-os instead of ~/.firestorm_x64
+# We want to be able to use the OS version together with the official firestorm-bin version so we want a different config directory for this version.
+# This patch changes the default config directory to ~/.firestorm_x64-dev instead of ~/.firestorm_x64
   '002-set-different-config-dir.patch'
+
+# GCC 16 introduced -Wsfinae-incomplete which triggers on valid SFINAE patterns used in llinitparam.h.
+# This patch disables that warning-as-error for GCC 16+.
+  '003-fix-sfinae-incomplete-gcc16.patch'
+
+# libwebrtc.a bundles protobuf/protozero build-tool plugins (cppgen_plugin.o, protozero_plugin.o)
+# that both define main. Newer ld rejects multiple definitions even when building a shared library.
+  '004-fix-webrtc-multiple-definition.patch'
+
+# The D-Bus SLURL handoff never replied and its sender ignored the result. Check for a running viewer
+# by bus name owner instead; otherwise opening a link without a running viewer made it quit.
+  '005-fix-slurl-handoff-without-running-viewer.patch'
 )
 sha256sums=('SKIP'
             'SKIP'
-            'db34a50f4b7fda4a465cd0536f17a0f6040ff6b2e40c32594b1f244ebe8e2d60'
-            '465f1611c17f90bba8bc7e7cc3e05ffe8cf20fb9c1b7df59053f54a6bceb8283'
-            'cbef822d5ce2b1b9eb3bc88bfcaa59dfb2eec2cc698bdcb391b1c332a7ed93fb'
-            '5eec78e0196e51d58e45078b84dc277353ef635ff160ff61ac58ab5966245011')
-# The binaries are already stripped in the build system.
-options=(!strip)
+            '785af910134b3f221290e5a6b3341da040e48f6c9f12cb944761df0d1e59a974'
+            'eb225e8886f347ad8708cd7c3c42f0761d23f11ed7b2164538782ecc5c4b4548'
+            'a949492f28a5a8a01969d214aa983a3f5985c509c31a8f85d628dd5aba8c8a2d'
+            '5eec78e0196e51d58e45078b84dc277353ef635ff160ff61ac58ab5966245011'
+            '761502b9fe2a12d160b463b3dbe42d05cfa863b6ffde1fae8305c37f7eaa414c'
+            'cc754541b0ed40f80acee048ca038d32eccf5452e409d373638c055ccdb82dda'
+            'c09a364743107a5cda971407a82fb714c4c4e17bec784de9a3a81aec8ec9d1af')
+# The binaries are already stripped in the build system, so no separate debug package either.
+options=(!strip !debug)
 
 pkgver() {
 	_pkgver=$(cat "$srcdir/$pkgname/indra/newview/VIEWER_VERSION_FS.txt")
@@ -109,6 +142,7 @@
   # - Don't use Havok for physics. Havok requires license. This only affects Mesh uploads.
   # - Enable OpenSim support
   # - Pass --fresh to cmake to ensure flags are up to date
+
   autobuild build -A 64 -c ReleaseFS -- --chan "$channel" \
     --package \
     --avx2 \
@@ -122,13 +156,14 @@
   deactivate
 }
 
+
 package() {
   mkdir -p "$pkgdir/opt"
   mkdir -p "$pkgdir/usr/share/applications"
   mkdir -p "$pkgdir/usr/share/icons/hicolor/512x512/apps"
 
   # Install the packaged output to /opt/firestorm-$_extension
-  mv "$pkgname/build-linux-x86_64/newview/packaged" "$pkgdir/opt/firestorm-$_extension"
+  cp -a --reflink=auto "$pkgname/build-linux-x86_64/newview/packaged" "$pkgdir/opt/firestorm-$_extension"
 
   install -Dm755 "firestorm.launcher" "$pkgdir/usr/bin/firestorm-$_extension"
   install -Dm644 "firestorm.desktop" "$pkgdir/usr/share/applications/firestorm-$_extension.desktop"

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 23:51:05	Medium	1
2026-10-28 00:06:54	Low	2
2026-10-27 23:48:54	Medium	1
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2