firestorm-git

maintainer Wolfspirit · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The pip install is used internally to set up a build tool (autobuild) in an isolated venv from a requirements.txt in the project's own git repository, which is a normal part of the build process and not an attempt to install untrusted external code.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install is used internally to set up a build tool (autobuild) in an isolated venv from a requirements.txt in the project's own git repository, which is a normal part of the build process and not an attempt to install untrusted external code.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:89 python -m pip install --upgrade pip
PKGBUILD:90 pip install -r requirements.txt

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Wolfspirit Magic <wolfspirit at wolfspirit dot eu>
    
      2pkgname=firestorm-git
    
      3_src=master
    
      4_extension=dev
    
      5pkgver=7.2.4.80358
    
      6pkgrel=1
    
      7pkgdesc="Firestorm is a feature-packed third-party viewer for Second Life  and OpenSim grids ($_extension version)"
    
      8arch=('x86_64')
    
      9url=https://www.firestormviewer.org
    
      10license=('LGPL')
    
      11install='firestorm.install'
    
      12depends=(apr-util dbus-glib glu gtk2 lib32-libidn lib32-libsndfile
    
      13         lib32-util-linux lib32-zlib libbsd libgl libidn libjpeg-turbo
    
      14         libpng libxcrypt-compat libxss libxml2 mesa nss openal sdl
    
      15         vlc zlib)
    
      16optdepends=(
    
      17  'alsa-lib: for ALSA support'
    
      18  'pepper-flash: for inworld Flash support'
    
      19  'freealut: for OpenAL support'
    
      20  'lib32-gst-plugins-good: for voice support'
    
      21  'lib32-libidn11: for voice support'
    
      22  'libpulse: for PulseAudio support'
    
      23  'mesa-libgl: For Intel, Radeon, Nouveau support'
    
      24  'nvidia-libgl: for NVIDIA support'
    
      25  'nvidia-utils: for NVIDIA support'
    
      26)
    
      27makedepends=('cmake' 'python-pip' 'git' 'boost' 'xz')
    
      28conflicts=()
    
      29provides=("firestorm-$_extension")
    
      30source=(
    
      31  "$pkgname"::"git+https://github.com/FirestormViewer/phoenix-firestorm#branch=${_src}"
    
      32  "fs-build-variables"::'git+https://github.com/FirestormViewer/fs-build-variables'
    
      33  'firestorm.desktop'
    
      34  'firestorm.launcher'
    
      35# This patch fixes the fortify check. Arch defines _FORTIFY_SOURCE by default, 
    
      36# These are in CMAKE_CXX_FLAGS and not in CMAKE_CXX_COMPILER_ARG1, 
    
      37# so the check for _FORTIFY_SOURCE in CMAKE_CXX_COMPILER_ARG1 fails and the fortify check is not disabled, 
    
      38# which causes build failures.
    
      39  '001-fix-fortify-check.patch'
    
      40
    
      41# We want to be able to use the OS version together with the official firestorm-bin version so we want a different config directory for the OS version.
    
      42# This patch changes the default config directory to ~/.firestorm_x64-os instead of ~/.firestorm_x64
    
      43  '002-set-different-config-dir.patch'
    
      44)
    
      45sha256sums=('SKIP'
    
      46            'SKIP'
    
      47            'db34a50f4b7fda4a465cd0536f17a0f6040ff6b2e40c32594b1f244ebe8e2d60'
    
      48            '465f1611c17f90bba8bc7e7cc3e05ffe8cf20fb9c1b7df59053f54a6bceb8283'
    
      49            'cbef822d5ce2b1b9eb3bc88bfcaa59dfb2eec2cc698bdcb391b1c332a7ed93fb'
    
      50            '5eec78e0196e51d58e45078b84dc277353ef635ff160ff61ac58ab5966245011')
    
      51# The binaries are already stripped in the build system.
    
      52options=(!strip)
    
      53
    
      54pkgver() {
    
      55	_pkgver=$(cat "$srcdir/$pkgname/indra/newview/VIEWER_VERSION_FS.txt")
    
      56	cd "$srcdir/$pkgname"
    
      57	_revnum=$(git rev-list --count HEAD)
    
      58	printf "%s.%s" $_pkgver $_revnum
    
      59}
    
      60
    
      61prepare() {
    
      62  cd "$srcdir/$pkgname"
    
      63
    
      64  for p in "$srcdir"/*.patch; do
    
      65
    
      66    # Replace [EXTENSION] with the actual extension in the patch file
    
      67    sed -i "s/\[EXTENSION\]/$_extension/g" "$p"
    
      68    echo "Applying patch $(basename "$p")"
    
      69    patch -Np1 -i "$p" || exit 1
    
      70  done
    
      71}
    
      72
    
      73build() {
    
      74  # Rename _GLIBCXX_ASSERTIONS to _NO_GLIBCXX_ASSERTION if defined
    
      75  # The problem is that makepkg might define -D_GLIBCXX_ASSERTIONS.
    
      76  # There is a bug in FS right now that causes the assertion to trigger a crash so we rename it to NO_GLIBCXX_ASSERTIONS to disable the assertions.
    
      77  # This is not ideal but it is a workaround until the underlying issue in FS is fixed.
    
      78  CPPFLAGS=${CPPFLAGS//_GLIBCXX_ASSERTIONS/_NO_GLIBCXX_ASSERTIONS}
    
      79  CXXFLAGS=${CXXFLAGS//_GLIBCXX_ASSERTIONS/_NO_GLIBCXX_ASSERTIONS}
    
      80  export CPPFLAGS CXXFLAGS
    
      81
    
      82
    
      83  cd "$pkgname"
    
      84  export AUTOBUILD_VARIABLES_FILE="$srcdir/fs-build-variables/variables"
    
      85  
    
      86  # Install Autobuild + python deps into an isolated venv
    
      87  python -m venv .venv
    
      88  source .venv/bin/activate
    
      89  python -m pip install --upgrade pip
    
      90  pip install -r requirements.txt
    
      91
    
      92  case "$_extension" in
    
      93    os)
    
      94      channel="ReleaseOSArchx64"
    
      95      ;;
    
      96    beta)
    
      97      channel="BetaOSArchx64"
    
      98      ;;
    
      99    *)
    
      100      channel="DevOSArchx64"
    
      101      ;;
    
      102  esac
    
      103
    
      104  # Build the project using Autobuild with the specified options:
    
      105  # - Package the output for installation to /opt/firestorm-$_extension
    
      106  # - Enable AVX2 optimizations
    
      107  # - Don't use Kakadu for JPEG2000 support. KDU Requires license. Falling back to OpenJPEG for JPEG2000 support.
    
      108  # - Don't use FMOD Studio for audio. FMOD Studio requires an account to download the API. Falling back to OpenAL for audio support.
    
      109  # - Don't use Havok for physics. Havok requires license. This only affects Mesh uploads.
    
      110  # - Enable OpenSim support
    
      111  # - Pass --fresh to cmake to ensure flags are up to date
    
      112  autobuild build -A 64 -c ReleaseFS -- --chan "$channel" \
    
      113    --package \
    
      114    --avx2 \
    
      115    -DUSE_KDU:BOOL=OFF \
    
      116    -DUSE_FMODSTUDIO:BOOL=OFF \
    
      117    -DHAVOK_TPV:BOOL=OFF \
    
      118    -DOPENSIM:BOOL=ON \
    
      119    --fresh
    
      120  
    
      121  # Deactivate the virtual environment after the build is complete
    
      122  deactivate
    
      123}
    
      124
    
      125package() {
    
      126  mkdir -p "$pkgdir/opt"
    
      127  mkdir -p "$pkgdir/usr/share/applications"
    
      128  mkdir -p "$pkgdir/usr/share/icons/hicolor/512x512/apps"
    
      129
    
      130  # Install the packaged output to /opt/firestorm-$_extension
    
      131  mv "$pkgname/build-linux-x86_64/newview/packaged" "$pkgdir/opt/firestorm-$_extension"
    
      132
    
      133  install -Dm755 "firestorm.launcher" "$pkgdir/usr/bin/firestorm-$_extension"
    
      134  install -Dm644 "firestorm.desktop" "$pkgdir/usr/share/applications/firestorm-$_extension.desktop"
    
      135
    
      136  # Replace [EXTENSION] with the actual extension in the launcher and desktop file
    
      137  sed -i "s/\[EXTENSION\]/$_extension/g" "$pkgdir/usr/bin/firestorm-$_extension"
    
      138  sed -i "s/\[EXTENSION\]/$_extension/g" "$pkgdir/usr/share/applications/firestorm-$_extension.desktop"
    
      139
    
      140  install -Dm644 "$pkgdir/opt/firestorm-$_extension/firestorm_icon.png" "$pkgdir/usr/share/icons/hicolor/512x512/apps/firestorm-$_extension.png"
    
      141
    
      142  # rename "do-not-directly-run-firestorm-bin" to "do-not-directly-run-firestorm-$_extension" in the bin directory
    
      143  # firestorm uses that as the class name.
    
      144  # This allows us to have both the OS version and the official version installed at the same time
    
      145  # The .desktop file needs to match this name in the StartupWMClass field to work properly with the window manager.
    
      146  mv "$pkgdir/opt/firestorm-$_extension/bin/do-not-directly-run-firestorm-bin" "$pkgdir/opt/firestorm-$_extension/bin/do-not-directly-run-firestorm-$_extension"
    
      147
    
      148  # replace "do-not-directly-run-firestorm-bin" with "do-not-directly-run-firestorm-$_extension" in the "firestorm" script
    
      149  sed -i "s/do-not-directly-run-firestorm-bin/do-not-directly-run-firestorm-$_extension/g" "$pkgdir/opt/firestorm-$_extension/firestorm"
    
      150}
    
      151
    
      152

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2