funkwhale-venv

maintainer etienne · 3 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The pip install is used to install Python dependencies from the locally extracted and trusted source code (api/ directory), not from an external untrusted package, making it a standard part of building the application in a virtual environment.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install is used to install Python dependencies from the locally extracted and trusted source code (api/ directory), not from an external untrusted package, making it a standard part of building the application in a virtual environment.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:88 pip install --upgrade pip wheel

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: getzze <getzze at gmail dot com>
    
      2
    
      3pkgname=funkwhale-venv
    
      4_pkgname=funkwhale
    
      5pkgver=1.4.1
    
      6pkgrel=1
    
      7pkgdesc="A community-driven project that lets you listen and share music and audio within a decentralized, open network."
    
      8arch=(any)
    
      9url="https://funkwhale.audio/"
    
      10license=(GPL3)
    
      11provides=('funkwhale')
    
      12conflicts=('funkwhale')
    
      13optdepends=('apache: to use the Apache web server'
    
      14            'certbot-apache: for the server to be accessible from outside'
    
      15            'mod_xsendfile: needed if Apache server is used'
    
      16            'nginx: to use nginx web server')
    
      17depends=('curl'
    
      18        'file'
    
      19        'ffmpeg'
    
      20        'libjpeg'
    
      21        'libpqxx'
    
      22        'libsasl'
    
      23        'postgresql'
    
      24        'redis'
    
      25        'python311'
    
      26)
    
      27makedepends=(git)
    
      28# do not strip for pip wheel libraries
    
      29options=(!strip)
    
      30_source_api="https://dev.funkwhale.audio/funkwhale/funkwhale/-/jobs/artifacts/${pkgver}/download?job="
    
      31_source_env="https://dev.funkwhale.audio/funkwhale/funkwhale/raw/${pkgver}/deploy/"
    
      32source=("${_pkgname}-${pkgver}-api.zip::${_source_api}build_api"
    
      33        "${_pkgname}-${pkgver}-front.zip::${_source_api}build_front"
    
      34        "${_source_env}funkwhale_proxy.conf"
    
      35        "${_source_env}nginx.template"
    
      36        "funkwhale.target"
    
      37        "funkwhale-beat.service"
    
      38        "funkwhale-server.service"
    
      39        "funkwhale-worker.service"
    
      40        "apache-funkwhale.conf"
    
      41        "env-template"
    
      42        "funkwhale_manage"
    
      43)
    
      44sha256sums=('795faf2f233fbc9e77a3a6eed224c1413b5ed4edda390f363afc0c022479ec73'
    
      45            'f6d654a6f8d4cfbb1c59d86959d942529d49a1cdff0c77014645327c769105e0'
    
      46            '2906a075b41dcd2375c601482cb5a00e42cb87c613012b176c570d77918afbf2'
    
      47            '9e72558dee732c6783c597f5cb61e89ad346d4d3810d94f83afba2db580fb089'
    
      48            '5c821649d81d2d3a9aa52d872953696d5ae336906329a1c1b68871ce9c82fa59'
    
      49            '8f98e97b835225fdc2b89cfe2fa6f343d1fa36fdd5616c8585393ebd9c8169b8'
    
      50            'aecdf1a9283b6dc905820a5dd399bb00bbcab9819227ac438cb014d4ad1b5200'
    
      51            'd59bbf1a5bc82d2866fbfb5efa3f519469125ea9d4e24dfaa374f85ec6962ae7'
    
      52            'a5c51df1b8160b9e871d6e211c2668a6abbfabfad9e38d53d937b36162406450'
    
      53            'cea307055e9f8001a1507c507e1be91352d896cab17260a221f4ab8c298506d8'
    
      54            '202b1fe3ae4c8c3913d23646a8ebda7312f1725c3d69f15bee8cf599d9db62a9')
    
      55install=${pkgname}.install
    
      56
    
      57prepare() {
    
      58  cd "$srcdir"
    
      59
    
      60  ## change path of proxy parameters
    
      61  sed 's#/etc/nginx/funkwhale_proxy.conf#/etc/webapps/funkwhale/funkwhale_proxy.conf#' nginx.template > nginx.template.patched
    
      62}
    
      63
    
      64build() {
    
      65  cd "$srcdir"
    
      66  ## TODO: build front-end from source
    
      67}
    
      68
    
      69package() {
    
      70  cd "$srcdir"
    
      71
    
      72  install -dm0755 -o root "$pkgdir"/usr/share/webapps/${_pkgname}
    
      73
    
      74  # install api and frontend
    
      75  cp -R api "$pkgdir"/usr/share/webapps/${_pkgname}/.
    
      76  cp -R front "$pkgdir"/usr/share/webapps/${_pkgname}/.
    
      77  chmod 755 -R "$pkgdir"/usr/share/webapps/${_pkgname}/api/
    
      78  chown root:http -R "$pkgdir"/usr/share/webapps/${_pkgname}/api/
    
      79  mkdir "$pkgdir"/usr/bin
    
      80  install -Dm755 funkwhale_manage "$pkgdir"/usr/bin/funkwhale_manage
    
      81
    
      82  # create virtualenv and install python dependencies
    
      83  export PIP_DISABLE_PIP_VERSION_CHECK=1
    
      84  export PYTHONDONTWRITEBYTECODE=1
    
      85  python3.11 -m venv "$pkgdir"/usr/share/webapps/funkwhale/virtualenv
    
      86  source "$pkgdir"/usr/share/webapps/funkwhale/virtualenv/bin/activate
    
      87
    
      88  pip install --upgrade pip wheel
    
      89  pip install --editable ./api
    
      90
    
      91  # Remove srcdir references in scripts
    
      92  find "$pkgdir"/usr/share/webapps/funkwhale/virtualenv/lib/python*/site-packages/funkwhale_api* \
    
      93    -maxdepth 2 -type f -exec sed -i "s#${srcdir}/api#/usr/share/webapps/${_pkgname}/api#g" {} +
    
      94
    
      95  # Remove pkgdir references in scripts
    
      96  find "$pkgdir"/usr/share/webapps/funkwhale/virtualenv/bin/ \
    
      97    -maxdepth 1 -type f -exec sed -i "s#${pkgdir}/#/#g" {} +
    
      98  find "$pkgdir"/usr/share/webapps/funkwhale/virtualenv/pyvenv.cfg \
    
      99    -maxdepth 1 -type f -exec sed -i "s#${pkgdir}/#/#g" {} +
    
      100  find "$pkgdir"/usr/share/webapps/funkwhale/virtualenv/ \
    
      101    -type f -name "*.py[co]" -delete
    
      102  find "$pkgdir"/usr/share/webapps/funkwhale/virtualenv/ \
    
      103    -type d -name "__pycache__" -delete
    
      104
    
      105  # deactivate virtualenv
    
      106  deactivate
    
      107
    
      108  # install server config
    
      109  install -d "$pkgdir"/etc/webapps/${_pkgname}/config
    
      110  install -Dm644 funkwhale_proxy.conf "$pkgdir"/etc/webapps/${_pkgname}/.
    
      111  install -Dm644 nginx.template.patched "$pkgdir"/etc/webapps/${_pkgname}/nginx.template
    
      112  install -Dm644 apache-funkwhale.conf "$pkgdir"/etc/webapps/${_pkgname}/.
    
      113  install -Dm644 env-template "$pkgdir"/etc/webapps/${_pkgname}/env.template
    
      114
    
      115  install -Dm644 funkwhale.target funkwhale{-beat,-worker,-server}.service -t "$pkgdir/usr/lib/systemd/system/"
    
      116
    
      117  echo -e 'u funkwhale - "Funkwhale music server" /srv/funkwhale\nm funkwhale http' |
    
      118    install -Dm644 /dev/stdin "$pkgdir/usr/lib/sysusers.d/$pkgname.conf"
    
      119  echo 'd /srv/funkwhale 0775 funkwhale funkwhale' |
    
      120    install -Dm644 /dev/stdin "$pkgdir/usr/lib/tmpfiles.d/$pkgname.conf"
    
      121}
    
      122

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2