funkwhale-venv

LOW

maintainer etienne 3 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The pip install is used to install Python dependencies from the locally extracted and trusted source code ('./api'), not from external untrusted packages, so it does not pose a supply-chain risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install is used to install Python dependencies from the locally extracted and trusted source code ('./api'), not from external untrusted packages, so it does not pose a supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:88 pip install --upgrade pip wheel

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: getzze <getzze at gmail dot com>
    
      2
    
      3pkgname=funkwhale-venv
    
      4_pkgname=funkwhale
    
      5pkgver=2.0.10
    
      6pkgrel=1
    
      7pkgdesc="A community-driven project that lets you listen and share music and audio within a decentralized, open network."
    
      8arch=(any)
    
      9url="https://funkwhale.audio/"
    
      10license=(GPL3)
    
      11provides=('funkwhale')
    
      12conflicts=('funkwhale')
    
      13optdepends=('apache: to use the Apache web server'
    
      14            'certbot-apache: for the server to be accessible from outside'
    
      15            'mod_xsendfile: needed if Apache server is used'
    
      16            'nginx: to use nginx web server')
    
      17depends=('curl'
    
      18        'file'
    
      19        'ffmpeg'
    
      20        'libjpeg-turbo'
    
      21        'libpqxx'
    
      22        'libsasl'
    
      23        'postgresql'
    
      24        'redis'
    
      25        'python313'
    
      26)
    
      27makedepends=(git)
    
      28# do not strip for pip wheel libraries
    
      29options=(!strip)
    
      30_source_api="https://dev.funkwhale.audio/funkwhale/funkwhale/-/jobs/artifacts/${pkgver}/download?job="
    
      31_source_env="https://dev.funkwhale.audio/funkwhale/funkwhale/raw/${pkgver}/deploy/"
    
      32source=("${_pkgname}-${pkgver}-api.zip::${_source_api}build_api"
    
      33        "${_pkgname}-${pkgver}-front.zip::${_source_api}build_front"
    
      34        "${_source_env}funkwhale_proxy.conf"
    
      35        "${_source_env}nginx.template"
    
      36        "funkwhale.target"
    
      37        "funkwhale-beat.service"
    
      38        "funkwhale-server.service"
    
      39        "funkwhale-worker.service"
    
      40        "apache-funkwhale.conf"
    
      41        "env-template"
    
      42        "funkwhale_manage"
    
      43)
    
      44sha256sums=('27c46f327912d1a1ade09d0199ac3f7c1dcac702b974ba27d7be8eb9166194d4'
    
      45            '9cd17dcf1b3c09cfe49b70bf4407d45552ca416ca816480bebd2ceccfd64921c'
    
      46            '2906a075b41dcd2375c601482cb5a00e42cb87c613012b176c570d77918afbf2'
    
      47            '1e887126b1380dc614e014f6e80957019b711a9be61a2ba3a52aa9493c99f9b4'
    
      48            '5c821649d81d2d3a9aa52d872953696d5ae336906329a1c1b68871ce9c82fa59'
    
      49            '8f98e97b835225fdc2b89cfe2fa6f343d1fa36fdd5616c8585393ebd9c8169b8'
    
      50            'aecdf1a9283b6dc905820a5dd399bb00bbcab9819227ac438cb014d4ad1b5200'
    
      51            'd59bbf1a5bc82d2866fbfb5efa3f519469125ea9d4e24dfaa374f85ec6962ae7'
    
      52            'a5c51df1b8160b9e871d6e211c2668a6abbfabfad9e38d53d937b36162406450'
    
      53            'cea307055e9f8001a1507c507e1be91352d896cab17260a221f4ab8c298506d8'
    
      54            '202b1fe3ae4c8c3913d23646a8ebda7312f1725c3d69f15bee8cf599d9db62a9')
    
      55install=${pkgname}.install
    
      56
    
      57prepare() {
    
      58  cd "$srcdir"
    
      59
    
      60  ## change path of proxy parameters
    
      61  sed 's#/etc/nginx/funkwhale_proxy.conf#/etc/webapps/funkwhale/funkwhale_proxy.conf#' nginx.template > nginx.template.patched
    
      62}
    
      63
    
      64build() {
    
      65  cd "$srcdir"
    
      66  ## TODO: build front-end from source
    
      67}
    
      68
    
      69package() {
    
      70  cd "$srcdir"
    
      71
    
      72  install -dm0755 -o root "$pkgdir"/usr/share/webapps/${_pkgname}
    
      73
    
      74  # install api and frontend
    
      75  cp -R api "$pkgdir"/usr/share/webapps/${_pkgname}/.
    
      76  cp -R front "$pkgdir"/usr/share/webapps/${_pkgname}/.
    
      77  chmod 755 -R "$pkgdir"/usr/share/webapps/${_pkgname}/api/
    
      78  chown root:http -R "$pkgdir"/usr/share/webapps/${_pkgname}/api/
    
      79  mkdir "$pkgdir"/usr/bin
    
      80  install -Dm755 funkwhale_manage "$pkgdir"/usr/bin/funkwhale_manage
    
      81
    
      82  # create virtualenv and install python dependencies
    
      83  export PIP_DISABLE_PIP_VERSION_CHECK=1
    
      84  export PYTHONDONTWRITEBYTECODE=1
    
      85  python3.13 -m venv "$pkgdir"/usr/share/webapps/funkwhale/virtualenv
    
      86  source "$pkgdir"/usr/share/webapps/funkwhale/virtualenv/bin/activate
    
      87
    
      88  pip install --upgrade pip wheel
    
      89  pip install --editable ./api
    
      90
    
      91  # Remove srcdir references in scripts
    
      92  find "$pkgdir"/usr/share/webapps/funkwhale/virtualenv/lib/python*/site-packages/funkwhale_api* \
    
      93    -maxdepth 2 -type f -exec sed -i "s#${srcdir}/api#/usr/share/webapps/${_pkgname}/api#g" {} +
    
      94
    
      95  # Remove pkgdir references in scripts
    
      96  find "$pkgdir"/usr/share/webapps/funkwhale/virtualenv/bin/ \
    
      97    -maxdepth 1 -type f -exec sed -i "s#${pkgdir}/#/#g" {} +
    
      98  find "$pkgdir"/usr/share/webapps/funkwhale/virtualenv/pyvenv.cfg \
    
      99    -maxdepth 1 -type f -exec sed -i "s#${pkgdir}/#/#g" {} +
    
      100  find "$pkgdir"/usr/share/webapps/funkwhale/virtualenv/ \
    
      101    -type f -name "*.py[co]" -delete
    
      102  find "$pkgdir"/usr/share/webapps/funkwhale/virtualenv/ \
    
      103    -type d -name "__pycache__" -delete
    
      104
    
      105  # deactivate virtualenv
    
      106  deactivate
    
      107
    
      108  # install server config
    
      109  install -d "$pkgdir"/etc/webapps/${_pkgname}/config
    
      110  install -Dm644 funkwhale_proxy.conf "$pkgdir"/etc/webapps/${_pkgname}/.
    
      111  install -Dm644 nginx.template.patched "$pkgdir"/etc/webapps/${_pkgname}/nginx.template
    
      112  install -Dm644 apache-funkwhale.conf "$pkgdir"/etc/webapps/${_pkgname}/.
    
      113  install -Dm644 env-template "$pkgdir"/etc/webapps/${_pkgname}/env.template
    
      114
    
      115  install -Dm644 funkwhale.target funkwhale{-beat,-worker,-server}.service -t "$pkgdir/usr/lib/systemd/system/"
    
      116
    
      117  echo -e 'u funkwhale - "Funkwhale music server" /srv/funkwhale\nm funkwhale http' |
    
      118    install -Dm644 /dev/stdin "$pkgdir/usr/lib/sysusers.d/$pkgname.conf"
    
      119  echo 'd /srv/funkwhale 0775 funkwhale funkwhale' |
    
      120    install -Dm644 /dev/stdin "$pkgdir/usr/lib/tmpfiles.d/$pkgname.conf"
    
      121}
    
      122

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2