gourmand-git

MEDIUM

maintainer fridge 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package uses pip to install a Python wheel built from the local source, but the command `venv/bin/pip install --isolated "$wheel[$extras]" "setuptools"` involves a variable expansion `$extras` derived from an external script `get-extras.py` that could influence what is installed, creating a potential supply-chain risk if the script is tampered with or returns unexpected input.

Triggered rules

Medium pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:37 venv/bin/pip install --isolated "$wheel[$extras]" "setuptools"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is MEDIUM (confidence 90%): The package uses pip to install a Python wheel built from the local source, but the command `venv/bin/pip install --isolated "$wheel[$extras]" "setuptools"` involves a variable expansion `$extras` derived from an external script `get-extras.py` that could influence what is installed, creating a potential supply-chain risk if the script is tampered with or returns unexpected input.

PKGBUILD:37 venv/bin/pip install --isolated "$wheel[$extras]" "setuptools"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: fridge <echo dW5sb3ZhYmxlX2ZyaWRnZTM1NkBhbGVlYXMuY29tCg== | base64 -d>
    
      2pkgname="gourmand-git"
    
      3pkgver="1.2.0.r20.be6261df"
    
      4pkgrel="2"
    
      5pkgdesc="A manager, editor, and organizer for recipes."
    
      6url="https://github.com/GourmandRecipeManager/${pkgname%-git}"
    
      7license=("GPL-2.0-only")
    
      8source=("$pkgname::git+$url.git" "get-extras.py")
    
      9b2sums=("SKIP" "d31820469d0cc07c6c53f7ef2bcf59dd153c82b5fc44347bf78d32797f43dbae2ac0a158ed2aba4dc4a2a74cb54539fb5fe1e6148c81e544503da054d992fcbc")
    
      10arch=("x86_64")
    
      11makedepends=("gendesk" "coreutils" "python-virtualenv" "python-pip" "python-setuptools" "git" "intltool")
    
      12depends=("bash")
    
      13conflicts=("${pkgname%-git}")
    
      14provides=("${pkgname%-git}=$pkgver")
    
      15
    
      16pkgver()
    
      17{
    
      18    cd "$pkgname" || exit
    
      19    local currentCommit; currentCommit="$(git rev-parse HEAD)"
    
      20    local latestReleaseWithoutPreReleases; latestReleaseWithoutPreReleases="$(git describe --tags --abbrev=0 --exclude "*rc*")"
    
      21    git describe --long --tags --match "$latestReleaseWithoutPreReleases" "$currentCommit" | sed -r "s/-([0-9]+)-/.r\1./; s/\.g/./"
    
      22}
    
      23
    
      24build()
    
      25{
    
      26    gendesk -f -n --categories="Utility" --startupnotify="true"
    
      27    echo "creating start script"
    
      28    echo -e '#!/bin/bash\ncd "/opt/'"${pkgname%-git}"'/bin"\n"./'"${pkgname%-git}"'" -q "$@"' > "${pkgname%-git}"
    
      29    cd "$pkgname" || exit
    
      30    echo "creating virtual environment"
    
      31    python -m venv --clear --copies venv
    
      32    echo "building Gourmand wheel"
    
      33    python setup.py bdist_wheel
    
      34    echo "installing into virtual environment"
    
      35    local wheel; wheel="$(ls dist/*.whl)"
    
      36    local extras; extras="$($srcdir/get-extras.py)"
    
      37    venv/bin/pip install --isolated "$wheel[$extras]" "setuptools"
    
      38    echo "removing unnecessary packages from virtual environment"
    
      39    venv/bin/pip uninstall --isolated -y pip
    
      40    echo "making virtual environment portable"
    
      41    sed -i '1s|.*|#!/usr/bin/env -S /bin/sh -c '"'"'"\$(dirname "\$0")/python" "\$0" "\$@"'"'"'|' "venv/bin/${pkgname%-git}"
    
      42}
    
      43
    
      44package()
    
      45{
    
      46    install -dv "$pkgdir/opt/${pkgname%-git}"
    
      47    cp -afLv "$pkgname/venv/"* "$pkgdir/opt/${pkgname%-git}"
    
      48    install -Dvm755 "${pkgname%-git}" "$pkgdir/usr/bin/${pkgname%-git}"
    
      49    install -Dvm644 "${pkgname%-git}.desktop" "$pkgdir/usr/share/applications/${pkgname%-git}.desktop"
    
      50    install -Dvm644 "$pkgname/src/${pkgname%-git}/data/images/${pkgname%-git}.svg" "$pkgdir/usr/share/icons/${pkgname%-git}.svg"
    
      51}
    
      52

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2