headroom-ai-bin
MEDIUM
maintainer Quatro
2 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package installs a Python wheel from PyPI and uses pip to install dependencies specified within it, including an extra [proxy] set that pulls in numerous external packages; while PyPI is a known repository, the dynamic resolution of dependencies from a variable-defined extra in a prebuilt wheel creates an unverifiable supply-chain risk if the wheel or its metadata were tampered with.
Triggered rules
Medium
pip install of an external package
pip_install_external
`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:41
./venv/bin/python -m pip install --quiet --no-cache-dir --upgrade pip
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package installs a Python wheel from PyPI and uses pip to install dependencies specified within it, including an extra [proxy] set that pulls in numerous external packages; while PyPI is a known repository, the dynamic resolution of dependencies from a variable-defined extra in a prebuilt wheel creates an unverifiable supply-chain risk if the wheel or its metadata were tampered with.
-
PKGBUILD:42
./venv/bin/python -m pip install --no-cache-dir --no-compile "$srcdir/$_wheel[proxy]"
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: Xavier Francisco <echo moc.liamg@ocsicnarf.n.reivax | rev>
2
3
pkgname=headroom-ai-bin
4
_pyname=headroom_ai
5
pkgver=0.37.0
6
pkgrel=1
7
pkgdesc="Context optimization layer for LLM applications - cut token costs by 50-90% (binary wheel, Python 3.12)"
8
arch=('x86_64')
9
url="https://github.com/chopratejas/headroom"
10
license=('Apache-2.0')
11
depends=('python312' 'ast-grep')
12
provides=("headroom-ai=$pkgver")
13
conflicts=('headroom-ai')
14
# Prebuilt wheel + vendored .so's: don't strip them or extract a -debug package
15
# (avoids dangling build-id debug symlinks for the bundled binaries).
16
options=('!strip' '!debug')
17
18
# Upstream switched from pure-Python (hatchling) to Rust+maturin in 0.21.x.
19
# 0.32.1 ships a stable-ABI cp310-abi3 wheel for x86_64 Linux. We install it into
20
# a python3.12 venv: abi3 wheels run on any Python >=3.10, and pinning python3.12
21
# (a fixed-version package) keeps the vendored venv stable across Arch's rolling
22
# /usr/bin/python bumps.
23
#
24
# Arch's python-* ecosystem (tiktoken/pydantic/litellm/...) is built against
25
# /usr/bin/python (3.14) and is invisible to /usr/bin/python3.12, so we can't
26
# satisfy headroom's Python deps via regular Arch packages. We vendor them
27
# into /usr/lib/python3.12/site-packages/ via pip in a transient venv.
28
#
29
# The wheel declares fastapi/uvicorn/openai/mcp/onnxruntime/transformers/etc.
30
# as the `proxy` extra, but headroom.cli imports headroom.proxy unconditionally
31
# so the [proxy] set is effectively required just for `headroom --help` to load.
32
_pytag=cp310-abi3-manylinux_2_28_x86_64
33
_wheel="$_pyname-$pkgver-$_pytag.whl"
34
source=("$_wheel::https://files.pythonhosted.org/packages/72/b8/16878cf4fe6fc390a0d22025b671468619db690ff14c1b103ace4b5e35f9/$_wheel")
35
noextract=("$_wheel")
36
sha256sums=('2efc5cdf681a10c5fc7a2a271a471179c409074537045f682b10e4d724976f46')
37
38
build() {
39
rm -rf venv
40
/usr/bin/python3.12 -m venv venv
41
./venv/bin/python -m pip install --quiet --no-cache-dir --upgrade pip
42
./venv/bin/python -m pip install --no-cache-dir --no-compile "$srcdir/$_wheel[proxy]"
43
}
44
45
package() {
46
local sitepkg="$pkgdir/usr/lib/python3.12/site-packages"
47
install -dm755 "$sitepkg"
48
49
# Copy the venv's vendored deps, then strip bootstrap + bytecode noise.
50
cp -a venv/lib/python3.12/site-packages/. "$sitepkg/"
51
rm -rf \
52
"$sitepkg"/pip "$sitepkg"/pip-*.dist-info \
53
"$sitepkg"/setuptools "$sitepkg"/setuptools-*.dist-info \
54
"$sitepkg"/wheel "$sitepkg"/wheel-*.dist-info \
55
"$sitepkg"/_distutils_hack "$sitepkg"/pkg_resources \
56
"$sitepkg"/distutils-precedence.pth
57
find "$sitepkg" -depth -type d -name __pycache__ -exec rm -rf {} +
58
59
install -dm755 "$pkgdir/usr/bin"
60
cat > "$pkgdir/usr/bin/headroom" <<'EOF'
61
#!/usr/bin/python3.12
62
import sys
63
from headroom.cli import main
64
if __name__ == '__main__':
65
sys.exit(main())
66
EOF
67
chmod 755 "$pkgdir/usr/bin/headroom"
68
}
69
Changes since previous scan
--- PKGBUILD @ 2026-08-30 00:04+++ PKGBUILD @ 2026-09-17 00:27@@ -2,7 +2,7 @@ pkgname=headroom-ai-bin _pyname=headroom_ai-pkgver=0.34.0+pkgver=0.37.0 pkgrel=1 pkgdesc="Context optimization layer for LLM applications - cut token costs by 50-90% (binary wheel, Python 3.12)" arch=('x86_64')@@ -31,9 +31,9 @@ # so the [proxy] set is effectively required just for `headroom --help` to load. _pytag=cp310-abi3-manylinux_2_28_x86_64 _wheel="$_pyname-$pkgver-$_pytag.whl"-source=("$_wheel::https://files.pythonhosted.org/packages/93/09/2b5a3470207cb4c8d75bf737d0bc8e59c5ab80b3c28f5d46b2aaa97913df/$_wheel")+source=("$_wheel::https://files.pythonhosted.org/packages/72/b8/16878cf4fe6fc390a0d22025b671468619db690ff14c1b103ace4b5e35f9/$_wheel") noextract=("$_wheel")-sha256sums=('061d974b4f4e95b8fc9611fc4d059331e43fd2bd4737243bbed5fcb3af82775f')+sha256sums=('2efc5cdf681a10c5fc7a2a271a471179c409074537045f682b10e4d724976f46') build() { rm -rf venvScan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Medium | 2 |
| 2026-09-16 00:03:17 | Medium | 2 |
| 2026-09-15 00:25:31 | Medium | 2 |
| 2026-09-14 00:27:57 | Medium | 2 |
| 2026-09-13 00:19:54 | Medium | 2 |
| 2026-09-12 00:25:17 | Medium | 2 |
| 2026-09-11 00:19:22 | Medium | 2 |
| 2026-09-10 00:22:44 | Medium | 2 |
| 2026-09-09 00:04:09 | Medium | 2 |
| 2026-09-08 00:18:08 | Medium | 2 |
| 2026-09-07 00:30:15 | Medium | 2 |
| 2026-09-06 00:17:06 | Medium | 2 |
| 2026-09-05 00:16:27 | Medium | 2 |
| 2026-09-04 00:03:13 | Medium | 2 |
| 2026-09-03 00:15:47 | Medium | 2 |
| 2026-09-02 00:02:31 | Medium | 2 |
| 2026-09-01 00:11:19 | Medium | 2 |
| 2026-08-31 00:19:57 | Medium | 2 |
| 2026-08-30 03:41:10 | Medium | 2 |
| 2026-08-30 00:04:14 | Low | 2 |