krita-ai-diffusion

maintainer rkmax · 2 votes · scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged The pip install is part of building the plugin from its own source within a local venv for packaging; it installs declared dependencies from the project's requirements.txt, not arbitrary external code.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install is part of building the plugin from its own source within a local venv for packaging; it installs declared dependencies from the project's requirements.txt, not arbitrary external code.

2 higher static findings superseded - not the current verdict (shown for transparency)
MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

  • PKGBUILD:46 uv pip install -r requirements.txt
MEDIUM External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

  • PKGBUILD:46 uv pip install -r requirements.txt

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Julian Reyes <contacto@julianreyes.co>
2# Contributor: Roald Clark <roaldclark@gmail.com>
3
4pkgname=krita-ai-diffusion
5pkgver=1.48.0
6pkgrel=1
7pkgdesc="A plugin to use generative AI in image painting and editing workflows from within Krita"
8arch=('any')
9url="https://github.com/Acly/krita-ai-diffusion"
10license=('GPL-3.0-or-later')
11depends=(
12 'krita'
13 'python-pyqt5'
14 'qt5-imageformats'
15)
16makedepends=(
17 'git'
18 'git-lfs'
19 'uv'
20)
21checkdepends=(
22 'openssl'
23)
24install=krita-ai-diffusion.install
25source=("${pkgname}::git+${url}.git#tag=v${pkgver}"
26 "add-regex-to-requirements.patch")
27sha256sums=('304b1f71ff865e340c5b6b23ed9a6ab75bb0ee0f6066583f7db34bdcabaf5040'
28 '3cdb6f448e78ae8bcfe4427d6a7b44a732b375366aa52dd4aaceb11f328edaf0')
29
30# If `git lfs install` was run before, `makepkg` may error
31# Set this env var to resolve
32export GIT_LFS_SKIP_SMUDGE=1
33
34prepare() {
35 # The plugin itself will run inside Krita's embedded Python,
36 # and only has access to the Python standard library and Qt5
37 cd "${srcdir}/${pkgname}"
38 patch -Np1 -i ../add-regex-to-requirements.patch
39 git submodule update --init --recursive
40 git lfs install --local
41 git remote add network-origin "${url}.git"
42 git lfs fetch network-origin
43 git lfs checkout
44 uv venv --python 3.12 .venv
45 source .venv/bin/activate
46 uv pip install -r requirements.txt
47}
48
49build() {
50 cd "${srcdir}/${pkgname}"
51 source .venv/bin/activate
52 python scripts/package.py
53}
54
55check() {
56 cd "${srcdir}/${pkgname}"
57 source .venv/bin/activate
58 if [[ $(vercmp "${pkgver}" "1.21.0") -gt 0 ]]; then
59 python scripts/download_models.py --minimal scripts/downloads
60 else
61 python scripts/download_models.py --minimal scripts/docker/downloads
62 fi
63 python -m pytest tests/test_server.py -vs --test-install
64 python -m pytest tests -vs --ci
65}
66
67package() {
68 cd "${srcdir}/${pkgname}"/scripts/.package
69 install -d -m 755 "${pkgdir}"/usr/share/krita/pykrita/
70 cp -r {ai_diffusion,ai_diffusion.desktop} "${pkgdir}"/usr/share/krita/pykrita/
71 install -D -m 644 ai_diffusion/ai_diffusion.action -t "${pkgdir}"/usr/share/krita/actions/
72}
73

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 LOW 3
2026-08-02 00:16:08 LOW 3
2026-08-01 00:11:18 LOW 3
2026-07-31 00:14:10 LOW 3
2026-07-30 00:17:23 LOW 3
2026-07-29 00:25:53 LOW 3
2026-07-28 00:07:28 LOW 3
2026-07-27 00:24:32 LOW 3
2026-07-26 00:07:32 LOW 3
2026-07-25 00:13:44 LOW 3
2026-07-24 00:02:28 LOW 3
2026-07-23 00:14:47 LOW 3
2026-07-22 00:29:32 LOW 3
2026-07-21 00:24:15 LOW 3
2026-07-20 00:19:49 LOW 3
2026-07-19 00:17:08 LOW 3
2026-07-18 00:14:48 LOW 3
2026-07-17 00:06:16 LOW 3
2026-07-16 00:05:41 LOW 3
2026-07-15 00:09:25 LOW 3

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion