krita-ai-diffusion

LOW

maintainer rkmax 2 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The pip install is part of building the plugin from its own source in a controlled venv for packaging; it installs declared dependencies from the project's requirements.txt, not arbitrary external code, and the final install is pure Python/Qt data placed in Krita's plugin directory.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install is part of building the plugin from its own source in a controlled venv for packaging; it installs declared dependencies from the project's requirements.txt, not arbitrary external code, and the final install is pure Python/Qt data placed in Krita's plugin directory.

2 higher static findings superseded - not the current verdict (shown for transparency)

Medium pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:47 uv pip install -r requirements.txt

Medium External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:47 uv pip install -r requirements.txt

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Julian Reyes <contacto@julianreyes.co>
    
      2# Contributor: Roald Clark <roaldclark@gmail.com>
    
      3
    
      4pkgname=krita-ai-diffusion
    
      5pkgver=1.53.0.r6.gdda58d1
    
      6pkgrel=1
    
      7pkgdesc="A plugin to use generative AI in image painting and editing workflows from within Krita"
    
      8arch=('any')
    
      9url="https://github.com/Acly/krita-ai-diffusion"
    
      10license=('GPL-3.0-or-later')
    
      11depends=(
    
      12    'krita'
    
      13    'python-pyqt6'
    
      14    'qt6-imageformats'
    
      15)
    
      16makedepends=(
    
      17    'git'
    
      18    'git-lfs'
    
      19    'uv'
    
      20)
    
      21checkdepends=(
    
      22    'openssl'
    
      23)
    
      24install=krita-ai-diffusion.install
    
      25_commit=dda58d1c63e361207ccec085efbc34dbd32f1654
    
      26source=("${pkgname}::git+${url}.git#commit=${_commit}"
    
      27        "fix-it-json-syntax.patch")
    
      28sha256sums=('cc8354e0d0e19a417950e6825bb9974fe9cb3dc34c5206c0f4dcec12c3781025'
    
      29            '55fdda2a4349e4a271cf7dc5bd5d2171d6a1c18ab19bad58f0d033e0a8cf51ef')
    
      30
    
      31# If `git lfs install` was run before, `makepkg` may error
    
      32# Set this env var to resolve
    
      33export GIT_LFS_SKIP_SMUDGE=1
    
      34
    
      35prepare() {
    
      36    # The plugin itself will run inside Krita's embedded Python,
    
      37    # and only has access to the Python standard library and Qt5
    
      38    cd "${srcdir}/${pkgname}"
    
      39    patch -Np1 -i ../fix-it-json-syntax.patch
    
      40    git submodule update --init --recursive
    
      41    git lfs install --local
    
      42    git remote add network-origin "${url}.git"
    
      43    git lfs fetch network-origin
    
      44    git lfs checkout
    
      45    uv venv --python 3.12 .venv
    
      46    source .venv/bin/activate
    
      47    uv pip install -r requirements.txt
    
      48}
    
      49
    
      50build() {
    
      51    cd "${srcdir}/${pkgname}"
    
      52    source .venv/bin/activate
    
      53    python scripts/package.py
    
      54}
    
      55
    
      56check() {
    
      57    cd "${srcdir}/${pkgname}"
    
      58    source .venv/bin/activate
    
      59    if [[ $(vercmp "${pkgver}" "1.21.0") -gt 0 ]]; then
    
      60        python scripts/download_models.py --minimal scripts/downloads
    
      61    else
    
      62        python scripts/download_models.py --minimal scripts/docker/downloads
    
      63    fi
    
      64    python -m pytest tests/test_server.py -vs --test-install
    
      65    python -m pytest tests -vs --ci
    
      66}
    
      67
    
      68package() {
    
      69    cd "${srcdir}/${pkgname}"/scripts/.package
    
      70    install -d -m 755 "${pkgdir}"/usr/share/krita/pykrita/
    
      71    cp -r {ai_diffusion,ai_diffusion.desktop} "${pkgdir}"/usr/share/krita/pykrita/
    
      72    install -D -m 644 ai_diffusion/ai_diffusion.action -t "${pkgdir}"/usr/share/krita/actions/
    
      73}
    
      74

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	3
2026-09-16 00:03:17	Low	3
2026-09-15 00:25:31	Low	3
2026-09-14 00:27:57	Low	3
2026-09-13 00:19:54	Low	3
2026-09-12 00:25:17	Low	3
2026-09-11 00:19:22	Low	3
2026-09-10 00:22:44	Low	3
2026-09-09 00:04:09	Low	3
2026-09-08 00:18:08	Low	3
2026-09-07 00:30:15	Low	3
2026-09-06 00:17:06	Low	3
2026-09-05 00:16:27	Low	3
2026-09-04 00:03:13	Low	3
2026-09-03 00:15:47	Low	3
2026-09-02 00:02:31	Low	3
2026-09-01 00:11:19	Low	3
2026-08-31 00:19:57	Low	3
2026-08-30 00:04:14	Low	3
2026-08-29 00:29:17	Low	3