lostorm-git

LOW

maintainer jesusokay 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The pip install is for build dependencies from a requirements.txt file in the project's own source repository, which is a normal part of building the software and not an external untrusted package.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install is for build dependencies from a requirements.txt file in the project's own source repository, which is a normal part of building the software and not an external untrusted package.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:80 pip install --upgrade pip --quiet
PKGBUILD:81 pip install -r "$srcdir/lostorm/requirements.txt" --quiet

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: jesus <jesusaiyan@gmail.com>
    
      2pkgname=lostorm-git
    
      3pkgver=7.2.3
    
      4pkgrel=1
    
      5pkgdesc="Privacy-enhanced Firestorm Second Life viewer (hardware ID spoofing per account)"
    
      6arch=('x86_64')
    
      7url="https://git.allthefallen.moe/lostorm/lostorm"
    
      8license=('LGPL2.1')
    
      9provides=('lostorm')
    
      10conflicts=('lostorm')
    
      11depends=(
    
      12  'libpulse'
    
      13  'mesa'
    
      14  'libxinerama'
    
      15  'libxrandr'
    
      16  'fontconfig'
    
      17  'freetype2'
    
      18  'openssl'
    
      19  'dbus'
    
      20  'gtk3'
    
      21  'nss'
    
      22  'at-spi2-atk'
    
      23  'libxss'
    
      24  'libxtst'
    
      25  'libxkbcommon'
    
      26  'alsa-lib'
    
      27)
    
      28makedepends=(
    
      29  'git'
    
      30  'cmake'
    
      31  'gcc11'
    
      32  'python-pip'
    
      33  'python-virtualenv'
    
      34  'base-devel'
    
      35  'glu'
    
      36)
    
      37options=('!strip' '!buildflags')
    
      38
    
      39# Primary source + mirrors (tried in order if primary fails)
    
      40_sources=(
    
      41  "https://git.allthefallen.moe/lostorm/lostorm.git"
    
      42  "https://codeberg.org/lostorm/lostorm.git"
    
      43  "https://gitlab.com/lostorm/lostorm.git"
    
      44)
    
      45
    
      46source=("fs-build-variables::git+https://github.com/FirestormViewer/fs-build-variables.git")
    
      47sha256sums=('SKIP')
    
      48
    
      49_clone_lostorm() {
    
      50  if [ -d "$srcdir/lostorm/.git" ]; then
    
      51    echo "==> Updating existing lostorm clone..."
    
      52    git -C "$srcdir/lostorm" pull --depth=1
    
      53    return
    
      54  fi
    
      55  for _url in "${_sources[@]}"; do
    
      56    echo "==> Cloning lostorm from $_url ..."
    
      57    git clone --depth=1 "$_url" "$srcdir/lostorm" && return
    
      58    rm -rf "$srcdir/lostorm"
    
      59  done
    
      60  echo "ERROR: All lostorm mirrors failed"
    
      61  return 1
    
      62}
    
      63
    
      64pkgver() {
    
      65  _clone_lostorm >/dev/null 2>&1
    
      66  local _ver
    
      67  _ver=$(cat "$srcdir/lostorm/indra/newview/VIEWER_VERSION.txt" | tr -d '[:space:]')
    
      68  local _rev
    
      69  _rev=$(git -C "$srcdir/lostorm" rev-list --count HEAD)
    
      70  local _hash
    
      71  _hash=$(git -C "$srcdir/lostorm" rev-parse --short HEAD)
    
      72  echo "${_ver}.r${_rev}.${_hash}"
    
      73}
    
      74
    
      75prepare() {
    
      76  _clone_lostorm
    
      77  python -m venv "$srcdir/.venv"
    
      78  # shellcheck disable=SC1091
    
      79  source "$srcdir/.venv/bin/activate"
    
      80  pip install --upgrade pip --quiet
    
      81  pip install -r "$srcdir/lostorm/requirements.txt" --quiet
    
      82}
    
      83
    
      84build() {
    
      85  # shellcheck disable=SC1091
    
      86  source "$srcdir/.venv/bin/activate"
    
      87  export AUTOBUILD_VARIABLES_FILE="$srcdir/fs-build-variables/variables"
    
      88  export CC=gcc-11
    
      89  export CXX=g++-11
    
      90
    
      91  cd "$srcdir/lostorm"
    
      92  autobuild configure -A 64 -c ReleaseFS_open -- -DLL_TESTS:BOOL=FALSE
    
      93  autobuild build -A 64 -c ReleaseFS_open -- -DLL_TESTS:BOOL=FALSE --package
    
      94}
    
      95
    
      96package() {
    
      97  local _built="$srcdir/lostorm/build-linux-x86_64/newview/packaged"
    
      98
    
      99  install -d "$pkgdir/opt/lostorm"
    
      100  cp -r "$_built"/. "$pkgdir/opt/lostorm/"
    
      101
    
      102  install -d "$pkgdir/usr/bin"
    
      103  ln -s /opt/lostorm/firestorm "$pkgdir/usr/bin/lostorm"
    
      104
    
      105  install -d "$pkgdir/usr/share/applications"
    
      106  cat > "$pkgdir/usr/share/applications/lostorm.desktop" << 'EOF'
    
      107[Desktop Entry]
    
      108Type=Application
    
      109Name=LOstorm
    
      110Exec=/opt/lostorm/firestorm
    
      111Comment=Privacy-enhanced Second Life viewer
    
      112Icon=/opt/lostorm/firestorm_icon.png
    
      113Categories=Network;
    
      114Terminal=false
    
      115EOF
    
      116
    
      117  chmod -R a-x,a+X "$pkgdir/opt/lostorm/"
    
      118  chmod +x "$pkgdir/opt/lostorm/firestorm"
    
      119  find "$pkgdir/opt/lostorm/" -name "*.so*" -exec chmod +x {} \;
    
      120  find "$pkgdir/opt/lostorm/bin" -type f -exec chmod +x {} \; 2>/dev/null || true
    
      121}
    
      122

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2