multiworld-gg-git
LOW
maintainer FoxAmes
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The pip installations are part of building the project from its own source repository using standard development tools; all dependencies are pulled from official or project-associated Git repositories, and no untrusted remote code execution occurs.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip installations are part of building the project from its own source repository using standard development tools; all dependencies are pulled from official or project-associated Git repositories, and no untrusted remote code execution occurs.
2 higher static findings superseded - not the current verdict (shown for transparency)
Medium
pip install of an external package
pip_install_external
`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:30
uv pip install --quiet -r requirements.txt -
PKGBUILD:34
ls worlds/*/requirements.txt | xargs -l uv pip install --quiet --overrides=requirements-override.txt -r -
PKGBUILD:35
uv pip install --quiet pip cx-Freeze==8.4.0
Medium
External install via pipx/uv/poetry/cargo/go/gem
alt_pkg_manager_install
A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:30
uv pip install --quiet -r requirements.txt -
PKGBUILD:35
uv pip install --quiet pip cx-Freeze==8.4.0
PKGBUILD
3 offending line(s) highlighted
1
# Maintainer: Forest Ames <fox dot ames at smallfox dot io>
2
_pkgname="multiworld-gg"
3
pkgname="${_pkgname}-git"
4
pkgver=r9734
5
pkgrel=1
6
pkgdesc="MultiworldGG Multi-Game Randomizer and Server - Fork of Archipelago"
7
arch=('x86_64')
8
url="https://github.com/MultiworldGG/MultiworldGG"
9
license=('GPL-3.0')
10
provides=('multiworld-gg')
11
conflicts=('multiworld-gg')
12
depends=('python' 'glibc' 'libstdc++' 'libgcc' 'openssl' 'zlib' 'expat')
13
optdepends=('xdg-terminal-exec: Better terminal support')
14
makedepends=('uv' 'git')
15
checkdepends=('uv')
16
_author="MultiworldGG"
17
_branch="main"
18
source=("${_pkgname}::git+https://github.com/${_author}/MultiworldGG.git#branch=${_branch}")
19
sha256sums=('SKIP')
20
21
pkgver() {
22
cd "$srcdir/${_pkgname}"
23
git rev-list --count HEAD | sed 's/\([0-9][0-9]*\)/r\1/'
24
}
25
26
build() {
27
cd "$srcdir/${_pkgname}"
28
uv venv --allow-existing --python 3.13
29
. .venv/bin/activate
30
uv pip install --quiet -r requirements.txt
31
cat <<EOF >"requirements-override.txt" # Works around build errors related to dated gclib deps
32
pyfastyaz0yay0 @ git+https://github.com/LagoLunatic/PyFastYaz0Yay0.git@00e19626ab17621416d4b9055b17f0ea3fea66f3
33
EOF
34
ls worlds/*/requirements.txt | xargs -l uv pip install --quiet --overrides=requirements-override.txt -r
35
uv pip install --quiet pip cx-Freeze==8.4.0 # Used directly by the setup script
36
python setup.py build_exe -b build/MultiworldGG
37
}
38
39
# check() {
40
# Tests take >2 hours to run on my machine and there aren't any platform tests relevant to packaging that I can tell
41
# cd "$srcdir/${_pkgname}"
42
# uv venv --allow-existing --python 3.13
43
# . .venv/bin/activate
44
# uv pip install --quiet -r requirements.txt
45
# uv pip install --quiet pytest
46
# uv pip install --quiet flask flask_caching pony waitress Flask-Compress # Needed for several tests
47
48
# cat <<EOF >"conftest.py"
49
# import sys
50
51
# collect_ignore = [
52
# "worlds/dk64/randomizer/CollectibleLogicFiles/TestBananaTotals.py",
53
# "worlds/minecraft/test/TestAdvancements.py",
54
# "worlds/minecraft/test/TestDataLoad.py",
55
# "worlds/minecraft/test/TestEntrances.py",
56
# "worlds/minecraft/test/TestOptions.py",
57
# "worlds/poe/test/test_generation.py",
58
# "worlds/smo/TestClient.py",
59
# "worlds/toontown/test/TestFishing.py",
60
# "worlds/toontown/test/TestTreasures.py",
61
# "worlds/tp/tests/test_shuffle_options.py",
62
# "worlds/tp/tests/test_tests.py",
63
# "worlds/poe/test/test_boss_validation.py",
64
# "worlds/poe/test/test_client_commands.py",
65
# "worlds/poe/test/test_rarity_validation.py",
66
# "worlds/poe/test/test_text_updates.py",
67
# "worlds/poe/test/test_validation_logic.py"
68
# ]
69
# EOF
70
71
# pytest -s
72
# }
73
74
package() {
75
install -d "$pkgdir/opt"
76
cp -r "$srcdir/${_pkgname}/build/MultiworldGG" "$pkgdir/opt/"
77
chown -R :games "$pkgdir/opt/MultiworldGG"
78
chmod -R g+w "$pkgdir/opt/MultiworldGG"
79
mkdir -p "$pkgdir/usr/share/applications"
80
cat <<EOF >"$pkgdir/usr/share/applications/MultiworldGG.desktop"
81
[Desktop Entry]
82
Version=1.0
83
Exec=/opt/MultiworldGG/MultiworldGGLauncher
84
Path=/opt/MultiworldGG/
85
Name=MultiworldGG
86
Type=Application
87
Icon=/opt/MultiworldGG/icon.png
88
Categories=Game;
89
Keywords=multi-game;randomizer;
90
EOF
91
}
92
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 3 |
| 2026-09-16 00:03:17 | Low | 3 |
| 2026-09-15 00:25:31 | Low | 3 |
| 2026-09-14 00:27:57 | Low | 3 |
| 2026-09-13 00:19:54 | Low | 3 |
| 2026-09-12 00:25:17 | Low | 3 |
| 2026-09-11 00:19:22 | Low | 3 |
| 2026-09-10 00:22:44 | Low | 3 |
| 2026-09-09 00:04:09 | Low | 3 |
| 2026-09-08 00:18:08 | Low | 3 |
| 2026-09-07 00:30:15 | Low | 3 |
| 2026-09-06 00:17:06 | Low | 3 |
| 2026-09-05 00:16:27 | Low | 3 |
| 2026-09-04 00:03:13 | Low | 3 |
| 2026-09-03 00:15:47 | Low | 3 |
| 2026-09-02 00:02:31 | Low | 3 |
| 2026-09-01 00:11:19 | Low | 3 |
| 2026-08-31 00:19:57 | Low | 3 |
| 2026-08-30 00:04:14 | Low | 3 |
| 2026-08-29 00:29:17 | Low | 3 |