multiworld-gg-git
LOW
maintainer FoxAmes
0 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The pip installs are part of building the project from its own source using development tools (uv) in a controlled environment; all dependencies are pulled from official or version-controlled sources, and no untrusted remote code execution occurs.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip installs are part of building the project from its own source using development tools (uv) in a controlled environment; all dependencies are pulled from official or version-controlled sources, and no untrusted remote code execution occurs.
2 higher static findings superseded - not the current verdict (shown for transparency)
Medium
pip install of an external package
pip_install_external
`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:31
uv pip install --quiet -r requirements.txt -
PKGBUILD:35
ls worlds/*/requirements.txt | xargs -l uv pip install --quiet --overrides=requirements-override.txt -r -
PKGBUILD:37
uv pip install --quiet pip $CX_FREEZE
Medium
External install via pipx/uv/poetry/cargo/go/gem
alt_pkg_manager_install
A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:31
uv pip install --quiet -r requirements.txt -
PKGBUILD:37
uv pip install --quiet pip $CX_FREEZE
PKGBUILD
3 offending line(s) highlighted
1
# Maintainer: Forest Ames <fox dot ames at smallfox dot io>
2
_pkgname="multiworld-gg"
3
pkgname="${_pkgname}-git"
4
pkgver=0.7.273.r0.gf2ee95d
5
pkgrel=1
6
epoch=1
7
pkgdesc="MultiworldGG Multi-Game Randomizer and Server - Fork of Archipelago"
8
arch=('x86_64')
9
url="https://github.com/MultiworldGG/MultiworldGG"
10
license=('GPL-3.0')
11
provides=('multiworld-gg')
12
conflicts=('multiworld-gg')
13
depends=('python' 'glibc' 'libstdc++' 'libgcc' 'openssl' 'zlib' 'expat')
14
optdepends=('xdg-terminal-exec: Better terminal support')
15
makedepends=('uv' 'git')
16
checkdepends=('uv')
17
_author="MultiworldGG"
18
_branch="main"
19
source=("${_pkgname}::git+https://github.com/${_author}/MultiworldGG.git#branch=${_branch}")
20
sha256sums=('SKIP')
21
22
pkgver() {
23
cd "$srcdir/${_pkgname}"
24
git describe --long --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g'
25
}
26
27
build() {
28
cd "$srcdir/${_pkgname}"
29
uv venv --allow-existing --python 3.13
30
. .venv/bin/activate
31
uv pip install --quiet -r requirements.txt
32
cat <<EOF >"requirements-override.txt" # Works around build errors related to dated gclib deps
33
pyfastyaz0yay0 @ git+https://github.com/LagoLunatic/PyFastYaz0Yay0.git@00e19626ab17621416d4b9055b17f0ea3fea66f3
34
EOF
35
ls worlds/*/requirements.txt | xargs -l uv pip install --quiet --overrides=requirements-override.txt -r
36
CX_FREEZE=(grep -o 'cx-Freeze==[0-9]\.[0-9]\.[0-9]' setup.py)
37
uv pip install --quiet pip $CX_FREEZE # Used directly by the setup script
38
python setup.py build_exe -b build/MultiworldGG
39
}
40
41
# check() {
42
# Tests take >2 hours to run on my machine and there aren't any platform tests relevant to packaging that I can tell
43
# cd "$srcdir/${_pkgname}"
44
# uv venv --allow-existing --python 3.13
45
# . .venv/bin/activate
46
# uv pip install --quiet -r requirements.txt
47
# uv pip install --quiet pytest
48
# uv pip install --quiet flask flask_caching pony waitress Flask-Compress # Needed for several tests
49
50
# cat <<EOF >"conftest.py"
51
# import sys
52
53
# collect_ignore = [
54
# "worlds/dk64/randomizer/CollectibleLogicFiles/TestBananaTotals.py",
55
# "worlds/minecraft/test/TestAdvancements.py",
56
# "worlds/minecraft/test/TestDataLoad.py",
57
# "worlds/minecraft/test/TestEntrances.py",
58
# "worlds/minecraft/test/TestOptions.py",
59
# "worlds/poe/test/test_generation.py",
60
# "worlds/smo/TestClient.py",
61
# "worlds/toontown/test/TestFishing.py",
62
# "worlds/toontown/test/TestTreasures.py",
63
# "worlds/tp/tests/test_shuffle_options.py",
64
# "worlds/tp/tests/test_tests.py",
65
# "worlds/poe/test/test_boss_validation.py",
66
# "worlds/poe/test/test_client_commands.py",
67
# "worlds/poe/test/test_rarity_validation.py",
68
# "worlds/poe/test/test_text_updates.py",
69
# "worlds/poe/test/test_validation_logic.py"
70
# ]
71
# EOF
72
73
# pytest -s
74
# }
75
76
package() {
77
install -d "$pkgdir/opt"
78
cp -r "$srcdir/${_pkgname}/build/MultiworldGG" "$pkgdir/opt/"
79
chown -R :games "$pkgdir/opt/MultiworldGG"
80
chmod -R g+w "$pkgdir/opt/MultiworldGG"
81
mkdir -p "$pkgdir/usr/share/applications"
82
cat <<EOF >"$pkgdir/usr/share/applications/MultiworldGG.desktop"
83
[Desktop Entry]
84
Version=1.0
85
Exec=/opt/MultiworldGG/MultiworldGGLauncher
86
Path=/opt/MultiworldGG/
87
Name=MultiworldGG
88
Type=Application
89
Icon=/opt/MultiworldGG/icon.png
90
Categories=Game;
91
Keywords=multi-game;randomizer;
92
EOF
93
}
94
Changes since previous scan
--- PKGBUILD @ 2026-10-16 00:12+++ PKGBUILD @ 2026-11-01 00:21@@ -1,8 +1,9 @@ # Maintainer: Forest Ames <fox dot ames at smallfox dot io> _pkgname="multiworld-gg" pkgname="${_pkgname}-git"-pkgver=r9734+pkgver=0.7.273.r0.gf2ee95d pkgrel=1+epoch=1 pkgdesc="MultiworldGG Multi-Game Randomizer and Server - Fork of Archipelago" arch=('x86_64') url="https://github.com/MultiworldGG/MultiworldGG"@@ -20,7 +21,7 @@ pkgver() { cd "$srcdir/${_pkgname}"- git rev-list --count HEAD | sed 's/\([0-9][0-9]*\)/r\1/'+ git describe --long --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g' } build() {@@ -32,7 +33,8 @@ pyfastyaz0yay0 @ git+https://github.com/LagoLunatic/PyFastYaz0Yay0.git@00e19626ab17621416d4b9055b17f0ea3fea66f3 EOF ls worlds/*/requirements.txt | xargs -l uv pip install --quiet --overrides=requirements-override.txt -r- uv pip install --quiet pip cx-Freeze==8.4.0 # Used directly by the setup script+ CX_FREEZE=(grep -o 'cx-Freeze==[0-9]\.[0-9]\.[0-9]' setup.py)+ uv pip install --quiet pip $CX_FREEZE # Used directly by the setup script python setup.py build_exe -b build/MultiworldGG } Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 3 |
| 2026-10-31 00:07:41 | Low | 3 |
| 2026-10-30 00:29:30 | Low | 3 |
| 2026-10-29 00:13:55 | Low | 3 |
| 2026-10-28 00:06:54 | Low | 3 |
| 2026-10-27 00:23:28 | Low | 3 |
| 2026-10-26 00:12:40 | Low | 3 |
| 2026-10-25 00:20:48 | Low | 3 |
| 2026-10-24 00:14:55 | Low | 3 |
| 2026-10-23 00:02:19 | Low | 3 |
| 2026-10-22 00:13:10 | Low | 3 |
| 2026-10-21 00:12:50 | Low | 3 |
| 2026-10-20 00:10:31 | Low | 3 |
| 2026-10-19 00:03:55 | Low | 3 |
| 2026-10-18 00:06:55 | Low | 3 |
| 2026-10-17 00:21:55 | Low | 3 |
| 2026-10-16 21:16:13 | Medium | 2 |
| 2026-10-16 00:12:47 | Low | 3 |
| 2026-10-15 00:28:05 | Low | 3 |
| 2026-10-14 00:06:47 | Low | 3 |