mycroft-core

LOW

maintainer robertfoster 30 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The pip install commands are part of building the project from its own source, installing declared dependencies from requirements files in the official source tarball; this is normal for Python packages and not a supply-chain risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install commands are part of building the project from its own source, installing declared dependencies from requirements files in the official source tarball; this is normal for Python packages and not a supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:64 pip install -r requirements/requirements.txt
PKGBUILD:65 pip install -r requirements/extra-audiobackend.txt
PKGBUILD:66 pip install -r requirements/extra-stt.txt

PKGBUILD

3 offending line(s) highlighted

      1# Maintainer: robertfoster
    
      2# Contributor: Thorben Guenther <echo YWRtaW5AeGVucm94Lm5ldAo= | base64 -d>
    
      3
    
      4pkgname=mycroft-core
    
      5pkgver=21.2.2
    
      6pkgrel=2
    
      7pkgdesc="The Mycroft Artificial Intelligence platform."
    
      8arch=('i686' 'x86_64' 'armv6h' 'armv7h' 'aarch64')
    
      9url='https://github.com/MycroftAI/mycroft-core'
    
      10license=('Apache')
    
      11depends=('python'
    
      12  'python-gobject'
    
      13  'libffi'
    
      14  'swig'
    
      15  'portaudio'
    
      16  'mimic1'
    
      17  'mpg123'
    
      18  'screen'
    
      19  'flac'
    
      20  'curl'
    
      21  'icu'
    
      22  'libjpeg-turbo'
    
      23  'jq'
    
      24  'pulseaudio'
    
      25  'pulseaudio-alsa'
    
      26  'fann')
    
      27makedepends=('git' 'sudo' 'python-pip' 'python-setuptools' 'python-virtualenv' 'sudo')
    
      28install=mycroft-core.install
    
      29source=("${url}/archive/release/v${pkgver}.tar.gz"
    
      30  "mycroft.tmpfiles"
    
      31  "mycroft.sysusers"
    
      32  "mycroft.service"
    
      33  "client.conf"
    
      34  "mycroft.sh"
    
      35  "mycroft.csh"
    
      36)
    
      37
    
      38prepare() {
    
      39  cd "$srcdir/$pkgname-release-v$pkgver"
    
      40  sed -i 's/^check-dependencies$/#check-dependencies/g' start-mycroft.sh
    
      41  sed -i 's/change_ownership$/:/g' scripts/prepare-msm.sh
    
      42}
    
      43
    
      44package() {
    
      45  mkdir -p "${pkgdir}/usr/share/"
    
      46  cp -R "mycroft-core-release-v${pkgver}" "${pkgdir}/usr/share/mycroft-core"
    
      47
    
      48  # Place a link to mimic where mycroft is expecting it
    
      49  mkdir -p "${pkgdir}/usr/share/mycroft-core/mimic/bin"
    
      50  ln -s /usr/bin/mimic "${pkgdir}/usr/share/mycroft-core/mimic/bin/mimic"
    
      51
    
      52  # Set permissions
    
      53  chmod -R 755 "${pkgdir}/usr/share/mycroft-core"
    
      54
    
      55  # systemd
    
      56  install -D -m644 "${srcdir}/mycroft.service" -t "${pkgdir}/usr/lib/systemd/system"
    
      57  install -D -m644 "${srcdir}/mycroft.sysusers" "${pkgdir}/usr/lib/sysusers.d/mycroft.conf"
    
      58  install -D -m644 "${srcdir}/mycroft.tmpfiles" "${pkgdir}/usr/lib/tmpfiles.d/mycroft.conf"
    
      59
    
      60  # Virtualenv
    
      61  cd "$pkgdir/usr/share/mycroft-core"
    
      62  virtualenv .venv
    
      63  source .venv/bin/activate
    
      64  pip install -r requirements/requirements.txt
    
      65  pip install -r requirements/extra-audiobackend.txt
    
      66  pip install -r requirements/extra-stt.txt
    
      67
    
      68  # Fix Virtualenv
    
      69  sed -i 's/^VIRTUAL_ENV=.*/VIRTUAL_ENV="\/usr\/share\/mycroft-core\/.venv"/g' .venv/bin/activate
    
      70  pathtoreplace=$(echo $pkgdir | sed 's:/:\\\/:g')
    
      71  rm .venv/bin/activate.{fish,csh}
    
      72
    
      73  # Cleanup
    
      74  find . -name "*.py[co]" -o -name __pycache__ -exec rm -rf {} +
    
      75  rm -rf "$pkgdir/usr/share/mycroft-core/test"
    
      76  sed -i "s/$pathtoreplace//g" "$pkgdir"/usr/share/mycroft-core/.venv/bin/*
    
      77
    
      78  # Use a sane default editor
    
      79  sed -i "s/sensible-editor/vi/g" "$pkgdir"/usr/share/mycroft-core/bin/mycroft-config
    
      80  # Pulseaudio Client configuration
    
      81  install -Dm644 "${srcdir}/client.conf" \
    
      82    "${pkgdir}/var/lib/mycroft/.config/pulse/client.conf"
    
      83
    
      84  # Set environmental variable for binary usage
    
      85  install -Dm644 "${srcdir}/mycroft.sh" \
    
      86    "${pkgdir}/etc/profile.d/mycroft.sh"
    
      87  install -Dm644 "${srcdir}/mycroft.csh" \
    
      88    "${pkgdir}/etc/profile.d/mycroft.csh"
    
      89}
    
      90
    
      91sha256sums=('3748b2422691bbfdf3e31e8a61ebf0eb3dfd5dd0f6103f0c501005437d83c728'
    
      92            'cbc90e2a3308619dbfe1ccf417b7a41d15fac13c7ae8124b90b82a4f09aa8485'
    
      93            '658ab08f0db3a2000d762c6a0a0bfd3a79d8375cf5a70f373ed097aa40f51278'
    
      94            '48f7bf2f24061bfbc58318f03098059bc8f292b5ae0f4a2cf5f90915587f74ad'
    
      95            '87fb0adc4f3ab15e9d71c4d4bfb799d50f5d14b3962e8eb4fd1de1e7d86486cf'
    
      96            'ec42c92425e016e747da0e61406754db0cabdccd5c6325ab9e8f6374a128263a'
    
      97            'c2199a1f1fe50c0178fa722f0bf6f674d29e86f0edef90895e28aa9b329a8e34')
    
      98

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2