odoo-venv

MEDIUM

maintainer AlphaJack 57 votes scanned 2026-10-29 17:53:05.425985

View on AUR

Why flagged

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

Triggered rules

Medium pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:78 uv pip install --python "$pkgdir/usr/share/odoo/venv/bin/python" -r "requirements.txt" dist/*.whl

Medium External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:78 uv pip install --python "$pkgdir/usr/share/odoo/venv/bin/python" -r "requirements.txt" dist/*.whl

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:26 source=("https://nightly.odoo.com/$_major/nightly/src/odoo_$_major.latest.tar.gz"

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: AlphaJack <alphajack at tuta dot io>
    
      2# Contributor: SamWhited <sam@samwhited.com>
    
      3# Contributor: HLFH <gaspard@dhautefeuille.eu>
    
      4
    
      5pkgname="odoo-venv"
    
      6_major=20.0
    
      7pkgrel=3
    
      8# set by aur-updater from the newest nightly of $_major
    
      9pkgver=20.0.20261029
    
      10pkgdesc="Open Source Apps To Grow Your Business"
    
      11url="https://odoo.com/"
    
      12arch=("x86_64" "aarch64")
    
      13license=("LGPL-3.0-only")
    
      14provides=("odoo" "odoo${_major/.*/}")
    
      15replaces=("odoo")
    
      16conflicts=("odoo" "odoo-nightly" "odoo18-nightly")
    
      17depends=("python")
    
      18optdepends=("postgresql: local database"
    
      19            "wkhtmltopdf: generate PDFs")
    
      20# pg_config is needed to build psycopg2 from source
    
      21makedepends=("uv"
    
      22             "python-build"
    
      23             "python-wheel"
    
      24             "python-setuptools"
    
      25             "postgresql-libs")
    
      26source=("https://nightly.odoo.com/$_major/nightly/src/odoo_$_major.latest.tar.gz"
    
      27        "odoo.conf"
    
      28        "odoo.logrotate"
    
      29        "odoo.service"
    
      30        "odoo.sysusers"
    
      31        "odoo.tmpfiles")
    
      32noextract=("odoo_$_major.latest.tar.gz")
    
      33b2sums=('SKIP'
    
      34        '72c131dc68f82047c52347b909a82073356a95c6f8817dc4f2faab93b4c17e978414897b7b831b25ed6a2e2fe3cb16892f5176ae8ad5880255d7bb7fdaacd5d6'
    
      35        '1ef682d87ba12dd8a185ba36701b737f8feb0c1e6eb4b23302a0dc5930ef63c990af65bc45a36313f879a29a23cbdb602e7fc34ba9cee2e46d9a3d8407d5751a'
    
      36        '93d51bda841f970694afa21c5246fe81ae558bde5ae4b29e8343b641f6295d9433fa64da8c990f72f83d7aceb48c3d7a50fd46900d2cc916deebc1821796b45b'
    
      37        '311757f40c9de2845482ebf22e36469cc1058396bba9edaa2265a2bd085e2bcdd22115b098af3aaa037f7dac3a81212ae8b249df0b268f6bf2d798ee01698aae'
    
      38        'f899025f7637aaed2d231de33e5c2d2a831f21f038cb86b9794f9f75224f6eb14b6c9baf95663278ae15568a80ac49354446202232f38577991a24d332373b53')
    
      39backup=("etc/odoo/odoo.conf")
    
      40install="odoo.install"
    
      41# a venv has no use for a -debug package, and collecting its sources takes minutes
    
      42options=("!strip" "!debug")
    
      43
    
      44prepare(){
    
      45 # extract manually to avoid a folder name that includes the download date
    
      46 rm -rf "odoo-$_major"
    
      47 tar -xzf "odoo_$_major.latest.tar.gz" --one-top-level="odoo-$_major" --strip-components 1
    
      48}
    
      49
    
      50build(){
    
      51 # generate the wheel using the system python-build
    
      52 cd "odoo-$_major"
    
      53 python -m build --no-isolation --wheel
    
      54}
    
      55
    
      56_strip_pkgdir() {
    
      57 # remove mentions of $pkgdir in files and symlinks
    
      58 grep -RIlZ "$pkgdir" "$pkgdir" | xargs -0 -r sed -i "s|$pkgdir||g"
    
      59 find "$pkgdir" -type l -print0 |
    
      60  while IFS= read -r -d '' _link; do
    
      61   _target=$(readlink -- "$_link")
    
      62   if [[ $_target == "$pkgdir"/* ]]; then
    
      63    ln -sfn "${_target#"$pkgdir"}" "$_link"
    
      64   fi
    
      65  done
    
      66}
    
      67
    
      68package(){
    
      69 cd "odoo-$_major"
    
      70
    
      71 # virtual environment with the system Python, odoo and its requirements
    
      72 export UV_CACHE_DIR="$srcdir/uv-cache"
    
      73 export UV_LINK_MODE=copy
    
      74 export UV_NO_INSTALLER_METADATA=1
    
      75 export UV_PYTHON_DOWNLOADS=never
    
      76 export PYTHONDONTWRITEBYTECODE=1
    
      77 uv venv --python /usr/bin/python "$pkgdir/usr/share/odoo/venv"
    
      78 uv pip install --python "$pkgdir/usr/share/odoo/venv/bin/python" -r "requirements.txt" dist/*.whl
    
      79 _strip_pkgdir
    
      80 find "$pkgdir/usr/share/odoo/venv" -type d -name "__pycache__" -prune -exec rm -r {} +
    
      81
    
      82 # executable
    
      83 install -d "$pkgdir/usr/bin"
    
      84 ln -s "/usr/share/odoo/venv/bin/odoo" "$pkgdir/usr/bin/odoo"
    
      85
    
      86 # configuration file
    
      87 install -d -m 750 "$pkgdir/etc/odoo"
    
      88 install -D -m 640 "$srcdir/odoo.conf" "$pkgdir/etc/odoo/odoo.conf"
    
      89
    
      90 # log file
    
      91 install -D -m 644 "$srcdir/odoo.logrotate" "$pkgdir/etc/logrotate.d/odoo"
    
      92
    
      93 # systemd files
    
      94 install -D -m 644 "$srcdir/odoo.service" "$pkgdir/usr/lib/systemd/system/odoo.service"
    
      95 install -D -m 644 "$srcdir/odoo.sysusers" "$pkgdir/usr/lib/sysusers.d/odoo.conf"
    
      96 install -D -m 644 "$srcdir/odoo.tmpfiles" "$pkgdir/usr/lib/tmpfiles.d/odoo.conf"
    
      97}
    
      98

Changes since previous scan

--- PKGBUILD @ 2026-10-29 15:52
+++ PKGBUILD @ 2026-10-29 17:53
@@ -3,13 +3,13 @@
 # Contributor: HLFH <gaspard@dhautefeuille.eu>
 
 pkgname="odoo-venv"
-_major=18.0
-pkgrel=1
-# updated automatically via pkgver()
-pkgver=18.0.20241229
+_major=20.0
+pkgrel=3
+# set by aur-updater from the newest nightly of $_major
+pkgver=20.0.20261029
 pkgdesc="Open Source Apps To Grow Your Business"
 url="https://odoo.com/"
-arch=("any")
+arch=("x86_64" "aarch64")
 license=("LGPL-3.0-only")
 provides=("odoo" "odoo${_major/.*/}")
 replaces=("odoo")
@@ -17,9 +17,12 @@
 depends=("python")
 optdepends=("postgresql: local database"
             "wkhtmltopdf: generate PDFs")
-makedepends=("python-build"
+# pg_config is needed to build psycopg2 from source
+makedepends=("uv"
+             "python-build"
              "python-wheel"
-             "python-setuptools")
+             "python-setuptools"
+             "postgresql-libs")
 source=("https://nightly.odoo.com/$_major/nightly/src/odoo_$_major.latest.tar.gz"
         "odoo.conf"
         "odoo.logrotate"
@@ -35,12 +38,8 @@
         'f899025f7637aaed2d231de33e5c2d2a831f21f038cb86b9794f9f75224f6eb14b6c9baf95663278ae15568a80ac49354446202232f38577991a24d332373b53')
 backup=("etc/odoo/odoo.conf")
 install="odoo.install"
-options=("!strip")
-
-pkgver(){
- # retrieve date from the most recent archive
- curl "https://nightly.odoo.com/$_major/nightly/src/" | grep -oP 'odoo_\K(\d{2}\.\d{1}.\d{8})'| sort | tail -1
-}
+# a venv has no use for a -debug package, and collecting its sources takes minutes
+options=("!strip" "!debug")
 
 prepare(){
  # extract manually to avoid a folder name that includes the download date
@@ -54,28 +53,31 @@
  python -m build --no-isolation --wheel
 }
 
+_strip_pkgdir() {
+ # remove mentions of $pkgdir in files and symlinks
+ grep -RIlZ "$pkgdir" "$pkgdir" | xargs -0 -r sed -i "s|$pkgdir||g"
+ find "$pkgdir" -type l -print0 |
+  while IFS= read -r -d '' _link; do
+   _target=$(readlink -- "$_link")
+   if [[ $_target == "$pkgdir"/* ]]; then
+    ln -sfn "${_target#"$pkgdir"}" "$_link"
+   fi
+  done
+}
+
 package(){
  cd "odoo-$_major"
 
- # create virtual environment
- export PIP_DISABLE_PIP_VERSION_CHECK=1
+ # virtual environment with the system Python, odoo and its requirements
+ export UV_CACHE_DIR="$srcdir/uv-cache"
+ export UV_LINK_MODE=copy
+ export UV_NO_INSTALLER_METADATA=1
+ export UV_PYTHON_DOWNLOADS=never
  export PYTHONDONTWRITEBYTECODE=1
- python -m venv "$pkgdir/usr/share/odoo/venv"
- source "$pkgdir/usr/share/odoo/venv/bin/activate"
-
- # install odoo and dependencies using pip
- "$pkgdir/usr/share/odoo/venv/bin/"pip install --upgrade pip installer
- "$pkgdir/usr/share/odoo/venv/bin/"pip install -r "requirements.txt"
- "$pkgdir/usr/share/odoo/venv/bin/"python -m installer dist/*.whl
-
- # remove references to pkgdir
- find "$pkgdir/usr/share/odoo/venv/bin" -maxdepth 1 -type f -exec sed -i "s|${pkgdir}/|/|g" {} +
- find "$pkgdir/usr/share/odoo/venv/pyvenv.cfg" -maxdepth 1 -type f -exec sed -i "s|${pkgdir}/|/|g" {} +
- find "$pkgdir/usr/share/odoo/venv" -type f -name "*.py[co]" -delete
- find "$pkgdir/usr/share/odoo/venv" -type d -name "__pycache__" -delete
-
- # exit virtual environment
- deactivate
+ uv venv --python /usr/bin/python "$pkgdir/usr/share/odoo/venv"
+ uv pip install --python "$pkgdir/usr/share/odoo/venv/bin/python" -r "requirements.txt" dist/*.whl
+ _strip_pkgdir
+ find "$pkgdir/usr/share/odoo/venv" -type d -name "__pycache__" -prune -exec rm -r {} +
 
  # executable
  install -d "$pkgdir/usr/bin"

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-29 17:53:05	Medium	3
2026-10-29 15:52:51	Medium	2
2026-06-19 19:07:35	Clean	3
2026-06-18 16:11:54	Medium	2