odoo18-nightly

maintainer SamWhited · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged Two genuine supply-chain concerns exist here: (1) The source tarball is fetched from nightly.odoo.com with sha256sums=SKIP, meaning no integrity check is performed on the main executable artifact. While nightly.odoo.com is Odoo's official nightly build server (not a personal/unofficial host), the SKIP checksum means any MITM or server-side substitution would go undetected. (2) The build process runs 'pip install --upgrade pip build installer wheel setuptools' and 'pip install -r requirements.txt' from PyPI without any hash pinning or verification. The requirements.txt comes from inside the unverified tarball, so a compromised nightly tarball could specify malicious PyPI packages. The combination of SKIP checksum on the primary source plus unbounded pip installs from a requirements file inside that unverified source creates a real, if not obviously malicious, supply-chain risk. The host (nightly.odoo.com) is legitimate Odoo infrastructure, which reduces severity somewhat, but the lack of integrity verification keeps this at medium.

Triggered rules

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:47 venv/bin/pip install --upgrade pip build installer wheel setuptools
PKGBUILD:48 venv/bin/pip install -r requirements.txt

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:21 source=("https://nightly.odoo.com/$pkgver/nightly/src/odoo_$pkgver.latest.tar.gz"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): Two genuine supply-chain concerns exist here: (1) The source tarball is fetched from nightly.odoo.com with sha256sums=SKIP, meaning no integrity check is performed on the main executable artifact. While nightly.odoo.com is Odoo's official nightly build server (not a personal/unofficial host), the SKIP checksum means any MITM or server-side substitution would go undetected. (2) The build process runs 'pip install --upgrade pip build installer wheel setuptools' and 'pip install -r requirements.txt' from PyPI without any hash pinning or verification. The requirements.txt comes from inside the unverified tarball, so a compromised nightly tarball could specify malicious PyPI packages. The combination of SKIP checksum on the primary source plus unbounded pip installs from a requirements file inside that unverified source creates a real, if not obviously malicious, supply-chain risk. The host (nightly.odoo.com) is legitimate Odoo infrastructure, which reduces severity somewhat, but the lack of integrity verification keeps this at medium.

PKGBUILD

3 offending line(s) highlighted

      1# Maintainer: SamWhited <sam@samwhited.com>
    
      2
    
      3_name="odoo18"
    
      4pkgname="$_name-nightly"
    
      5pkgver=18.0
    
      6pkgrel=5
    
      7pkgdesc="Odoo. Open Source Apps To Grow Your Business."
    
      8url="https://odoo.com/"
    
      9arch=("any")
    
      10license=("LGPL-3.0-only")
    
      11depends=("postgresql>=12.0"
    
      12    # I'm unsure how best to handle this as the earlier versions of Python on
    
      13    # the AUR do not provide "python", so we'd have to pick one specifically.
    
      14    # This should work with >=3.10<=3.12, so 3.10 or 3.11 are fine too.
    
      15    "python312"
    
      16)
    
      17# Virtualenv-tools3 currently doesn't work with Python 3.12.
    
      18# See comments in the package() function.
    
      19#makedepends=("python-virtualenv-tools3")
    
      20
    
      21source=("https://nightly.odoo.com/$pkgver/nightly/src/odoo_$pkgver.latest.tar.gz"
    
      22		"odoo.conf"
    
      23		"odoo.service"
    
      24		"odoo.sysusers"
    
      25		"odoo.tmpfiles")
    
      26noextract=("odoo_$pkgver.latest.tar.gz")
    
      27sha256sums=(SKIP
    
      28            '7ac5830fec158e162c2efce1a5d3a44be6f6c6cde25ab710ad358826f1a41daa'
    
      29            '5474ae3277b32d54699d37d2832231c129c5c7d81f035583b938bcf45ad3fb08'
    
      30            'f0c775b551c096197c300df7cdc5a26d1eee4db79f7ddc53482d60de6dce3be5'
    
      31            'ac4082eb2a6daabfd28c1d86fb310285b51d5fa2a1be6b6ffacd2cdbd1bb0239')
    
      32backup=("etc/$_name/odoo.conf")
    
      33install="odoo.install"
    
      34options=("!strip")
    
      35provides=("openerp" "odoo" "odoo18")
    
      36
    
      37prepare() {
    
      38	# Extract manually to avoid a folder name that includes the download date.
    
      39	rm -rf "odoo-$pkgver"
    
      40	tar -xzf "odoo_$pkgver.latest.tar.gz" --one-top-level="odoo-$pkgver" \
    
      41		--strip-components 1
    
      42}
    
      43
    
      44build() {
    
      45	cd "odoo-$pkgver"
    
      46	python3.12 -m venv --clear venv
    
      47	venv/bin/pip install --upgrade pip build installer wheel setuptools
    
      48	venv/bin/pip install -r requirements.txt
    
      49
    
      50	venv/bin/python3.12 -m build --no-isolation --wheel
    
      51}
    
      52
    
      53package() {
    
      54	cd "odoo-$pkgver"
    
      55
    
      56  # Install package
    
      57	venv/bin/python3.12 -m installer dist/*.whl
    
      58
    
      59	# Relocate and copy the venv
    
      60	# Right now virtualenv-tools is not compatible with Python 3.12.
    
      61	# Temporarily just rename paths and assume that's good enough for our purposes
    
      62	# where we're not likely to have to deal with lots of different versions of
    
      63	# virtualenv. If you are using a version of Python other than the system
    
      64	# version, this may fail until we can get virtualenv-tools updated.
    
      65  rm -rf "venv/bin/__pycache__"
    
      66	find venv -type f -name '*.pyc' -delete
    
      67	rm -rf 'venv/local'
    
      68	find ./venv -type f -exec sed -i "s,$srcdir/odoo-$pkgver/venv,/var/lib/$_name/venv,g" {} \;
    
      69	# virtualenv-tools --update-path "/var/lib/$_name/venv/" venv
    
      70	install -d -m 750 "$pkgdir/var/lib/$_name/venv"
    
      71	cp -r ./venv/* "$pkgdir/var/lib/$_name/venv/"
    
      72
    
      73	# Configuration file
    
      74	install -d -m 750 "$pkgdir/etc/$_name"
    
      75	install -D -m 640 "$srcdir/odoo.conf" "$pkgdir/etc/$_name/odoo.conf"
    
      76
    
      77	# Systemd files
    
      78	install -D -m 644 "$srcdir/odoo.service" "$pkgdir/usr/lib/systemd/system/odoo18.service"
    
      79	install -D -m 644 "$srcdir/odoo.sysusers" "$pkgdir/usr/lib/sysusers.d/odoo18.conf"
    
      80	install -D -m 644 "$srcdir/odoo.tmpfiles" "$pkgdir/usr/lib/tmpfiles.d/odoo18.conf"
    
      81}
    
      82
    
      83# vim:set ts=2 sw=2 et:
    
      84

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 00:29:32	MEDIUM	3
2026-07-21 00:24:15	MEDIUM	3
2026-07-20 00:19:49	MEDIUM	3
2026-07-19 00:17:08	MEDIUM	3
2026-07-18 00:14:48	MEDIUM	3
2026-07-17 00:06:16	MEDIUM	3
2026-07-16 00:05:41	MEDIUM	3
2026-07-15 00:09:25	MEDIUM	3