odoo19-nightly
LOW
maintainer SamWhited
0 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package builds from an official project source (nightly.odoo.com) and installs its own dependencies via pip, which is standard for Python applications; the host is not whitelisted but is plausibly official, and no untrusted remote code execution occurs.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from an official project source (nightly.odoo.com) and installs its own dependencies via pip, which is standard for Python applications; the host is not whitelisted but is plausibly official, and no untrusted remote code execution occurs.
2 higher static findings superseded - not the current verdict (shown for transparency)
Medium
pip install of an external package
pip_install_external
`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:51
venv/bin/pip install --upgrade pip build installer wheel setuptools -
PKGBUILD:52
venv/bin/pip install -r requirements.txt
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:25
source=("https://nightly.odoo.com/$pkgver/nightly/src/odoo_$pkgver.latest.tar.gz"
PKGBUILD
3 offending line(s) highlighted
1
# Maintainer: SamWhited <sam@samwhited.com>
2
3
_name="odoo19"
4
pkgname="$_name-nightly"
5
pkgver=19.0
6
pkgrel=1
7
pkgdesc="Odoo. Open Source Apps To Grow Your Business."
8
url="https://odoo.com/"
9
arch=("any")
10
license=("LGPL-3.0-only")
11
depends=(
12
"libldap"
13
"libsasl"
14
"postgresql>=13.0"
15
"postgresql-libs"
16
"python312"
17
)
18
optdepends=(
19
"wkhtmltopdf: generate PDF invoices and receipts"
20
)
21
# Virtualenv-tools3 currently doesn't work with Python >3.12.
22
# See comments in the package() function.
23
#makedepends=("python-virtualenv-tools3")
24
25
source=("https://nightly.odoo.com/$pkgver/nightly/src/odoo_$pkgver.latest.tar.gz"
26
"odoo.conf"
27
"odoo.service"
28
"odoo.sysusers"
29
"odoo.tmpfiles")
30
noextract=("odoo_$pkgver.latest.tar.gz")
31
sha256sums=('SKIP'
32
'3629d309c87dd914d5d27cfcf4f350dfd726ddb65c71e50d7111db6ac2b5638d'
33
'93232237a2f69b45e1434908679f59d37d830db10736dfed24158f7ffb859962'
34
'1725f4f4a47f80dd65dfd2fe59295d424eb9b927d7d88e41df0be6052b89720e'
35
'6d152800ff5416d535d6b1cda438315cc434d8d178a28aae82c0bb2a1e8bc55c')
36
backup=("etc/$_name/odoo.conf")
37
install="odoo.install"
38
options=("!strip")
39
provides=("openerp" "odoo" "odoo19")
40
41
prepare() {
42
# Extract manually to avoid a folder name that includes the download date.
43
rm -rf "odoo-$pkgver"
44
tar -xzf "odoo_$pkgver.latest.tar.gz" --one-top-level="odoo-$pkgver" \
45
--strip-components 1
46
}
47
48
build() {
49
cd "odoo-$pkgver"
50
python3.12 -m venv --clear --upgrade-deps venv
51
venv/bin/pip install --upgrade pip build installer wheel setuptools
52
venv/bin/pip install -r requirements.txt
53
54
venv/bin/python3.12 -m build --no-isolation --wheel
55
}
56
57
package() {
58
cd "odoo-$pkgver"
59
60
# Install package
61
venv/bin/python3.12 -m installer dist/*.whl
62
63
# Relocate and copy the venv
64
# Right now virtualenv-tools is not compatible with Python 3.12.
65
# Temporarily just rename paths and assume that's good enough for our purposes
66
# where we're not likely to have to deal with lots of different versions of
67
# virtualenv. If you are using a version of Python other than the system
68
# version, this may fail until we can get virtualenv-tools updated.
69
rm -rf "venv/bin/__pycache__"
70
find venv -type f -name '*.pyc' -delete
71
rm -rf 'venv/local'
72
find ./venv -type f -exec sed -i "s,$srcdir/odoo-$pkgver/venv,/var/lib/$_name/venv,g" {} \;
73
# virtualenv-tools --update-path "/var/lib/$_name/venv/" venv
74
install -d -m 750 "$pkgdir/var/lib/$_name/venv"
75
cp -r ./venv/* "$pkgdir/var/lib/$_name/venv/"
76
77
# Configuration file
78
install -d -m 750 "$pkgdir/etc/$_name"
79
install -D -m 640 "$srcdir/odoo.conf" "$pkgdir/etc/$_name/odoo.conf"
80
81
# Systemd files
82
install -D -m 644 "$srcdir/odoo.service" "$pkgdir/usr/lib/systemd/system/odoo19.service"
83
install -D -m 644 "$srcdir/odoo.sysusers" "$pkgdir/usr/lib/sysusers.d/odoo19.conf"
84
install -D -m 644 "$srcdir/odoo.tmpfiles" "$pkgdir/usr/lib/tmpfiles.d/odoo19.conf"
85
}
86
87
# vim:set ts=2 sw=2 et:
88
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 3 |
| 2026-10-31 00:07:41 | Low | 3 |
| 2026-10-30 00:29:30 | Low | 3 |
| 2026-10-29 00:13:55 | Low | 3 |
| 2026-10-28 00:06:54 | Low | 3 |
| 2026-10-27 00:23:28 | Low | 3 |
| 2026-10-26 00:12:40 | Low | 3 |
| 2026-10-25 00:20:48 | Low | 3 |
| 2026-10-24 00:14:55 | Low | 3 |
| 2026-10-23 00:02:19 | Low | 3 |
| 2026-10-22 00:13:10 | Low | 3 |
| 2026-10-21 00:12:50 | Low | 3 |
| 2026-10-20 00:10:31 | Low | 3 |
| 2026-10-19 00:03:55 | Low | 3 |
| 2026-10-18 00:06:55 | Low | 3 |
| 2026-10-17 00:21:55 | Low | 3 |
| 2026-10-16 00:12:47 | Low | 3 |
| 2026-10-15 00:28:05 | Low | 3 |
| 2026-10-14 00:06:47 | Low | 3 |
| 2026-10-13 00:23:45 | Low | 3 |