odoo19-nightly

maintainer SamWhited · 0 votes · scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged The package builds from an official project source (nightly.odoo.com) and installs its own dependencies via pip, which is standard for Python applications; the host is not whitelisted but is plausibly official, and no untrusted remote code execution occurs.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from an official project source (nightly.odoo.com) and installs its own dependencies via pip, which is standard for Python applications; the host is not whitelisted but is plausibly official, and no untrusted remote code execution occurs.

2 higher static findings superseded - not the current verdict (shown for transparency)
MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

  • PKGBUILD:51 venv/bin/pip install --upgrade pip build installer wheel setuptools
  • PKGBUILD:52 venv/bin/pip install -r requirements.txt
MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:25 source=("https://nightly.odoo.com/$pkgver/nightly/src/odoo_$pkgver.latest.tar.gz"

PKGBUILD

3 offending line(s) highlighted
1# Maintainer: SamWhited <sam@samwhited.com>
2
3_name="odoo19"
4pkgname="$_name-nightly"
5pkgver=19.0
6pkgrel=1
7pkgdesc="Odoo. Open Source Apps To Grow Your Business."
8url="https://odoo.com/"
9arch=("any")
10license=("LGPL-3.0-only")
11depends=(
12 "libldap"
13 "libsasl"
14 "postgresql>=13.0"
15 "postgresql-libs"
16 "python312"
17)
18optdepends=(
19 "wkhtmltopdf: generate PDF invoices and receipts"
20)
21# Virtualenv-tools3 currently doesn't work with Python >3.12.
22# See comments in the package() function.
23#makedepends=("python-virtualenv-tools3")
24
25source=("https://nightly.odoo.com/$pkgver/nightly/src/odoo_$pkgver.latest.tar.gz"
26 "odoo.conf"
27 "odoo.service"
28 "odoo.sysusers"
29 "odoo.tmpfiles")
30noextract=("odoo_$pkgver.latest.tar.gz")
31sha256sums=('SKIP'
32 '3629d309c87dd914d5d27cfcf4f350dfd726ddb65c71e50d7111db6ac2b5638d'
33 '93232237a2f69b45e1434908679f59d37d830db10736dfed24158f7ffb859962'
34 '1725f4f4a47f80dd65dfd2fe59295d424eb9b927d7d88e41df0be6052b89720e'
35 '6d152800ff5416d535d6b1cda438315cc434d8d178a28aae82c0bb2a1e8bc55c')
36backup=("etc/$_name/odoo.conf")
37install="odoo.install"
38options=("!strip")
39provides=("openerp" "odoo" "odoo19")
40
41prepare() {
42 # Extract manually to avoid a folder name that includes the download date.
43 rm -rf "odoo-$pkgver"
44 tar -xzf "odoo_$pkgver.latest.tar.gz" --one-top-level="odoo-$pkgver" \
45 --strip-components 1
46}
47
48build() {
49 cd "odoo-$pkgver"
50 python3.12 -m venv --clear --upgrade-deps venv
51 venv/bin/pip install --upgrade pip build installer wheel setuptools
52 venv/bin/pip install -r requirements.txt
53
54 venv/bin/python3.12 -m build --no-isolation --wheel
55}
56
57package() {
58 cd "odoo-$pkgver"
59
60 # Install package
61 venv/bin/python3.12 -m installer dist/*.whl
62
63 # Relocate and copy the venv
64 # Right now virtualenv-tools is not compatible with Python 3.12.
65 # Temporarily just rename paths and assume that's good enough for our purposes
66 # where we're not likely to have to deal with lots of different versions of
67 # virtualenv. If you are using a version of Python other than the system
68 # version, this may fail until we can get virtualenv-tools updated.
69 rm -rf "venv/bin/__pycache__"
70 find venv -type f -name '*.pyc' -delete
71 rm -rf 'venv/local'
72 find ./venv -type f -exec sed -i "s,$srcdir/odoo-$pkgver/venv,/var/lib/$_name/venv,g" {} \;
73 # virtualenv-tools --update-path "/var/lib/$_name/venv/" venv
74 install -d -m 750 "$pkgdir/var/lib/$_name/venv"
75 cp -r ./venv/* "$pkgdir/var/lib/$_name/venv/"
76
77 # Configuration file
78 install -d -m 750 "$pkgdir/etc/$_name"
79 install -D -m 640 "$srcdir/odoo.conf" "$pkgdir/etc/$_name/odoo.conf"
80
81 # Systemd files
82 install -D -m 644 "$srcdir/odoo.service" "$pkgdir/usr/lib/systemd/system/odoo19.service"
83 install -D -m 644 "$srcdir/odoo.sysusers" "$pkgdir/usr/lib/sysusers.d/odoo19.conf"
84 install -D -m 644 "$srcdir/odoo.tmpfiles" "$pkgdir/usr/lib/tmpfiles.d/odoo19.conf"
85}
86
87# vim:set ts=2 sw=2 et:
88

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 LOW 3
2026-08-02 00:16:08 LOW 3
2026-08-01 00:11:18 LOW 3
2026-07-31 00:14:10 LOW 3
2026-07-30 00:17:23 LOW 3
2026-07-29 00:25:53 LOW 3
2026-07-28 00:07:28 LOW 3
2026-07-27 00:24:32 LOW 3
2026-07-26 00:07:32 LOW 3
2026-07-25 00:13:44 LOW 3
2026-07-24 00:02:28 LOW 3
2026-07-23 00:14:47 LOW 3
2026-07-22 00:29:32 LOW 3
2026-07-21 00:24:15 LOW 3
2026-07-20 00:19:49 LOW 3
2026-07-19 00:17:08 LOW 3
2026-07-18 00:14:48 LOW 3
2026-07-17 00:06:16 LOW 3
2026-07-16 00:05:41 LOW 3
2026-07-15 00:09:25 LOW 3

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion