openjiuwen-connect
LOW
maintainer orphaned
1 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
Builds from the project's own git repository on gitcode.com with SKIP checksums; the bundled local files (wrapper scripts, install hook) are not downloaded from a remote host but are local sources, and pip installs only requirements from the checked-out source tree — no unverifiable prebuilt binaries or obfuscated payloads, just sloppy checksum hygiene and a non-whitelisted but plausibly project-owned forge host.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 60%): Builds from the project's own git repository on gitcode.com with SKIP checksums; the bundled local files (wrapper scripts, install hook) are not downloaded from a remote host but are local sources, and pip installs only requirements from the checked-out source tree — no unverifiable prebuilt binaries or obfuscated payloads, just sloppy checksum hygiene and a non-whitelisted but plausibly project-owned forge host.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:32
source=("git+https://gitcode.com/openJiuwen/agent-studio.git#tag=v${pkgver}")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: enihcam <enihcam@noreply.gitcode.com>
2
pkgname=openjiuwen-connect
3
pkgver=0.1.8
4
pkgrel=1
5
pkgdesc="OpenJiuwen Connect: channel adapters (Telegram, Slack, etc.) + MCP server. Ships as a venv at /opt/openjiuwen-connect."
6
arch=('x86_64')
7
url="https://gitcode.com/openJiuwen/agent-studio"
8
license=('Apache-2.0')
9
depends=(
10
'python>=3.11.4'
11
'python-virtualenv'
12
'python-pip'
13
'python-click' # transitive of the channel adapters
14
# Channel adapters / MCP server runtime deps (namcap requires these to be
15
# declared even though the bundled venv ships the pip-installed copies):
16
'python-certifi'
17
'python-charset-normalizer'
18
'python-cryptography'
19
'python-dotenv'
20
'python-idna'
21
'python-legacy-cgi' # transitive: stdlib `cgi` was removed in Python 3.13
22
'python-numpy'
23
'python-requests'
24
'python-urllib3'
25
'python-yaml'
26
)
27
makedepends=('python-pip')
28
optdepends=(
29
'openjiuwen-server: backend that the channel adapters and MCP server proxy to'
30
)
31
_srcdir_repo=agent-studio
32
source=("git+https://gitcode.com/openJiuwen/agent-studio.git#tag=v${pkgver}")
33
source+=("openjiuwen-channel-runner")
34
source+=("openjiuwen-mcp-server")
35
source+=("openjiuwen-connect.install")
36
sha256sums=('SKIP')
37
sha256sums+=('SKIP')
38
sha256sums+=('SKIP')
39
sha256sums+=('SKIP')
40
41
# Notes:
42
# - The upstream connect/ tree has no pyproject.toml, so we cannot build a wheel.
43
# We install it into a venv at /opt/openjiuwen-connect/venv/ alongside the
44
# adapter deps listed in connect/adapters/*/requirements.txt.
45
# - This is intentionally not split into per-channel subpackages because the
46
# upstream tree couples them under one umbrella and most users want both.
47
48
build() {
49
local srcdir_top="${srcdir}/${_srcdir_repo:-agent-studio}"
50
local venv="${srcdir}/venv"
51
52
python -m venv --system-site-packages "${venv}"
53
"${venv}/bin/pip" install --no-cache-dir --upgrade pip wheel
54
55
# Merge requirements from each adapter subpackage, then install once.
56
local merged="${srcdir}/requirements-merged.txt"
57
: > "${merged}"
58
for req in "${srcdir_top}"/connect/adapters/*/requirements.txt; do
59
[ -f "${req}" ] || continue
60
echo "# --- ${req##*/connect/} ---" >> "${merged}"
61
grep -vE '^\s*(#|$)' "${req}" >> "${merged}" || true
62
done
63
"${venv}/bin/pip" install --no-cache-dir -r "${merged}"
64
}
65
66
package() {
67
local srcdir_top="${srcdir}/${_srcdir_repo:-agent-studio}"
68
69
# Install the venv (built in build()) under /usr/lib/ — namcap forbids ELF
70
# files under /opt/, and the venv bundles .so extensions (pydantic_core,
71
# aiohttp, frozenlist, yarl, rpds, propcache, multidict, audioop, etc.).
72
install -dm755 "${pkgdir}/usr/lib/openjiuwen-connect"
73
cp -a "${srcdir}/venv" "${pkgdir}/usr/lib/openjiuwen-connect/venv"
74
75
# Lay out the connect/ source tree under /usr/share/ (FHS read-only data).
76
install -dm755 "${pkgdir}/usr/share/openjiuwen-connect"
77
cp -a "${srcdir_top}/connect/." "${pkgdir}/usr/share/openjiuwen-connect/src/"
78
79
# Wrapper scripts in /usr/bin/
80
install -Dm755 "${srcdir}/openjiuwen-channel-runner" \
81
"${pkgdir}/usr/bin/openjiuwen-channel-runner"
82
install -Dm755 "${srcdir}/openjiuwen-mcp-server" \
83
"${pkgdir}/usr/bin/openjiuwen-mcp-server"
84
85
# Sample configuration directory (user copies/adapts)
86
install -dm755 "${pkgdir}/etc/openjiuwen-connect"
87
install -Dm644 /dev/null "${pkgdir}/etc/openjiuwen-connect/.keepdir"
88
89
# License
90
install -Dm644 "${srcdir_top}/LICENSE" \
91
"${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
92
93
# Install hook (notes how to activate)
94
install -Dm755 "${srcdir}/openjiuwen-connect.install" \
95
"${pkgdir}/usr/share/libalpm/scripts/openjiuwen-connect.install"
96
}
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |