openjiuwen-server

maintainer enihcam · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged Builds from a tagged git source on gitcode.com (plausibly the project's own forge), with all local bundled support files; the non-whitelisted host and SKIP'd checksums are mildly concerning but this is a normal own-source build pattern, not a prebuilt binary from an unrelated swappable host.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 60%): Builds from a tagged git source on gitcode.com (plausibly the project's own forge), with all local bundled support files; the non-whitelisted host and SKIP'd checksums are mildly concerning but this is a normal own-source build pattern, not a prebuilt binary from an unrelated swappable host.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:56 source=("git+https://gitcode.com/openJiuwen/agent-studio.git#tag=v${pkgver}")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: enihcam <enihcam@noreply.gitcode.com>
    
      2pkgname=openjiuwen-server
    
      3pkgver=0.1.8
    
      4pkgrel=1
    
      5pkgdesc="OpenJiuwen Studio backend: FastAPI server, SQLAlchemy ORM, plugin manager, evaluation CLI (agenteval)"
    
      6arch=('x86_64')
    
      7url="https://gitcode.com/openJiuwen/agent-studio"
    
      8license=('Apache-2.0')
    
      9depends=(
    
      10    'python>=3.11.4'
    
      11    'python-fastapi'
    
      12    'uvicorn'
    
      13    'python-pydantic'
    
      14    'python-sqlalchemy'
    
      15    'python-alembic'
    
      16    'python-redis'
    
      17    'python-pymilvus<2.6.10'
    
      18    'python-jinja'
    
      19    'python-requests'
    
      20    'python-aiosqlite'
    
      21    'python-pymysql'
    
      22    'python-aiomysql'
    
      23    'python-pyjwt'
    
      24    'python-jose'
    
      25    'python-pycryptodome'
    
      26    'python-minio'
    
      27    'python-psutil'
    
      28    'python-yaml'
    
      29    'python-networkx'
    
      30    'python-numpy'
    
      31    'python-scipy'
    
      32    'python-greenlet'
    
      33    'protobuf'
    
      34    'python-apscheduler'
    
      35    'python-croniter'
    
      36    'python-click'
    
      37    'python-dotenv'
    
      38    'python-pydantic-settings'
    
      39    'python-telegram-bot'
    
      40    'python-slack-bolt'
    
      41    'python-mcp'
    
      42)
    
      43makedepends=(
    
      44    'python-build'
    
      45    'python-installer'
    
      46    'python-wheel'
    
      47    'python-setuptools'
    
      48)
    
      49optdepends=(
    
      50    'valkey: production session checkpointer (drop-in Redis replacement; default uses in-memory)'
    
      51    'python-chromadb: in-process vector index (default; alternative to milvus)'
    
      52    'python-milvus-lite-bin: embedded Milvus vector index (alternative to chroma; no separate server)'
    
      53    'mariadb: production SQL backend (default uses sqlite)'
    
      54)
    
      55_srcdir_repo=agent-studio
    
      56source=("git+https://gitcode.com/openJiuwen/agent-studio.git#tag=v${pkgver}")
    
      57source+=("openjiuwen-server.service")
    
      58source+=("openjiuwen-server.sysusers")
    
      59source+=("openjiuwen-server.tmpfiles")
    
      60source+=("openjiuwen-server.install")
    
      61sha256sums=('SKIP')
    
      62sha256sums+=('SKIP')
    
      63sha256sums+=('SKIP')
    
      64sha256sums+=('SKIP')
    
      65sha256sums+=('SKIP')
    
      66
    
      67build() {
    
      68    cd "${srcdir}/${_srcdir_repo:-agent-studio}/backend"
    
      69    python -m build --wheel --no-isolation
    
      70}
    
      71
    
      72package() {
    
      73    cd "${srcdir}/${_srcdir_repo:-agent-studio}/backend"
    
      74
    
      75    # Python package install
    
      76    python -m installer --destdir="${pkgdir}" --compile-bytecode=1 dist/*.whl
    
      77
    
      78    # Move conflicting /opt entry to /opt/openjiuwen-studio for systemd
    
      79    install -dm755 "${pkgdir}/opt/openjiuwen-studio"
    
      80    cp -a "${pkgdir}/usr/lib/python3"*/site-packages/openjiuwen_studio \
    
      81          "${pkgdir}/opt/openjiuwen-studio/lib"
    
      82    rm -rf "${pkgdir}/usr/lib/python3"*/site-packages/openjiuwen_studio
    
      83
    
      84    # Backend resources (alembic trees, configs)
    
      85    install -dm755 "${pkgdir}/opt/openjiuwen-studio/upgrade"
    
      86    cp -a upgrade "${pkgdir}/opt/openjiuwen-studio/"
    
      87    install -Dm644 alembic.ini "${pkgdir}/opt/openjiuwen-studio/alembic.ini"
    
      88    install -Dm644 main.py "${pkgdir}/opt/openjiuwen-studio/main.py"
    
      89
    
      90    # Runtime directories
    
      91    install -dm750 "${pkgdir}/var/lib/openjiuwen-studio"
    
      92    install -dm755 "${pkgdir}/var/log/openjiuwen-studio"
    
      93
    
      94    # Configuration template (installed but NOT activated — user copies & edits)
    
      95    install -Dm644 /dev/null "${pkgdir}/etc/openjiuwen-studio.env.example"
    
      96    cat > "${pkgdir}/etc/openjiuwen-studio.env.example" <<'EOF'
    
      97# OpenJiuwen Studio — copy to /etc/openjiuwen-studio.env and edit before first start.
    
      98# See README.md / docs/en/ for the full key list. The defaults below boot with sqlite + chroma.
    
      99
    
      100DB_TYPE=sqlite
    
      101OPS_DB_NAME=openjiuwen_ops
    
      102AGENT_DB_NAME=openjiuwen_agent
    
      103
    
      104INDEX_MANAGER_TYPE=chroma
    
      105
    
      106RUNTIME_HOST=127.0.0.1
    
      107RUNTIME_PORT=8186
    
      108WORKFLOW_EXECUTE_TIMEOUT=300
    
      109
    
      110# Required: generate with `python -c "import secrets; print(secrets.token_hex(32))"`
    
      111JWT_SECRET_KEY=change-me-before-production
    
      112
    
      113# Optional — leave commented if you don't need them
    
      114# REDIS_HOST=127.0.0.1
    
      115# REDIS_PORT=6379
    
      116# MILVUS_HOST=127.0.0.1
    
      117# MILVUS_PORT=19530
    
      118# CODE_SANDBOX_URL=http://127.0.0.1:8190
    
      119EOF
    
      120
    
      121    # License
    
      122    install -Dm644 "${srcdir}/agent-studio/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      123
    
      124    # Systemd unit + sysusers + tmpfiles + install hook
    
      125    install -Dm644 "${srcdir}/openjiuwen-server.service" \
    
      126        "${pkgdir}/usr/lib/systemd/system/openjiuwen-server.service"
    
      127    install -Dm644 "${srcdir}/openjiuwen-server.sysusers" \
    
      128        "${pkgdir}/usr/lib/sysusers.d/openjiuwen-server.conf"
    
      129    install -Dm644 "${srcdir}/openjiuwen-server.tmpfiles" \
    
      130        "${pkgdir}/usr/lib/tmpfiles.d/openjiuwen-server.conf"
    
      131    install -Dm755 "${srcdir}/openjiuwen-server.install" \
    
      132        "${pkgdir}/usr/share/libalpm/scripts/openjiuwen-server.install"
    
      133}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 00:17:08	LOW	3
2026-07-18 00:14:48	LOW	3
2026-07-17 00:06:16	LOW	3
2026-07-16 00:05:41	LOW	3
2026-07-15 00:09:25	LOW	3