opensnitch-git
LOW
maintainer lsf
46 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The flagged pattern involves using 'python -m installer' to install a wheel built from the project's own source, which is a standard and safe practice in AUR packages, not an external untrusted install.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged pattern involves using 'python -m installer' to install a wheel built from the project's own source, which is a standard and safe practice in AUR packages, not an external untrusted install.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
External install via pipx/uv/poetry/cargo/go/gem
alt_pkg_manager_install
A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:108
go install github.com/golang/protobuf/protoc-gen-go -
PKGBUILD:109
go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.3.0
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer:
2
# Contributor: Mark Wagie <mark dot wagie at tutanota dot com>
3
# Contributor: lsf
4
# Contributor: Adam Hose <adis@blad.is>
5
# Contributor: Ryan Steed <ryan.steed.usa@pm.me>
6
pkgname=opensnitch-git
7
pkgver=1.8.0.r215.5c79d419
8
pkgrel=1
9
pkgdesc="A GNU/Linux port of the Little Snitch application firewall"
10
arch=('i686' 'x86_64' 'armv6h' 'armv7h' 'aarch64')
11
url="https://github.com/evilsocket/opensnitch"
12
license=('GPL3')
13
makedepends=(
14
'git'
15
'go'
16
'python-grpcio-tools'
17
'python-build'
18
'python-installer'
19
'python-wheel'
20
'python-setuptools'
21
'python-jaraco.text'
22
'qt6-tools'
23
)
24
depends=(
25
'hicolor-icon-theme'
26
'libnetfilter_queue'
27
'libpcap' # check: do we still need this? Arch upstream says no?
28
'python-grpcio'
29
'python-protobuf'
30
'python-slugify'
31
'python-pyqt6'
32
'python-pyinotify'
33
'python-notify2'
34
)
35
optdepends=(
36
'logrotate: logfile rotation'
37
'opensnitch-ebpf-module-git: eBPF process monitor method (non-hardened kernel only)'
38
'python-pyasn: display network names of IP'
39
'python-qt-material-git: extra ui themes'
40
'qt6-svg')
41
provides=("${pkgname%-git}")
42
conflicts=("${pkgname%-git}")
43
backup=(
44
"etc/${pkgname%-git}d/default-config.json"
45
"etc/${pkgname%-git}d/system-fw.json"
46
)
47
install="${pkgname%-git}.install"
48
_arch_svntogit=https://raw.githubusercontent.com/archlinux/svntogit-community
49
_arch_commit=eebb5fb16ed15251d3ead163e8e4b4229c21a999
50
_arch_git_url=${_arch_svntogit}/${_arch_commit}/trunk/
51
source=(
52
'git+https://github.com/evilsocket/opensnitch.git'
53
"remove-debian-path.patch"
54
"use-system-python-packages.patch"
55
"${_arch_git_url}fix-setup.py.patch"
56
"${_arch_git_url}tmpfiles.conf"
57
)
58
sha256sums=('SKIP'
59
'd88cfe1acce3389ab577958048e5b642fc3b34d12f2f2f69123113bfe49d0099'
60
'34890f234ef868919d29ba19ab2a9179d626dcc457465d3dffc8aa1af0019c28'
61
'e77d2f6a6ada2761a987828e00c7725dee0c06bdb8793ae414d0df7fb1eb44a7'
62
'09bd2cda97f74033617fd31efce8eba68eac03b29ea6d0f55aba2cef18824a72')
63
64
pkgver() {
65
cd "$srcdir/${pkgname%-git}"
66
git describe --long | sed 's/^v//;s/-rc./rc/;s/\([^-]*-\)g/r\1/;s/-/./g'
67
}
68
69
prepare() {
70
export GOPATH="$srcdir/gopath"
71
go clean -modcache
72
73
cd "$srcdir/${pkgname%-git}"
74
75
# Arch upstream patches
76
77
# TODO file an upstream bug
78
# * fix an issue with setup.py installing to python's site-packages instead
79
# of /usr
80
# * prefer scaled SVG instead of pixellated 48x48 PNG
81
patch -p1 -i "$srcdir/fix-setup.py.patch"
82
83
# TODO file an upstream bug
84
# remove Debian-specific path from sys.path
85
patch -p1 -i "$srcdir/remove-debian-path.patch"
86
87
# use system python packages
88
patch -p1 -i "$srcdir/use-system-python-packages.patch"
89
90
# other fixes
91
local site_packages=$(python -c "import site; print(site.getsitepackages()[0])")
92
sed -i "s|/usr/lib/python3/dist-packages/data/|${site_packages}/pyasn/data/|g" ui/opensnitch/utils/__init__.py
93
sed -i "s|/usr/lib/python3/dist-packages/|${site_packages}/|g" ui/bin/opensnitch-ui
94
95
sed -i.orig 's/grpc_tools.protoc/grpc_tools.protoc --experimental_editions/' "${srcdir}/opensnitch/proto/Makefile";
96
}
97
98
build() {
99
cd "$srcdir/${pkgname%-git}"
100
101
export GOPATH="$srcdir/gopath"
102
export CGO_CPPFLAGS="${CPPFLAGS}"
103
export CGO_CFLAGS="${CFLAGS}"
104
export CGO_CXXFLAGS="${CXXFLAGS}"
105
export CGO_LDFLAGS="${LDFLAGS}"
106
export GOFLAGS="-buildmode=pie -trimpath -ldflags=-linkmode=external -mod=mod"
107
export PATH=${PATH}:${GOPATH}/bin
108
go install github.com/golang/protobuf/protoc-gen-go
109
go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.3.0
110
pushd proto
111
make
112
popd
113
114
pushd daemon
115
make
116
popd
117
118
pushd ui
119
# https://stackoverflow.com/questions/66099225/how-can-resources-be-provided-in-pyqt6-which-has-no-pyrcc
120
/usr/lib/qt6/rcc -g python opensnitch/res/resources.qrc | \
121
sed '0,/PySide6/s//PyQt6/' > opensnitch/resources_rc.py
122
123
# NOTE: yes, we do need this.
124
# Arch upstream uses a patch, but _also_ includes pb files pre-generated
125
# so it fails for this PKGBUILD.
126
# not seeing the files to be fixed with this in the tree _before_ building
127
# made me assume they were just not there anymore (and thus no need for the fix).
128
# I was wrong.
129
find opensnitch/proto/ -name 'ui_pb2_grpc.py' -exec sed -i 's/^import ui_pb2/from . import ui_pb2/' {} \;
130
python -m build --wheel --no-isolation
131
# python setup.py build
132
popd
133
go clean -modcache
134
135
# do not use ebpf proc method by default as the module is provided as an optdepend
136
# NOTE: does not seem to be required, the default-config.json should use proc unless
137
# changed in the settings / in the file
138
# cp "daemon/${pkgname%-git}d.service" "daemon/${pkgname%-git}d-ebpf.service"
139
# sed -i 's/\(ExecStart=.*\)/\1 -process-monitor-method ebpf/' "daemon/${pkgname%-git}d-ebpf.service"
140
# sed -i 's/\(ExecStart=.*\)/\1 -process-monitor-method proc/' "daemon/${pkgname%-git}d.service"
141
}
142
143
package() {
144
cd "$srcdir/${pkgname%-git}"
145
# pushd ui
146
# export PYTHONHASHSEED=0 # to hopefully avoid annoying keychain popups
147
# python setup.py install --root="$pkgdir/" --optimize=1 --skip-build
148
# popd
149
150
install -d "$pkgdir/etc/${pkgname%-git}d/rules"
151
install -Dm755 "daemon/${pkgname%-git}d" -t "$pkgdir/usr/bin"
152
install -Dm644 "utils/packaging/daemon/deb/debian/${pkgname%-git}.service" \
153
"$pkgdir/usr/lib/systemd/system/${pkgname%-git}d.service"
154
install -vDm644 "$srcdir/tmpfiles.conf" \
155
"$pkgdir/usr/lib/tmpfiles.d/${pkgname%-git}.conf"
156
# install -Dm644 "daemon/${pkgname%-git}d-ebpf.service" -t \
157
# "$pkgdir/usr/lib/systemd/system"
158
install -Dm644 daemon/data/default-config.json -t "$pkgdir/etc/${pkgname%-git}d"
159
install -Dm644 daemon/data/system-fw.json -t "$pkgdir/etc/${pkgname%-git}d"
160
install -Dm644 "utils/packaging/daemon/deb/debian/${pkgname%-git}.logrotate" \
161
"$pkgdir/etc/logrotate.d/${pkgname%-git}"
162
163
# python ui
164
python -m installer --destdir="$pkgdir" ui/dist/*.whl
165
166
# tests are in site-packages, big no-no
167
local site_packages=$(python -c "import site; print(site.getsitepackages()[0])")
168
rm -rf "$pkgdir/$site_packages/tests"
169
}
170
Changes since previous scan
--- PKGBUILD @ 2026-09-11 00:19+++ PKGBUILD @ 2026-09-17 00:27@@ -4,7 +4,7 @@ # Contributor: Adam Hose <adis@blad.is> # Contributor: Ryan Steed <ryan.steed.usa@pm.me> pkgname=opensnitch-git-pkgver=1.8.0.r18.65480fa5+pkgver=1.8.0.r215.5c79d419 pkgrel=1 pkgdesc="A GNU/Linux port of the Little Snitch application firewall" arch=('i686' 'x86_64' 'armv6h' 'armv7h' 'aarch64')@@ -57,7 +57,7 @@ ) sha256sums=('SKIP' 'd88cfe1acce3389ab577958048e5b642fc3b34d12f2f2f69123113bfe49d0099'- '812824386d1ef72effd10c193d4fcbe371bf987a072cea77f9bc45bd526dc36e'+ '34890f234ef868919d29ba19ab2a9179d626dcc457465d3dffc8aa1af0019c28' 'e77d2f6a6ada2761a987828e00c7725dee0c06bdb8793ae414d0df7fb1eb44a7' '09bd2cda97f74033617fd31efce8eba68eac03b29ea6d0f55aba2cef18824a72') Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 09:22:22 | Medium | 1 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |