opensnitch-git

maintainer lsf · 46 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The flagged 'external install via pipx/uv/poetry/cargo/go/gem' refers to using 'python -m installer' to install a wheel built from the project's own source, which is a standard and safe AUR practice.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged 'external install via pipx/uv/poetry/cargo/go/gem' refers to using 'python -m installer' to install a wheel built from the project's own source, which is a standard and safe AUR practice.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:108 go install github.com/golang/protobuf/protoc-gen-go
PKGBUILD:109 go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.3.0

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer:
    
      2# Contributor: Mark Wagie <mark dot wagie at tutanota dot com>
    
      3# Contributor: lsf
    
      4# Contributor: Adam Hose <adis@blad.is>
    
      5# Contributor: Ryan Steed <ryan.steed.usa@pm.me>
    
      6pkgname=opensnitch-git
    
      7pkgver=1.8.0.r18.65480fa5
    
      8pkgrel=1
    
      9pkgdesc="A GNU/Linux port of the Little Snitch application firewall"
    
      10arch=('i686' 'x86_64' 'armv6h' 'armv7h' 'aarch64')
    
      11url="https://github.com/evilsocket/opensnitch"
    
      12license=('GPL3')
    
      13makedepends=(
    
      14  'git'
    
      15  'go'
    
      16  'python-grpcio-tools'
    
      17  'python-build'
    
      18  'python-installer'
    
      19  'python-wheel'
    
      20  'python-setuptools'
    
      21  'python-jaraco.text'
    
      22  'qt6-tools'
    
      23)
    
      24depends=(
    
      25  'hicolor-icon-theme'
    
      26  'libnetfilter_queue'
    
      27  'libpcap' # check: do we still need this? Arch upstream says no?
    
      28  'python-grpcio'
    
      29  'python-protobuf'
    
      30  'python-slugify'
    
      31  'python-pyqt6'
    
      32  'python-pyinotify'
    
      33  'python-notify2'
    
      34)
    
      35optdepends=(
    
      36 'logrotate: logfile rotation'
    
      37 'opensnitch-ebpf-module-git: eBPF process monitor method (non-hardened kernel only)'
    
      38 'python-pyasn: display network names of IP'
    
      39 'python-qt-material-git: extra ui themes'
    
      40 'qt6-svg')
    
      41provides=("${pkgname%-git}")
    
      42conflicts=("${pkgname%-git}")
    
      43backup=(
    
      44  "etc/${pkgname%-git}d/default-config.json"
    
      45  "etc/${pkgname%-git}d/system-fw.json"
    
      46)
    
      47install="${pkgname%-git}.install"
    
      48_arch_svntogit=https://raw.githubusercontent.com/archlinux/svntogit-community
    
      49_arch_commit=eebb5fb16ed15251d3ead163e8e4b4229c21a999
    
      50_arch_git_url=${_arch_svntogit}/${_arch_commit}/trunk/
    
      51source=(
    
      52  'git+https://github.com/evilsocket/opensnitch.git'
    
      53  "remove-debian-path.patch"
    
      54  "use-system-python-packages.patch"
    
      55  "${_arch_git_url}fix-setup.py.patch"
    
      56  "${_arch_git_url}tmpfiles.conf"
    
      57)
    
      58sha256sums=('SKIP'
    
      59            'd88cfe1acce3389ab577958048e5b642fc3b34d12f2f2f69123113bfe49d0099'
    
      60            '812824386d1ef72effd10c193d4fcbe371bf987a072cea77f9bc45bd526dc36e'
    
      61            'e77d2f6a6ada2761a987828e00c7725dee0c06bdb8793ae414d0df7fb1eb44a7'
    
      62            '09bd2cda97f74033617fd31efce8eba68eac03b29ea6d0f55aba2cef18824a72')
    
      63
    
      64pkgver() {
    
      65  cd "$srcdir/${pkgname%-git}"
    
      66  git describe --long | sed 's/^v//;s/-rc./rc/;s/\([^-]*-\)g/r\1/;s/-/./g'
    
      67}
    
      68
    
      69prepare() {
    
      70  export GOPATH="$srcdir/gopath"
    
      71  go clean -modcache
    
      72
    
      73  cd "$srcdir/${pkgname%-git}"
    
      74
    
      75  # Arch upstream patches
    
      76
    
      77  # TODO file an upstream bug
    
      78  # * fix an issue with setup.py installing to python's site-packages instead
    
      79  # of /usr
    
      80  # * prefer scaled SVG instead of pixellated 48x48 PNG
    
      81  patch -p1 -i "$srcdir/fix-setup.py.patch"
    
      82
    
      83  # TODO file an upstream bug
    
      84  # remove Debian-specific path from sys.path
    
      85  patch -p1 -i "$srcdir/remove-debian-path.patch"
    
      86
    
      87  # use system python packages
    
      88  patch -p1 -i "$srcdir/use-system-python-packages.patch"
    
      89
    
      90  # other fixes
    
      91  local site_packages=$(python -c "import site; print(site.getsitepackages()[0])")
    
      92  sed -i "s|/usr/lib/python3/dist-packages/data/|${site_packages}/pyasn/data/|g" ui/opensnitch/utils/__init__.py
    
      93  sed -i "s|/usr/lib/python3/dist-packages/|${site_packages}/|g" ui/bin/opensnitch-ui
    
      94
    
      95  sed -i.orig 's/grpc_tools.protoc/grpc_tools.protoc --experimental_editions/' "${srcdir}/opensnitch/proto/Makefile";
    
      96}
    
      97
    
      98build() {
    
      99  cd "$srcdir/${pkgname%-git}"
    
      100
    
      101  export GOPATH="$srcdir/gopath"
    
      102  export CGO_CPPFLAGS="${CPPFLAGS}"
    
      103  export CGO_CFLAGS="${CFLAGS}"
    
      104  export CGO_CXXFLAGS="${CXXFLAGS}"
    
      105  export CGO_LDFLAGS="${LDFLAGS}"
    
      106  export GOFLAGS="-buildmode=pie -trimpath -ldflags=-linkmode=external -mod=mod"
    
      107  export PATH=${PATH}:${GOPATH}/bin
    
      108  go install github.com/golang/protobuf/protoc-gen-go
    
      109  go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.3.0
    
      110  pushd proto
    
      111  make
    
      112  popd
    
      113
    
      114  pushd daemon
    
      115  make
    
      116  popd
    
      117
    
      118  pushd ui
    
      119  # https://stackoverflow.com/questions/66099225/how-can-resources-be-provided-in-pyqt6-which-has-no-pyrcc
    
      120  /usr/lib/qt6/rcc -g python opensnitch/res/resources.qrc | \
    
      121    sed '0,/PySide6/s//PyQt6/' > opensnitch/resources_rc.py
    
      122
    
      123  # NOTE: yes, we do need this.
    
      124  # Arch upstream uses a patch, but _also_ includes pb files pre-generated
    
      125  # so it fails for this PKGBUILD.
    
      126  # not seeing the files to be fixed with this in the tree _before_ building
    
      127  # made me assume they were just not there anymore (and thus no need for the fix).
    
      128  # I was wrong.
    
      129  find opensnitch/proto/ -name 'ui_pb2_grpc.py' -exec sed -i 's/^import ui_pb2/from . import ui_pb2/' {} \;
    
      130  python -m build --wheel --no-isolation
    
      131  # python setup.py build
    
      132  popd
    
      133  go clean -modcache
    
      134
    
      135  # do not use ebpf proc method by default as the module is provided as an optdepend
    
      136  # NOTE: does not seem to be required, the default-config.json should use proc unless
    
      137  # changed in the settings / in the file
    
      138  # cp "daemon/${pkgname%-git}d.service" "daemon/${pkgname%-git}d-ebpf.service"
    
      139  # sed  -i 's/\(ExecStart=.*\)/\1 -process-monitor-method ebpf/' "daemon/${pkgname%-git}d-ebpf.service"
    
      140  # sed  -i 's/\(ExecStart=.*\)/\1 -process-monitor-method proc/' "daemon/${pkgname%-git}d.service"
    
      141}
    
      142
    
      143package() {
    
      144  cd "$srcdir/${pkgname%-git}"
    
      145  # pushd ui
    
      146  # export PYTHONHASHSEED=0 # to hopefully avoid annoying keychain popups
    
      147  # python setup.py install --root="$pkgdir/" --optimize=1 --skip-build
    
      148  # popd
    
      149
    
      150  install -d "$pkgdir/etc/${pkgname%-git}d/rules"
    
      151  install -Dm755 "daemon/${pkgname%-git}d" -t "$pkgdir/usr/bin"
    
      152  install -Dm644 "utils/packaging/daemon/deb/debian/${pkgname%-git}.service" \
    
      153    "$pkgdir/usr/lib/systemd/system/${pkgname%-git}d.service"
    
      154  install -vDm644 "$srcdir/tmpfiles.conf" \
    
      155    "$pkgdir/usr/lib/tmpfiles.d/${pkgname%-git}.conf"
    
      156  # install -Dm644 "daemon/${pkgname%-git}d-ebpf.service" -t \
    
      157    # "$pkgdir/usr/lib/systemd/system"
    
      158  install -Dm644 daemon/data/default-config.json -t "$pkgdir/etc/${pkgname%-git}d"
    
      159  install -Dm644 daemon/data/system-fw.json -t "$pkgdir/etc/${pkgname%-git}d"
    
      160  install -Dm644 "utils/packaging/daemon/deb/debian/${pkgname%-git}.logrotate" \
    
      161    "$pkgdir/etc/logrotate.d/${pkgname%-git}"
    
      162
    
      163  # python ui
    
      164  python -m installer --destdir="$pkgdir" ui/dist/*.whl
    
      165
    
      166  # tests are in site-packages, big no-no
    
      167  local site_packages=$(python -c "import site; print(site.getsitepackages()[0])")
    
      168  rm -rf "$pkgdir/$site_packages/tests"
    
      169}
    
      170

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 09:48:24	MEDIUM	1