pacman-utils

maintainer kata198 · 8 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The pip install occurs only in a conditional code path for a standalone virtualenv, which is disabled by default; the default build uses standard AUR practices with declared dependencies and installs from the project's own source tarball.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install occurs only in a conditional code path for a standalone virtualenv, which is disabled by default; the default build uses standard AUR practices with declared dependencies and installs from the project's own source tarball.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:52 pip install -r requirements.txt

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Tim Savannah <kata198@gmail.com>
    
      2
    
      3# _STANDALONE_VIRTUALENV - Set to "true" to not require dependencies
    
      4#   and build in a standalone virtualenv
    
      5_STANDALONE_VIRTUALENV="false"
    
      6#_STANDALONE_VIRTUALENV="true"
    
      7
    
      8pkgname=pacman-utils
    
      9pkgver=1.1.0
    
      10pkgrel=1
    
      11pkgdesc="Some utils and helper scripts for archlinux packages "
    
      12# arch package url is https://github.com/kata198/pacman-utils-pkg
    
      13url="https://github.com/kata198/pacman-utils"
    
      14arch=(any)
    
      15license=(apache)
    
      16if [ "$_STANDALONE_VIRTUALENV" = "true" ];
    
      17then
    
      18    makedepends=(python python-virtualenv python-setuptools)
    
      19    depends=(wget curl python python-virtualenv python-setuptools)
    
      20    install=install.sh
    
      21else
    
      22    makedepends=(python python-setuptools 'python-cmp_version>=3.0.0' python-func_timeout)
    
      23    depends=(wget curl python python-setuptools 'python-cmp_version>=3.0.0' python-func_timeout)
    
      24fi
    
      25optdepends=('pacman-utils-data:  Data for whatprovides_upstream')
    
      26source=("https://github.com/kata198/pacman-utils/archive/${pkgver}.tar.gz")
    
      27sha512sums=("36c202bdfe7a86ce004ca9f731c8bb8458257ab6652b173b0324faf15e45877943b4617946ba4893af8f8bcf657d0e1cf29b5133ffdbd9b14af6df1ce7dc9c96")
    
      28
    
      29build() {
    
      30  cd "${pkgname}-${pkgver}"
    
      31
    
      32}
    
      33
    
      34_virtualenv_package() {
    
      35  # _virtualenv_package - Called when _STANDALONE_VIRTUALENV is "true", 
    
      36  #   and will create and install deps into a local virtualenv.
    
      37  #
    
      38  # Doing it this way ensures no additional AUR dependencies,
    
      39  #  but is sub-optimal. cmp_version and function_timeout are BOTH
    
      40  #   available in AUR.
    
      41  mkdir -p "${pkgdir}/var/lib/pacman-utils"
    
      42  pushd "${pkgdir}"
    
      43
    
      44  mkdir -p "${pkgdir}/var/lib/pacman-utils/env"
    
      45  virtualenv "var/lib/pacman-utils/env"
    
      46
    
      47  source var/lib/pacman-utils/env/bin/activate
    
      48
    
      49  pushd "${srcdir}/${pkgname}-${pkgver}"
    
      50
    
      51  # Install deps into this virtualenv
    
      52  pip install -r requirements.txt
    
      53
    
      54  ./install.sh DESTDIR="${pkgdir}"
    
      55
    
      56  popd # back to pkgdir
    
      57
    
      58  deactivate;
    
      59
    
      60  sed -e "s|${pkgdir}||g" -i var/lib/pacman-utils/env/bin/activate
    
      61
    
      62
    
      63  cd usr/bin
    
      64
    
      65  # Change all python code to use virtualenv root
    
      66  for fname in $(grep -l '^#!/usr/bin/env python' *);
    
      67  do
    
      68    sed -e 's|^#!/usr/bin/env python|#!/var/lib/pacman-utils/env/bin/python|g' -i "${fname}"
    
      69  done
    
      70  
    
      71  popd
    
      72}
    
      73
    
      74_standalone_package() {
    
      75  # _standalone_package - Build this package the standard way.
    
      76  #  Called with _STANDALONE_VIRTUALENV is "false" (default).
    
      77  #
    
      78  #   So this way, unless you just want to try it quick
    
      79  #    and not have to deal with multiple dep packages
    
      80
    
      81  cd ${pkgname}-$pkgver
    
      82  ./install.sh DESTDIR="${pkgdir}"
    
      83
    
      84}
    
      85
    
      86package() {
    
      87    if [ "$_STANDALONE_VIRTUALENV" = "false" ];
    
      88    then
    
      89        _standalone_package;
    
      90    else
    
      91        _virtualenv_package;
    
      92    fi
    
      93 }
    
      94

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2