pacman-utils
LOW
maintainer kata198
8 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The pip install occurs only in a conditional code path for a standalone virtualenv, which is disabled by default; the default build uses standard AUR practices with declared dependencies and installs from the project's own source tarball.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install occurs only in a conditional code path for a standalone virtualenv, which is disabled by default; the default build uses standard AUR practices with declared dependencies and installs from the project's own source tarball.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
pip install of an external package
pip_install_external
`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:52
pip install -r requirements.txt
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Tim Savannah <kata198@gmail.com>
2
3
# _STANDALONE_VIRTUALENV - Set to "true" to not require dependencies
4
# and build in a standalone virtualenv
5
_STANDALONE_VIRTUALENV="false"
6
#_STANDALONE_VIRTUALENV="true"
7
8
pkgname=pacman-utils
9
pkgver=1.1.0
10
pkgrel=1
11
pkgdesc="Some utils and helper scripts for archlinux packages "
12
# arch package url is https://github.com/kata198/pacman-utils-pkg
13
url="https://github.com/kata198/pacman-utils"
14
arch=(any)
15
license=(apache)
16
if [ "$_STANDALONE_VIRTUALENV" = "true" ];
17
then
18
makedepends=(python python-virtualenv python-setuptools)
19
depends=(wget curl python python-virtualenv python-setuptools)
20
install=install.sh
21
else
22
makedepends=(python python-setuptools 'python-cmp_version>=3.0.0' python-func_timeout)
23
depends=(wget curl python python-setuptools 'python-cmp_version>=3.0.0' python-func_timeout)
24
fi
25
optdepends=('pacman-utils-data: Data for whatprovides_upstream')
26
source=("https://github.com/kata198/pacman-utils/archive/${pkgver}.tar.gz")
27
sha512sums=("36c202bdfe7a86ce004ca9f731c8bb8458257ab6652b173b0324faf15e45877943b4617946ba4893af8f8bcf657d0e1cf29b5133ffdbd9b14af6df1ce7dc9c96")
28
29
build() {
30
cd "${pkgname}-${pkgver}"
31
32
}
33
34
_virtualenv_package() {
35
# _virtualenv_package - Called when _STANDALONE_VIRTUALENV is "true",
36
# and will create and install deps into a local virtualenv.
37
#
38
# Doing it this way ensures no additional AUR dependencies,
39
# but is sub-optimal. cmp_version and function_timeout are BOTH
40
# available in AUR.
41
mkdir -p "${pkgdir}/var/lib/pacman-utils"
42
pushd "${pkgdir}"
43
44
mkdir -p "${pkgdir}/var/lib/pacman-utils/env"
45
virtualenv "var/lib/pacman-utils/env"
46
47
source var/lib/pacman-utils/env/bin/activate
48
49
pushd "${srcdir}/${pkgname}-${pkgver}"
50
51
# Install deps into this virtualenv
52
pip install -r requirements.txt
53
54
./install.sh DESTDIR="${pkgdir}"
55
56
popd # back to pkgdir
57
58
deactivate;
59
60
sed -e "s|${pkgdir}||g" -i var/lib/pacman-utils/env/bin/activate
61
62
63
cd usr/bin
64
65
# Change all python code to use virtualenv root
66
for fname in $(grep -l '^#!/usr/bin/env python' *);
67
do
68
sed -e 's|^#!/usr/bin/env python|#!/var/lib/pacman-utils/env/bin/python|g' -i "${fname}"
69
done
70
71
popd
72
}
73
74
_standalone_package() {
75
# _standalone_package - Build this package the standard way.
76
# Called with _STANDALONE_VIRTUALENV is "false" (default).
77
#
78
# So this way, unless you just want to try it quick
79
# and not have to deal with multiple dep packages
80
81
cd ${pkgname}-$pkgver
82
./install.sh DESTDIR="${pkgdir}"
83
84
}
85
86
package() {
87
if [ "$_STANDALONE_VIRTUALENV" = "false" ];
88
then
89
_standalone_package;
90
else
91
_virtualenv_package;
92
fi
93
}
94
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |