paperless-ngx-venv
LOW
maintainer AlphaJack
29 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The pip install is part of building a Python virtual environment from the project's own requirements.txt sourced from its official GitHub release, which is a standard and safe practice for AUR packages.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install is part of building a Python virtual environment from the project's own requirements.txt sourced from its official GitHub release, which is a standard and safe practice for AUR packages.
2 higher static findings superseded - not the current verdict (shown for transparency)
Medium
pip install of an external package
pip_install_external
`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:73
uv pip install --index-strategy unsafe-best-match -r "$srcdir/$_pkgname/requirements.txt"
Medium
External install via pipx/uv/poetry/cargo/go/gem
alt_pkg_manager_install
A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:73
uv pip install --index-strategy unsafe-best-match -r "$srcdir/$_pkgname/requirements.txt"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: AlphaJack <alphajack at tuta dot io>
2
# Maintainer: atomicfs <https://aur.archlinux.org/account/atomicfs>
3
# Maintainer: shtrophic <aur at shtrophic dot net>
4
5
pkgname="paperless-ngx-venv"
6
_pkgname="paperless-ngx"
7
pkgver=3.1.3
8
pkgrel=1
9
pkgdesc="paperless-ngx: scan, index and archive all your physical documents"
10
url="https://docs.paperless-ngx.com/"
11
license=("GPL-3.0-or-later")
12
arch=("x86_64" "aarch64")
13
provides=("paperless" "$pkgname")
14
conflicts=("paperless" "paperless-ng" "paperless-ngx")
15
replaces=("paperless-ngx")
16
makedepends=(
17
"uv"
18
"findutils"
19
"mariadb"
20
"postgresql"
21
"postgresql-libs"
22
"python-virtualenv-tools3"
23
)
24
depends=(
25
"file"
26
"ghostscript"
27
"gnupg"
28
"imagemagick"
29
"nltk-data"
30
"optipng"
31
"python"
32
"poppler"
33
"redis"
34
"sqlite"
35
"tesseract-data-eng"
36
"ttf-liberation"
37
"unpaper"
38
)
39
optdepends=(
40
"gotenberg: convert files to pdf"
41
"jbig2enc: smaller PDF size"
42
"mariadb: mariadb database"
43
"postgresql: postgres database"
44
"tika-server: extract metadata from files"
45
)
46
source=("https://github.com/$_pkgname/$_pkgname/releases/download/v$pkgver/$_pkgname-v$pkgver.tar.xz"
47
"paperless.conf"
48
"paperless.hook"
49
"paperless.sysusers"
50
"paperless.tmpfiles"
51
"paperless.target"
52
"paperless-consumer.service"
53
"paperless-scheduler.service"
54
"paperless-task-queue.service"
55
"paperless-webserver.service")
56
b2sums=('bf84679cece1639c702cf5f24b9cf13bdd3d2879d8570b26bb09a86ec0074878c9dbe7ac61bd7a5dc9ed80294ac059746486522b837bd6afbe491f667509eede'
57
'a182b37e6d885094e41ff90b82f4685c1a1ae20f0b03cf1478b072e3161875df7a1ea3d2410a0a5791df5fd911430d216bf1be67a996a943e74f7d65df98f76d'
58
'747a8b8774fa48073e58b9b3ba55b28ca505b193cf180467b1bcbbe3a2c44931a198f355163b377219299c8b43f0a74550e241f835d9941c594fe318ae5235cd'
59
'586ad775e26aef216716c33d8951e00044a7f6866167d27dceab39d51b4fd46527693dfe4e085dc20d2e9193679122ad2b9ac8a1c03a98df747af15ecca24ca2'
60
'4a59f0a0c6a4abad23cba01e216909f45a7064e93911b8ba3e3b394f52379e41898b8c9e1246ba034bc8d2fe6dc83f5cad926e265a17da7c7093d997cfe8b4f3'
61
'd4eff17cf6b4642211d61545d3722cb626e35b591fc1f11dfc0d4bd3b303ac145777953d405b1bbdf6473512590d50169cf58db8251de2701cee4d7b151ef6be'
62
'3a294006b2c7cd856a5034c22634e1c4b6d2c623ef690e1a72b4ae85964b068636520ff3b417a290a7224fceec0d7097b108085f33df40fbd21bb613369fa5f4'
63
'fb642f0354a1fefc709c1a5278e042ca47becf1256d8e83ed631546812ff3c74b9821d7ae46dababd90cf6159ba79d94a4f8c31d3e79241a6b909de70776d56c'
64
'f8de2bcb231a577b14eb2ff33b646d503d1b071cbc0f3916c37f425098c37ead94c6d86838f5f37066281ce5dea50cab2d4c18792f59039ae77168a058af6c18'
65
'706718fee07c4d0b0af759b3054ee914a8492a3f1957b7354546da2ec333ab6581a4cd7f887c3d93181801cd253b685bffa7b11f590d9722e99317e63dd57fb8')
66
backup=("etc/paperless.conf")
67
options=("!strip")
68
install="paperless.install"
69
70
prepare(){
71
uv venv --clear --no-managed-python -q "$srcdir/venv"
72
source "$srcdir/venv/bin/activate"
73
uv pip install --index-strategy unsafe-best-match -r "$srcdir/$_pkgname/requirements.txt"
74
deactivate
75
76
# roughly sorted by assumed compatibility
77
for f in redis{,-git} valkey keydb redict; do
78
fork=$(pacman -Qq $f) && break
79
done
80
81
if [[ -n "$fork" && redis != $fork ]]; then
82
echo "redis is not available. patching services to use $fork instead ..."
83
sed -i "s/redis.service/${fork%-git}.service/g" "$srcdir"/*.service "$srcdir/paperless.target"
84
fi
85
}
86
87
package(){
88
# program files
89
install -d "$pkgdir/usr/share/paperless" "$pkgdir/usr/bin"
90
cp -R "$_pkgname"/* "$pkgdir/usr/share/paperless"
91
92
# venv
93
install -d "$pkgdir/usr/lib/paperless"
94
cp -R "$srcdir/venv"/* "$pkgdir/usr/lib/paperless"
95
(cd "$pkgdir/usr/lib/paperless"; virtualenv-tools --update-path /usr/lib/paperless)
96
find "$pkgdir/usr/lib/paperless" -type d -name "__pycache__" | xargs rm -rf
97
98
# main executable
99
cat << EOF > "$pkgdir/usr/bin/paperless-manage"
100
#!/usr/bin/bash
101
102
source /usr/lib/paperless/bin/activate
103
exec /usr/share/paperless/src/manage.py \$@
104
EOF
105
106
# scheduler
107
cat << EOF > "$pkgdir/usr/lib/paperless/scheduler"
108
#!/usr/bin/bash
109
source /usr/lib/paperless/bin/activate
110
exec celery --app paperless beat --loglevel INFO
111
EOF
112
113
# task queue
114
cat << EOF > "$pkgdir/usr/lib/paperless/task-queue"
115
#!/usr/bin/bash
116
source /usr/lib/paperless/bin/activate
117
exec celery --app paperless worker --loglevel INFO
118
EOF
119
120
# webserver
121
cat << EOF > "$pkgdir/usr/lib/paperless/webserver"
122
#!/usr/bin/bash
123
124
source /usr/lib/paperless/bin/activate
125
126
[ -n "\$PAPERLESS_BIND_ADDR" ] && export GRANIAN_HOST=\$PAPERLESS_BIND_ADDR
127
[ -n "\$PAPERLESS_PORT" ] && export GRANIAN_PORT=\$PAPERLESS_PORT
128
[ -n "\$PAPERLESS_WEBSERVER_WORKERS" ] && export GRANIAN_WORKERS=\$PAPERLESS_WEBSERVER_WORKERS
129
[ -n "\$PAPERLESS_FORCE_SCRIPT_NAME" ] && export GRANIAN_URL_PATH_PREFIX=\$PAPERLESS_FORCE_SCRIPT_NAME
130
131
exec granian --interface asginl --ws "paperless.asgi:application"
132
EOF
133
134
chmod 755 "$pkgdir/usr/lib/paperless/"{scheduler,task-queue,webserver} "$pkgdir/usr/share/paperless/src/manage.py" "$pkgdir/usr/bin/paperless-manage"
135
136
# config file
137
install -D -m 640 "$srcdir/paperless.conf" "$pkgdir/etc/paperless.conf"
138
rm "$pkgdir/usr/share/paperless/paperless.conf"
139
ln -s "/etc/paperless.conf" "$pkgdir/usr/share/paperless/paperless.conf"
140
# optional pacman hook
141
install -D -m 644 "paperless.hook" "$pkgdir/usr/share/paperless/docs/paperless.hook"
142
# user and files to create, ownership and permission to set
143
install -D -m 644 "paperless.sysusers" "$pkgdir/usr/lib/sysusers.d/paperless.conf"
144
install -D -m 644 "paperless.tmpfiles" "$pkgdir/usr/lib/tmpfiles.d/paperless.conf"
145
# service files
146
install -D -m 644 "paperless.target" "$pkgdir/usr/lib/systemd/system/paperless.target"
147
install -D -m 644 "paperless-consumer.service" "$pkgdir/usr/lib/systemd/system/paperless-consumer.service"
148
install -D -m 644 "paperless-scheduler.service" "$pkgdir/usr/lib/systemd/system/paperless-scheduler.service"
149
install -D -m 644 "paperless-task-queue.service" "$pkgdir/usr/lib/systemd/system/paperless-task-queue.service"
150
install -D -m 644 "paperless-webserver.service" "$pkgdir/usr/lib/systemd/system/paperless-webserver.service"
151
}
152
Changes since previous scan
--- PKGBUILD @ 2026-09-05 00:16+++ PKGBUILD @ 2026-09-17 00:27@@ -4,7 +4,7 @@ pkgname="paperless-ngx-venv" _pkgname="paperless-ngx"-pkgver=3.1.1+pkgver=3.1.3 pkgrel=1 pkgdesc="paperless-ngx: scan, index and archive all your physical documents" url="https://docs.paperless-ngx.com/"@@ -53,7 +53,7 @@ "paperless-scheduler.service" "paperless-task-queue.service" "paperless-webserver.service")-b2sums=('33556560c94057be829ed8f0b80ac7c7f44877b5221037b38854afd6bbc7d8727e84397da7018a90048f52beb8ba6579fd86ffa44ba2c61f4db7415f621590ba'+b2sums=('bf84679cece1639c702cf5f24b9cf13bdd3d2879d8570b26bb09a86ec0074878c9dbe7ac61bd7a5dc9ed80294ac059746486522b837bd6afbe491f667509eede' 'a182b37e6d885094e41ff90b82f4685c1a1ae20f0b03cf1478b072e3161875df7a1ea3d2410a0a5791df5fd911430d216bf1be67a996a943e74f7d65df98f76d' '747a8b8774fa48073e58b9b3ba55b28ca505b193cf180467b1bcbbe3a2c44931a198f355163b377219299c8b43f0a74550e241f835d9941c594fe318ae5235cd' '586ad775e26aef216716c33d8951e00044a7f6866167d27dceab39d51b4fd46527693dfe4e085dc20d2e9193679122ad2b9ac8a1c03a98df747af15ecca24ca2'Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 3 |
| 2026-09-16 00:03:17 | Low | 3 |
| 2026-09-15 00:25:31 | Low | 3 |
| 2026-09-14 00:27:57 | Low | 3 |
| 2026-09-13 00:19:54 | Low | 3 |
| 2026-09-12 00:25:17 | Low | 3 |
| 2026-09-11 00:19:22 | Low | 3 |
| 2026-09-10 00:22:44 | Low | 3 |
| 2026-09-09 00:04:09 | Low | 3 |
| 2026-09-08 00:18:08 | Low | 3 |
| 2026-09-07 00:30:15 | Low | 3 |
| 2026-09-06 00:17:06 | Low | 3 |
| 2026-09-05 09:59:47 | Medium | 2 |
| 2026-09-05 00:16:27 | Low | 3 |
| 2026-09-04 00:03:13 | Low | 3 |
| 2026-09-03 00:15:47 | Low | 3 |
| 2026-09-02 00:02:31 | Low | 3 |
| 2026-09-01 00:11:19 | Low | 3 |
| 2026-08-31 21:46:19 | Medium | 2 |
| 2026-08-31 00:19:57 | Low | 3 |