paperless-ngx-venv
LOW
maintainer AlphaJack
31 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The pip install is part of building a Python virtual environment from the project's own requirements.txt within a released source tarball, which is a standard and safe practice for packaging.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install is part of building a Python virtual environment from the project's own requirements.txt within a released source tarball, which is a standard and safe practice for packaging.
2 higher static findings superseded - not the current verdict (shown for transparency)
Medium
pip install of an external package
pip_install_external
`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:74
uv pip install --index-strategy unsafe-best-match -r "$srcdir/$_pkgname/requirements.txt"
Medium
External install via pipx/uv/poetry/cargo/go/gem
alt_pkg_manager_install
A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:74
uv pip install --index-strategy unsafe-best-match -r "$srcdir/$_pkgname/requirements.txt"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: AlphaJack <alphajack at tuta dot io>
2
# Maintainer: atomicfs <https://aur.archlinux.org/account/atomicfs>
3
# Maintainer: shtrophic <aur at shtrophic dot net>
4
5
pkgname="paperless-ngx-venv"
6
_pkgname="paperless-ngx"
7
pkgver=3.4.0
8
pkgrel=1
9
pkgdesc="paperless-ngx: scan, index and archive all your physical documents"
10
url="https://docs.paperless-ngx.com/"
11
license=("GPL-3.0-or-later")
12
arch=("x86_64" "aarch64")
13
provides=("paperless" "$pkgname")
14
conflicts=("paperless" "paperless-ng" "paperless-ngx")
15
replaces=("paperless-ngx")
16
makedepends=(
17
"uv"
18
"findutils"
19
"mariadb"
20
"postgresql"
21
"postgresql-libs"
22
"python-virtualenv-tools3"
23
)
24
depends=(
25
"file"
26
"ghostscript"
27
"gnupg"
28
"imagemagick"
29
"nltk-data"
30
"optipng"
31
"python"
32
"poppler"
33
"redis"
34
"sqlite"
35
"tesseract-data-eng"
36
"ttf-liberation"
37
"unpaper"
38
)
39
optdepends=(
40
"gotenberg: convert files to pdf"
41
"jbig2enc: smaller PDF size"
42
"mariadb: mariadb database"
43
"postgresql: postgres database"
44
"tika-server: extract metadata from files"
45
)
46
source=("https://github.com/$_pkgname/$_pkgname/releases/download/v$pkgver/$_pkgname-v$pkgver.tar.xz"
47
"paperless.conf"
48
"paperless.hook"
49
"paperless.sysusers"
50
"paperless.tmpfiles"
51
"paperless.target"
52
"paperless-consumer.service"
53
"paperless-scheduler.service"
54
"paperless-task-queue.service"
55
"paperless-webserver.service")
56
b2sums=('532820047bd6e54bd807a274b312bf62a6db35e9677e29cffa33b000cc132b5c9143a11817609d2e52f006a327f6938c2882f22cd5436d0e36542a09b8a6f19f'
57
'a182b37e6d885094e41ff90b82f4685c1a1ae20f0b03cf1478b072e3161875df7a1ea3d2410a0a5791df5fd911430d216bf1be67a996a943e74f7d65df98f76d'
58
'747a8b8774fa48073e58b9b3ba55b28ca505b193cf180467b1bcbbe3a2c44931a198f355163b377219299c8b43f0a74550e241f835d9941c594fe318ae5235cd'
59
'586ad775e26aef216716c33d8951e00044a7f6866167d27dceab39d51b4fd46527693dfe4e085dc20d2e9193679122ad2b9ac8a1c03a98df747af15ecca24ca2'
60
'4a59f0a0c6a4abad23cba01e216909f45a7064e93911b8ba3e3b394f52379e41898b8c9e1246ba034bc8d2fe6dc83f5cad926e265a17da7c7093d997cfe8b4f3'
61
'd4eff17cf6b4642211d61545d3722cb626e35b591fc1f11dfc0d4bd3b303ac145777953d405b1bbdf6473512590d50169cf58db8251de2701cee4d7b151ef6be'
62
'3a294006b2c7cd856a5034c22634e1c4b6d2c623ef690e1a72b4ae85964b068636520ff3b417a290a7224fceec0d7097b108085f33df40fbd21bb613369fa5f4'
63
'fb642f0354a1fefc709c1a5278e042ca47becf1256d8e83ed631546812ff3c74b9821d7ae46dababd90cf6159ba79d94a4f8c31d3e79241a6b909de70776d56c'
64
'f8de2bcb231a577b14eb2ff33b646d503d1b071cbc0f3916c37f425098c37ead94c6d86838f5f37066281ce5dea50cab2d4c18792f59039ae77168a058af6c18'
65
'706718fee07c4d0b0af759b3054ee914a8492a3f1957b7354546da2ec333ab6581a4cd7f887c3d93181801cd253b685bffa7b11f590d9722e99317e63dd57fb8')
66
backup=("etc/paperless.conf")
67
# a venv has no use for a -debug package, and collecting its sources takes minutes
68
options=("!strip" "!debug")
69
install="paperless.install"
70
71
prepare(){
72
uv venv --clear --no-managed-python -q "$srcdir/venv"
73
source "$srcdir/venv/bin/activate"
74
uv pip install --index-strategy unsafe-best-match -r "$srcdir/$_pkgname/requirements.txt"
75
deactivate
76
77
# roughly sorted by assumed compatibility
78
for f in redis{,-git} valkey keydb redict; do
79
fork=$(pacman -Qq $f) && break
80
done
81
82
if [[ -n "$fork" && redis != $fork ]]; then
83
echo "redis is not available. patching services to use $fork instead ..."
84
sed -i "s/redis.service/${fork%-git}.service/g" "$srcdir"/*.service "$srcdir/paperless.target"
85
fi
86
}
87
88
package(){
89
# program files
90
install -d "$pkgdir/usr/share/paperless" "$pkgdir/usr/bin"
91
cp -R "$_pkgname"/* "$pkgdir/usr/share/paperless"
92
93
# venv
94
install -d "$pkgdir/usr/lib/paperless"
95
cp -R "$srcdir/venv"/* "$pkgdir/usr/lib/paperless"
96
(cd "$pkgdir/usr/lib/paperless"; virtualenv-tools --update-path /usr/lib/paperless)
97
find "$pkgdir/usr/lib/paperless" -type d -name "__pycache__" | xargs rm -rf
98
99
# main executable
100
cat << EOF > "$pkgdir/usr/bin/paperless-manage"
101
#!/usr/bin/bash
102
103
source /usr/lib/paperless/bin/activate
104
exec /usr/share/paperless/src/manage.py \$@
105
EOF
106
107
# scheduler
108
cat << EOF > "$pkgdir/usr/lib/paperless/scheduler"
109
#!/usr/bin/bash
110
source /usr/lib/paperless/bin/activate
111
exec celery --app paperless beat --loglevel INFO
112
EOF
113
114
# task queue
115
cat << EOF > "$pkgdir/usr/lib/paperless/task-queue"
116
#!/usr/bin/bash
117
source /usr/lib/paperless/bin/activate
118
exec celery --app paperless worker --loglevel INFO
119
EOF
120
121
# webserver
122
cat << EOF > "$pkgdir/usr/lib/paperless/webserver"
123
#!/usr/bin/bash
124
125
source /usr/lib/paperless/bin/activate
126
127
[ -n "\$PAPERLESS_BIND_ADDR" ] && export GRANIAN_HOST=\$PAPERLESS_BIND_ADDR
128
[ -n "\$PAPERLESS_PORT" ] && export GRANIAN_PORT=\$PAPERLESS_PORT
129
[ -n "\$PAPERLESS_WEBSERVER_WORKERS" ] && export GRANIAN_WORKERS=\$PAPERLESS_WEBSERVER_WORKERS
130
[ -n "\$PAPERLESS_FORCE_SCRIPT_NAME" ] && export GRANIAN_URL_PATH_PREFIX=\$PAPERLESS_FORCE_SCRIPT_NAME
131
132
exec granian --interface asginl --ws "paperless.asgi:application"
133
EOF
134
135
chmod 755 "$pkgdir/usr/lib/paperless/"{scheduler,task-queue,webserver} "$pkgdir/usr/share/paperless/src/manage.py" "$pkgdir/usr/bin/paperless-manage"
136
137
# config file
138
install -D -m 640 "$srcdir/paperless.conf" "$pkgdir/etc/paperless.conf"
139
rm "$pkgdir/usr/share/paperless/paperless.conf"
140
ln -s "/etc/paperless.conf" "$pkgdir/usr/share/paperless/paperless.conf"
141
# optional pacman hook
142
install -D -m 644 "paperless.hook" "$pkgdir/usr/share/paperless/docs/paperless.hook"
143
# user and files to create, ownership and permission to set
144
install -D -m 644 "paperless.sysusers" "$pkgdir/usr/lib/sysusers.d/paperless.conf"
145
install -D -m 644 "paperless.tmpfiles" "$pkgdir/usr/lib/tmpfiles.d/paperless.conf"
146
# service files
147
install -D -m 644 "paperless.target" "$pkgdir/usr/lib/systemd/system/paperless.target"
148
install -D -m 644 "paperless-consumer.service" "$pkgdir/usr/lib/systemd/system/paperless-consumer.service"
149
install -D -m 644 "paperless-scheduler.service" "$pkgdir/usr/lib/systemd/system/paperless-scheduler.service"
150
install -D -m 644 "paperless-task-queue.service" "$pkgdir/usr/lib/systemd/system/paperless-task-queue.service"
151
install -D -m 644 "paperless-webserver.service" "$pkgdir/usr/lib/systemd/system/paperless-webserver.service"
152
}
153
Changes since previous scan
--- PKGBUILD @ 2026-10-31 00:07+++ PKGBUILD @ 2026-11-01 00:21@@ -4,8 +4,8 @@ pkgname="paperless-ngx-venv" _pkgname="paperless-ngx"-pkgver=3.3.4-pkgrel=2+pkgver=3.4.0+pkgrel=1 pkgdesc="paperless-ngx: scan, index and archive all your physical documents" url="https://docs.paperless-ngx.com/" license=("GPL-3.0-or-later")@@ -53,7 +53,7 @@ "paperless-scheduler.service" "paperless-task-queue.service" "paperless-webserver.service")-b2sums=('89739b9e78f63e0b9bc1ad596672d73d4265810d31ec7b0872e658e53c47717f7269fa3a78cdf153a131b6f8cfcc595957403f707eb4cc421205e9dd1a1a8bd6'+b2sums=('532820047bd6e54bd807a274b312bf62a6db35e9677e29cffa33b000cc132b5c9143a11817609d2e52f006a327f6938c2882f22cd5436d0e36542a09b8a6f19f' 'a182b37e6d885094e41ff90b82f4685c1a1ae20f0b03cf1478b072e3161875df7a1ea3d2410a0a5791df5fd911430d216bf1be67a996a943e74f7d65df98f76d' '747a8b8774fa48073e58b9b3ba55b28ca505b193cf180467b1bcbbe3a2c44931a198f355163b377219299c8b43f0a74550e241f835d9941c594fe318ae5235cd' '586ad775e26aef216716c33d8951e00044a7f6866167d27dceab39d51b4fd46527693dfe4e085dc20d2e9193679122ad2b9ac8a1c03a98df747af15ecca24ca2'Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 3 |
| 2026-10-31 11:58:11 | Medium | 2 |
| 2026-10-31 00:07:41 | Low | 3 |
| 2026-10-30 11:55:28 | Medium | 2 |
| 2026-10-30 00:29:30 | Medium | 3 |
| 2026-10-29 15:52:51 | Medium | 3 |
| 2026-10-29 00:13:55 | Medium | 3 |
| 2026-10-28 00:06:54 | Medium | 3 |
| 2026-10-27 00:23:28 | Medium | 3 |
| 2026-10-26 00:12:40 | Medium | 3 |
| 2026-10-25 00:20:48 | Medium | 3 |
| 2026-10-24 15:40:54 | Medium | 3 |
| 2026-10-24 00:14:55 | Low | 3 |
| 2026-10-23 00:02:19 | Low | 3 |
| 2026-10-22 00:13:10 | Low | 3 |
| 2026-10-21 00:12:50 | Low | 3 |
| 2026-10-20 19:28:13 | Medium | 2 |
| 2026-10-20 00:10:31 | Low | 3 |
| 2026-10-19 00:03:55 | Low | 3 |
| 2026-10-18 00:06:55 | Low | 3 |