paperless-ngx-venv

maintainer AlphaJack · 29 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The pip install uses uv on requirements.txt from the official project's release tarball, which is a standard and safe build practice for Python applications; the external install is part of building the package's own dependencies in a venv, not executing untrusted remote code.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install uses uv on requirements.txt from the official project's release tarball, which is a standard and safe build practice for Python applications; the external install is part of building the package's own dependencies in a venv, not executing untrusted remote code.

2 higher static findings superseded - not the current verdict (shown for transparency)

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:73 uv pip install --index-strategy unsafe-best-match -r "$srcdir/$_pkgname/requirements.txt"

MEDIUM External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:73 uv pip install --index-strategy unsafe-best-match -r "$srcdir/$_pkgname/requirements.txt"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: AlphaJack <alphajack at tuta dot io>
    
      2# Maintainer: atomicfs <https://aur.archlinux.org/account/atomicfs>
    
      3# Maintainer: shtrophic <aur at shtrophic dot net>
    
      4
    
      5pkgname="paperless-ngx-venv"
    
      6_pkgname="paperless-ngx"
    
      7pkgver=3.0.4
    
      8pkgrel=1
    
      9pkgdesc="paperless-ngx: scan, index and archive all your physical documents"
    
      10url="https://docs.paperless-ngx.com/"
    
      11license=("GPL-3.0-or-later")
    
      12arch=("x86_64" "aarch64")
    
      13provides=("paperless" "$pkgname")
    
      14conflicts=("paperless" "paperless-ng" "paperless-ngx")
    
      15replaces=("paperless-ngx")
    
      16makedepends=(
    
      17 "uv"
    
      18 "findutils"
    
      19 "mariadb"
    
      20 "postgresql"
    
      21 "postgresql-libs"
    
      22 "python-virtualenv-tools3"
    
      23)
    
      24depends=(
    
      25 "file"
    
      26 "ghostscript"
    
      27 "gnupg"
    
      28 "imagemagick"
    
      29 "nltk-data"
    
      30 "optipng"
    
      31 "python"
    
      32 "poppler"
    
      33 "redis"
    
      34 "sqlite"
    
      35 "tesseract-data-eng"
    
      36 "ttf-liberation"
    
      37 "unpaper"
    
      38)
    
      39optdepends=(
    
      40 "gotenberg: convert files to pdf"
    
      41 "jbig2enc: smaller PDF size"
    
      42 "mariadb: mariadb database"
    
      43 "postgresql: postgres database"
    
      44 "tika-server: extract metadata from files"
    
      45)
    
      46source=("https://github.com/$_pkgname/$_pkgname/releases/download/v$pkgver/$_pkgname-v$pkgver.tar.xz"
    
      47        "paperless.conf"
    
      48        "paperless.hook"
    
      49        "paperless.sysusers"
    
      50        "paperless.tmpfiles"
    
      51        "paperless.target"
    
      52        "paperless-consumer.service"
    
      53        "paperless-scheduler.service"
    
      54        "paperless-task-queue.service"
    
      55	"paperless-webserver.service")
    
      56b2sums=('e7f7a772d74989c17dddb0c9441236c47ba1fd3278d04dbeaac6f97de7772a9c0f3da3c8669968c366f64bce38d1aa86c32f81e2dee3dc97212dfc8c422a770c'
    
      57        'a182b37e6d885094e41ff90b82f4685c1a1ae20f0b03cf1478b072e3161875df7a1ea3d2410a0a5791df5fd911430d216bf1be67a996a943e74f7d65df98f76d'
    
      58        '747a8b8774fa48073e58b9b3ba55b28ca505b193cf180467b1bcbbe3a2c44931a198f355163b377219299c8b43f0a74550e241f835d9941c594fe318ae5235cd'
    
      59        '586ad775e26aef216716c33d8951e00044a7f6866167d27dceab39d51b4fd46527693dfe4e085dc20d2e9193679122ad2b9ac8a1c03a98df747af15ecca24ca2'
    
      60        '4a59f0a0c6a4abad23cba01e216909f45a7064e93911b8ba3e3b394f52379e41898b8c9e1246ba034bc8d2fe6dc83f5cad926e265a17da7c7093d997cfe8b4f3'
    
      61        'd4eff17cf6b4642211d61545d3722cb626e35b591fc1f11dfc0d4bd3b303ac145777953d405b1bbdf6473512590d50169cf58db8251de2701cee4d7b151ef6be'
    
      62        '3a294006b2c7cd856a5034c22634e1c4b6d2c623ef690e1a72b4ae85964b068636520ff3b417a290a7224fceec0d7097b108085f33df40fbd21bb613369fa5f4'
    
      63        'fb642f0354a1fefc709c1a5278e042ca47becf1256d8e83ed631546812ff3c74b9821d7ae46dababd90cf6159ba79d94a4f8c31d3e79241a6b909de70776d56c'
    
      64        'f8de2bcb231a577b14eb2ff33b646d503d1b071cbc0f3916c37f425098c37ead94c6d86838f5f37066281ce5dea50cab2d4c18792f59039ae77168a058af6c18'
    
      65        '706718fee07c4d0b0af759b3054ee914a8492a3f1957b7354546da2ec333ab6581a4cd7f887c3d93181801cd253b685bffa7b11f590d9722e99317e63dd57fb8')
    
      66backup=("etc/paperless.conf")
    
      67options=("!strip")
    
      68install="paperless.install"
    
      69
    
      70prepare(){
    
      71 uv venv --clear --no-managed-python -q "$srcdir/venv"
    
      72 source "$srcdir/venv/bin/activate"
    
      73 uv pip install --index-strategy unsafe-best-match -r "$srcdir/$_pkgname/requirements.txt"
    
      74 deactivate
    
      75
    
      76 # roughly sorted by assumed compatibility
    
      77 for f in redis{,-git} valkey keydb redict; do
    
      78     fork=$(pacman -Qq $f) && break
    
      79 done
    
      80
    
      81 if [[ -n "$fork" && redis != $fork ]]; then
    
      82    echo "redis is not available. patching services to use $fork instead ..."
    
      83    sed -i "s/redis.service/${fork%-git}.service/g" "$srcdir"/*.service "$srcdir/paperless.target"
    
      84 fi
    
      85}
    
      86
    
      87package(){
    
      88 # program files
    
      89 install -d "$pkgdir/usr/share/paperless" "$pkgdir/usr/bin"
    
      90 cp -R "$_pkgname"/* "$pkgdir/usr/share/paperless"
    
      91
    
      92 # venv
    
      93 install -d "$pkgdir/usr/lib/paperless"
    
      94 cp -R "$srcdir/venv"/* "$pkgdir/usr/lib/paperless"
    
      95 (cd "$pkgdir/usr/lib/paperless"; virtualenv-tools --update-path /usr/lib/paperless)
    
      96 find "$pkgdir/usr/lib/paperless" -type d -name "__pycache__" | xargs rm -rf
    
      97
    
      98 # main executable
    
      99 cat << EOF > "$pkgdir/usr/bin/paperless-manage"
    
      100#!/usr/bin/bash
    
      101
    
      102source /usr/lib/paperless/bin/activate
    
      103exec /usr/share/paperless/src/manage.py \$@
    
      104EOF
    
      105
    
      106 # scheduler
    
      107 cat << EOF > "$pkgdir/usr/lib/paperless/scheduler"
    
      108#!/usr/bin/bash
    
      109source /usr/lib/paperless/bin/activate
    
      110exec celery --app paperless beat --loglevel INFO
    
      111EOF
    
      112
    
      113 # task queue
    
      114 cat << EOF > "$pkgdir/usr/lib/paperless/task-queue"
    
      115#!/usr/bin/bash
    
      116source /usr/lib/paperless/bin/activate
    
      117exec celery --app paperless worker --loglevel INFO
    
      118EOF
    
      119
    
      120 # webserver
    
      121 cat << EOF > "$pkgdir/usr/lib/paperless/webserver"
    
      122#!/usr/bin/bash
    
      123
    
      124source /usr/lib/paperless/bin/activate
    
      125
    
      126[ -n "\$PAPERLESS_BIND_ADDR" ] && export GRANIAN_HOST=\$PAPERLESS_BIND_ADDR
    
      127[ -n "\$PAPERLESS_PORT" ] && export GRANIAN_PORT=\$PAPERLESS_PORT
    
      128[ -n "\$PAPERLESS_WEBSERVER_WORKERS" ] && export GRANIAN_WORKERS=\$PAPERLESS_WEBSERVER_WORKERS
    
      129[ -n "\$PAPERLESS_FORCE_SCRIPT_NAME" ] && export GRANIAN_URL_PATH_PREFIX=\$PAPERLESS_FORCE_SCRIPT_NAME
    
      130
    
      131exec granian --interface asginl --ws "paperless.asgi:application"
    
      132EOF
    
      133 
    
      134 chmod 755 "$pkgdir/usr/lib/paperless/"{scheduler,task-queue,webserver} "$pkgdir/usr/share/paperless/src/manage.py" "$pkgdir/usr/bin/paperless-manage"
    
      135
    
      136 # config file
    
      137 install -D -m 640 "$srcdir/paperless.conf" "$pkgdir/etc/paperless.conf"
    
      138 rm "$pkgdir/usr/share/paperless/paperless.conf"
    
      139 ln -s "/etc/paperless.conf" "$pkgdir/usr/share/paperless/paperless.conf"
    
      140 # optional pacman hook
    
      141 install -D -m 644 "paperless.hook" "$pkgdir/usr/share/paperless/docs/paperless.hook"
    
      142 # user and files to create, ownership and permission to set
    
      143 install -D -m 644 "paperless.sysusers" "$pkgdir/usr/lib/sysusers.d/paperless.conf"
    
      144 install -D -m 644 "paperless.tmpfiles" "$pkgdir/usr/lib/tmpfiles.d/paperless.conf"
    
      145 # service files
    
      146 install -D -m 644 "paperless.target" "$pkgdir/usr/lib/systemd/system/paperless.target"
    
      147 install -D -m 644 "paperless-consumer.service" "$pkgdir/usr/lib/systemd/system/paperless-consumer.service"
    
      148 install -D -m 644 "paperless-scheduler.service" "$pkgdir/usr/lib/systemd/system/paperless-scheduler.service"
    
      149 install -D -m 644 "paperless-task-queue.service" "$pkgdir/usr/lib/systemd/system/paperless-task-queue.service"
    
      150 install -D -m 644 "paperless-webserver.service" "$pkgdir/usr/lib/systemd/system/paperless-webserver.service"
    
      151}
    
      152

Changes since previous scan

--- PKGBUILD @ 2026-07-29 00:25
+++ PKGBUILD @ 2026-08-03 00:08
@@ -4,7 +4,7 @@
 
 pkgname="paperless-ngx-venv"
 _pkgname="paperless-ngx"
-pkgver=2.20.15
+pkgver=3.0.4
 pkgrel=1
 pkgdesc="paperless-ngx: scan, index and archive all your physical documents"
 url="https://docs.paperless-ngx.com/"
@@ -53,7 +53,7 @@
         "paperless-scheduler.service"
         "paperless-task-queue.service"
 	"paperless-webserver.service")
-b2sums=('37dd1691c21238ffbef7daab07a9a9b260d7fecec88a1b001d9a352cf438867ff7568a8e453c9babe729df1b07d760df3c72ae5cb33c197c8e62c9a6f017b795'
+b2sums=('e7f7a772d74989c17dddb0c9441236c47ba1fd3278d04dbeaac6f97de7772a9c0f3da3c8669968c366f64bce38d1aa86c32f81e2dee3dc97212dfc8c422a770c'
         'a182b37e6d885094e41ff90b82f4685c1a1ae20f0b03cf1478b072e3161875df7a1ea3d2410a0a5791df5fd911430d216bf1be67a996a943e74f7d65df98f76d'
         '747a8b8774fa48073e58b9b3ba55b28ca505b193cf180467b1bcbbe3a2c44931a198f355163b377219299c8b43f0a74550e241f835d9941c594fe318ae5235cd'
         '586ad775e26aef216716c33d8951e00044a7f6866167d27dceab39d51b4fd46527693dfe4e085dc20d2e9193679122ad2b9ac8a1c03a98df747af15ecca24ca2'
@@ -70,8 +70,7 @@
 prepare(){
  uv venv --clear --no-managed-python -q "$srcdir/venv"
  source "$srcdir/venv/bin/activate"
- uv pip install -r "$srcdir/$_pkgname/requirements.txt"
- uv pip install granian==2.6.1
+ uv pip install --index-strategy unsafe-best-match -r "$srcdir/$_pkgname/requirements.txt"
  deactivate
 
  # roughly sorted by assumed compatibility

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 17:12:22	MEDIUM	2
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 00:17:08	LOW	3
2026-07-18 00:14:48	LOW	3
2026-07-17 00:06:16	LOW	3
2026-07-16 00:05:41	LOW	3