pdav

LOW

maintainer shinrax2 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The pip install is run inside a venv from requirements.txt sourced from the project's own git repository, so it only installs dependencies declared by the project itself, not an external package from an untrusted source.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install is run inside a venv from requirements.txt sourced from the project's own git repository, so it only installs dependencies declared by the project itself, not an external package from an untrusted source.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:19 .venv/bin/python3 -m pip install -r requirements.txt

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: shinrax2
    
      2_reponame=per-device-application-volume
    
      3pkgname=pdav
    
      4pkgver=0.3.1
    
      5pkgrel=1
    
      6pkgdesc="user daemon to automatically save and restore application volume settings based on default output device for pulseaudio/pipewire-pulse"
    
      7arch=(any)
    
      8url="https://github.com/shinrax2/per-device-application-volume"
    
      9license=('MIT')
    
      10depends=('python>=3' 'python-pulsectl' 'systemd' 'pulse-native-provider' 'libpulse')
    
      11source=("git+https://github.com/shinrax2/per-device-application-volume.git#tag=$pkgver")
    
      12conflicts=('pdav-git')
    
      13md5sums=('SKIP')
    
      14install=pdav.install
    
      15
    
      16build() {
    
      17    cd $_reponame
    
      18    python3 -m venv .venv
    
      19    .venv/bin/python3 -m pip install -r requirements.txt
    
      20    .venv/bin/python3 build-gui.py
    
      21}
    
      22
    
      23package() {
    
      24    cd $_reponame
    
      25    install -Dm755 "pdav" -t "$pkgdir/usr/bin"
    
      26    install -Dm755 "dist/pdav-gui" -t "$pkgdir/usr/bin"
    
      27    install -Dm644 "LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      28    install -Dm644 "quirks.json" -t "$pkgdir/usr/share/pdav"
    
      29    install -Dm644 "pdav-gui.desktop" -t "${pkgdir}/usr/share/applications"
    
      30    install -Dm644 "l10n/en.json" -t "$pkgdir/usr/share/pdav/l10n"
    
      31    install -Dm644 "l10n/de.json" -t "$pkgdir/usr/share/pdav/l10n"
    
      32    install -Dm644 "images/icon-256x256.png" -t "$pkgdir/usr/share/pdav/images"
    
      33    install -Dm644 "images/icon-128x128.png" -t "$pkgdir/usr/share/pdav/images"
    
      34    install -Dm644 "images/icon-64x64.png" -t "$pkgdir/usr/share/pdav/images"
    
      35    install -Dm644 "images/icon-32x32.png" -t "$pkgdir/usr/share/pdav/images"
    
      36    install -Dm644 "pdav.service" -t "$pkgdir/etc/systemd/user"
    
      37}
    
      38

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2