pdf-guru-anki-git

maintainer zxp19821005 · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The pip install is part of building the project from its own source in a local venv using requirements.txt from the git repository, which is a normal build step for Python components; the source is from the project's own repo and not an untrusted external package.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install is part of building the project from its own source in a local venv using requirements.txt from the git repository, which is a normal build step for Python components; the source is from the project's own repo and not an untrusted external package.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:85 ./bin/pip install -r requirements.txt

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2pkgname=pdf-guru-anki-git
    
      3_pkgname='PDF Guru'
    
      4pkgver=latest.r8.gf67a40f
    
      5_nodeversion=20
    
      6pkgrel=1
    
      7pkgdesc="A PDF-centric multi-functional office learning toolbox software, including four major functions: PDF practical toolbox, Anki card creation artifact, Anki strongest assistant, video note artifact."
    
      8arch=('any')
    
      9url="https://guru.kevin2li.top/"
    
      10_ghurl="https://github.com/kevin2li/PDF-Guru"
    
      11license=('AGPL-3.0-only')
    
      12conflicts=("${pkgname%-git}")
    
      13provides=("${pkgname%-git}=${pkgver%.r*}")
    
      14depends=(
    
  'python'
    
  'pandoc-cli'
    
  'tesseract'
    
  'python-pymupdf'
    
  'python-pillow'
    
  'python-tqdm'
    
      21)
    
      22makedepends=(
    
  'gendesk'
    
  'npm'
    
  'nvm'
    
  'git'
    
  'curl'
    
  'go'
    
  'python-pip'
    
  'wails'
    
  'pyinstaller'
    
  'upx'
    
      33)
    
      34source=(
    
  "${pkgname%-git}.git::git+${_ghurl}"
    
      36)
    
      37sha256sums=('SKIP')
    
      38pkgver() {
    
  cd "${srcdir}/${pkgname%-git}.git"
    
  set -o pipefail
    
  git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
    
  printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
    
      43}
    
      44_ensure_local_nvm() {
    
  local NVM_DIR="${srcdir}/.nvm"
    
  source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
    
  nvm install "${_nodeversion}"
    
  nvm use "${_nodeversion}"
    
      49}
    
      50prepare() {
    
  cd "${srcdir}/${pkgname%-git}.git"
    
  _ensure_local_nvm
    
  gendesk -q -f -n \
    
      --pkgname="${pkgname%-git}" \
    
      --pkgdesc="${pkgdesc}" \
    
      --categories="Office" \
    
      --name="${_pkgname}" \
    
      --exec="${pkgname%-git}"
    
  install -dm755 build/bin
    
  export CGO_ENABLED=1
    
  export GO111MODULE=on
    
  export GOOS=linux
    
  export GOCACHE="${srcdir}/go-build"
    
  export GOMODCACHE="${srcdir}/go/pkg/mod"
    
  if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
    
      export GOPROXY=https://goproxy.cn,direct
    
  fi
    
  go mod tidy
    
  cd "${srcdir}/${pkgname%-git}.git/frontend"
    
  HOME="${srcdir}/.electron-gyp"
    
  {
    
      echo -e '\n'	
    
      #echo 'build_from_source=true'
    
      echo "cache=${srcdir}/.npm_cache"
    
  } >> .npmrc
    
  if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
    
      {
    
          echo 'registry=https://registry.npmmirror.com'
    
      } >> .npmrc
    
      find ./ -type f -name "package-lock.json" -exec sed -i "s/registry.npmjs.org/registry.npmmirror.com/g" {} +
    
  fi
    
  NODE_ENV=development    npm install --legacy-peer-deps
    
  cd "${srcdir}/${pkgname%-git}.git/thirdparty"
    
  python -m venv ./
    
  ./bin/pip install -r requirements.txt
    
  pyinstaller -F -w pdf.py
    
  cp dist/pdf "${srcdir}/${pkgname%-git}.git/build/bin/"
    
  cp ocr.py "${srcdir}/${pkgname%-git}.git/build/bin/"
    
      89}
    
      90build() {
    
  cd "${srcdir}/${pkgname%-git}.git"
    
  sed -i "/frontend:install/d" wails.json
    
  wails build -upx -ldflags "-s -w"
    
      94}
    
      95package() {
    
  install -Dm755 "${srcdir}/${pkgname%-git}.git/build/bin/"{pdf,"${_pkgname}"} -t "${pkgdir}/usr/lib/${pkgname%-git}"
    
  install -Dm644 "${srcdir}/${pkgname%-git}.git/build/bin/ocr.py" -t "${pkgdir}/usr/lib/${pkgname%-git}"
    
  install -dm755 "${pkgdir}/usr/bin"
    
  ln -sf "/usr/lib/${pkgname%-git}/${_pkgname}" "${pkgdir}/usr/bin/${pkgname%-git}"
    
  touch "${pkgdir}/usr/lib/${pkgname%-git}/config.json"
    
  chmod 666 "${pkgdir}/usr/lib/${pkgname%-git}/config.json"
    
  install -Dm644 "${srcdir}/${pkgname%-git}.git/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
    
  install -Dm644 "${srcdir}/${pkgname%-git}.git/assets/logo.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
    
  install -Dm644 "${srcdir}/${pkgname%-git}.git/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      105}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2