photoprism

LOW

maintainer shtrophic 3 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads ONNX model files from the project's own domain (dl.photoprism.app), which are data assets used by the application, not executable code; the source code is built from the official GitHub repository, and the models are checksum-verified, posing no supply-chain risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads ONNX model files from the project's own domain (dl.photoprism.app), which are data assets used by the application, not executable code; the source code is built from the official GitHub repository, and the models are checksum-verified, posing no supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:25 "https://dl.${pkgname}.app/onnx/models/face_detection_yunet_2026may.onnx"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  shtrophic <aur@shtrophic.net>
    
      2# Contributor: Evine Deng <evinedeng@hotmail.com>
    
      3# Contributor: Thomas Eizinger <thomas@eizinger.io>
    
      4
    
      5pkgname=photoprism
    
      6pkgver=261007
    
      7_commit=65faaae5d
    
      8_pkgver="${pkgver}-${_commit}"
    
      9pkgrel=1
    
      10pkgdesc="AI-Powered Photos App for the Decentralized Web"
    
      11arch=('x86_64')
    
      12url="https://github.com/${pkgname}/${pkgname}"
    
      13license=('AGPL-3.0-or-later')
    
      14depends=(glibc glib2 libvips photoprism-tensorflow photoprism-onnxruntime)
    
      15makedepends=(go npm findutils)
    
      16optdepends=("darktable: for RAW to JPEG conversion"
    
      17	"ffmpeg: for video transcoding and thumbnail extraction"
    
      18	"libva: for video transcoding"
    
      19	"imagemagick: for image conversion"
    
      20	"libheif: for HEIC/HEIF image conversion"
    
      21	"mariadb: for MySQL database driver"
    
      22	"perl-image-exiftool: for extracting metadata"
    
      23	"rawtherapee: for RAW to JPEG conversion")
    
      24source=("${pkgname}-${_pkgver}.tar.gz::${url}/archive/refs/tags/${_pkgver}.tar.gz"
    
      25	"https://dl.${pkgname}.app/onnx/models/face_detection_yunet_2026may.onnx"
    
      26	"https://dl.${pkgname}.app/onnx/models/face_recognition_sface_2021dec.onnx"
    
      27	"https://dl.${pkgname}.app/onnx/models/efficientformerv2_s2.onnx"
    
      28	"https://dl.${pkgname}.app/onnx/models/yahoo_open_nsfw.onnx"
    
      29	"${pkgname}-import."{service,timer}
    
      30	"${pkgname}-vision."{service,timer}
    
      31	"${pkgname}."{service,sysusers,tmpfiles,user.service}
    
      32	"defaults.yml"
    
      33	"01-internal-config-config_go.patch")
    
      34backup=("etc/${pkgname}/defaults.yml")
    
      35b2sums=('7a4c7f5a3a1cb251aede3cb1104d8972a6316c2172ef7ec817d1276f571cc4d2faf33c89bdc8830ff7744e4c2e67849041403186e81081067da2d93654722cd5'
    
      36        '14dc17a3321d41a557a5dc4dc75b69687d89a912b372004b750ce239bef6b3554c74022ddfcd8d737ba10b197f8a5767114edc209ae69f99c38120f1a4707ea5'
    
      37        'c52ac4bf680272a9a532249f9d0f26abf9056f88187de829fd85be7010e188c2566cd6ba621a1f7daedc37c1ffca0059fe3b9e58fb570cf7e54836a882371ac1'
    
      38        '39a72642ac680f32e85ee99dd9072f6d4c046eb2b84af6ae5381dc25072e8611165174425b0540933dce42497800a591223dd8e655949005f9e0c7dd4d7a35a9'
    
      39        '0241c942a703bf712704087e8d2b1abdab9278ea339d331459e671aba5164adefa3decb7a8ceb1dc35865d7d40a0fe44aadbe91379090e7d8797691f5408a213'
    
      40        'f5a06fd26f15afa7b71bd66afba800488fad697567754b6efc0d20f55955c043ba817d280b1d80c901ccbfcf085f11ad289624946bcd4bf2c3f3ee963a431c2d'
    
      41        'e75033ee265dddf39cb4f0d1cfc1e86a540da37c9787e3c13040b6fc039437d6684be3b59d63f001864f98f46afd49847b86b4fc6bedf891be87881a4bb83cf0'
    
      42        '438f6206adaf7b1beccda7b65ea71ecc45c29b4443942b823ad4652dde40d0cdbb8d5b7e3476aaf0643e5ad4369377ae9df0682bf73ca7d2af419c3820b2ef20'
    
      43        '8b54d90d8ee721c555c3650f8c1041a5068a65aa847c0f768ce5d05a917b60e961b332fc8608ee7f3b0b8928e0606e49e85b5f3baa1e3b85d00b7decdf9f29da'
    
      44        'd910f3cd6f3e28e4f3f529f50b55e7ce3473f1dc51d3a76a91fd0b5c0af68616bd9fee64b574c93b0288302ba82d8a612c065dc4f15bffedd2e5a78b434dfa15'
    
      45        '02a752c8dda9c1611cac8119cf603bb8147dda1aa68fabaa9be61952e1839132d190691a68a01d0443d3750f76319a9e77e7fb9f175d5dbd0f527e5e4529ede8'
    
      46        'f8ad9373b97b6f5bda10caa193ae3f6700f8e15d82f30a2c8ad0fec02c5c25c3ad1f62ae524aa5e28b07312016d31c2918a3a9a3b172e61128fe054b129eecbe'
    
      47        '96d8d89499adfd1e3fba1b729133f3a01dbe16b2cb11deacc7e0e69620530c8f28e19911b16368816d98ce8e4ffa9645e8cb0429c82314179c335e736db87198'
    
      48        'eda69ac2d568534e3f5ca89605f68114dc034bc6c31c9a0edbdec14b79165aa9dd2f1183276cde40f0a69cd6e511b2c1250617103dc3d1ee8e0074469be7e93b'
    
      49        'e91d9a583d6eb7c2f31f0348885e5f8360c2f442ea800d0afbb627612fd84de2a705eebfa8782d9556b2f8af00fc15d16238e2ecc5700fd9373c693e209c8af8')
    
      50
    
      51prepare() {
    
      52	export GOPATH="$srcdir/go"
    
      53	export GOFLAGS="-modcacherw -mod=readonly"
    
      54
    
      55	cd "$pkgname-$_pkgver"
    
      56
    
      57	for p in "$srcdir/"*.patch; do
    
      58		patch -p0 <$p
    
      59	done
    
      60
    
      61	go mod download
    
      62
    
      63	npm --prefix=frontend install --cache "$srcdir/npm-cache"
    
      64}
    
      65
    
      66build() {
    
      67	export CGO_CFLAGS="$CFLAGS -I/usr/include/photoprism"
    
      68	export CGO_CPPFLAGS="$CPPFLAGS"
    
      69	export CGO_CXXFLAGS="$CXXFLAGS"
    
      70	export NODE_ENV=production
    
      71	export GOPATH="$srcdir/go"
    
      72
    
      73	cd "$pkgname-$_pkgver"
    
      74	local buildid="$_pkgver-$(uname -s)-$(uname -m)"
    
      75	local ldflags="
    
      76	-s -w \
    
      77	-linkmode external \
    
      78	-extldflags '$LDFLAGS -L/usr/lib/photoprism -Wl,-rpath=/usr/lib/photoprism' \
    
      79	-X main.version=$buildid
    
      80    "
    
      81	go build \
    
      82		-trimpath \
    
      83		-buildmode=pie \
    
      84		-mod=readonly \
    
      85		-modcacherw \
    
      86		-ldflags "$ldflags" \
    
      87		-o "$pkgname" \
    
      88		"./cmd/$pkgname/$pkgname.go"
    
      89
    
      90	npm --prefix=frontend run build
    
      91}
    
      92
    
      93package() {
    
      94	for model in efficientformerv2_s2 yahoo_open_nsfw yunet sface; do
    
      95		install -Dm644 *"$model"*.onnx -t "$pkgdir/usr/share/$pkgname/$model"
    
      96	done
    
      97
    
      98	install -Dm644 "$pkgname-import".* "$pkgname-vision".* "$pkgname.service" -t "$pkgdir/usr/lib/systemd/system"
    
      99	install -Dm644 "$pkgname.sysusers" "$pkgdir/usr/lib/sysusers.d/$pkgname.conf"
    
      100	install -Dm644 "$pkgname.tmpfiles" "$pkgdir/usr/lib/tmpfiles.d/$pkgname.conf"
    
      101	install -Dm644 "$pkgname.user.service" "$pkgdir/usr/lib/systemd/user/$pkgname.service"
    
      102	install -Dm644 "defaults.yml" "$pkgdir/etc/$pkgname/defaults.yml"
    
      103
    
      104	cd "$pkgname-$_pkgver"
    
      105	install -Dm755 "$pkgname" "$pkgdir/usr/bin/$pkgname"
    
      106	install -Dm644 LICENSE -t "$pkgdir/usr/share/licenses/$pkgname"
    
      107
    
      108	cd assets
    
      109	find {locales,profiles,static,templates} -type f -exec install -Dm644 {} "$pkgdir/usr/share/$pkgname/"{} \;
    
      110}
    
      111

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2