photoprism

LOW

maintainer shtrophic 3 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads model files (ONNX, zip) from the project's own domain (dl.photoprism.app), which is plausibly official; these are data files, not executables, and the main source is a tagged release from GitHub; checksums are provided, so the risk is low.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads model files (ONNX, zip) from the project's own domain (dl.photoprism.app), which is plausibly official; these are data files, not executables, and the main source is a tagged release from GitHub; checksums are provided, so the risk is low.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:25 "https://dl.${pkgname}.app/onnx/models/scrfd_500m_bnkps_shape640x640.onnx"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  shtrophic <aur@shtrophic.net>
    
      2# Contributor: Evine Deng <evinedeng@hotmail.com>
    
      3# Contributor: Thomas Eizinger <thomas@eizinger.io>
    
      4
    
      5pkgname=photoprism
    
      6pkgver=260728
    
      7_commit=bbde8f452
    
      8_pkgver="${pkgver}-${_commit}"
    
      9pkgrel=1
    
      10pkgdesc="AI-Powered Photos App for the Decentralized Web"
    
      11arch=('x86_64')
    
      12url="https://github.com/${pkgname}/${pkgname}"
    
      13license=('AGPL-3.0-or-later')
    
      14depends=(glibc glib2 libvips photoprism-tensorflow photoprism-onnxruntime)
    
      15makedepends=(go npm findutils)
    
      16optdepends=("darktable: for RAW to JPEG conversion"
    
      17	"ffmpeg: for video transcoding and thumbnail extraction"
    
      18	"libva: for video transcoding"
    
      19	"imagemagick: for image conversion"
    
      20	"libheif: for HEIC/HEIF image conversion"
    
      21	"mariadb: for MySQL database driver"
    
      22	"perl-image-exiftool: for extracting metadata"
    
      23	"rawtherapee: for RAW to JPEG conversion")
    
      24source=("${pkgname}-${_pkgver}.tar.gz::${url}/archive/refs/tags/${_pkgver}.tar.gz"
    
      25	"https://dl.${pkgname}.app/onnx/models/scrfd_500m_bnkps_shape640x640.onnx"
    
      26	"https://dl.${pkgname}.app/tensorflow/facenet.zip"
    
      27	"https://dl.${pkgname}.app/tensorflow/nasnet.zip"
    
      28	"https://dl.${pkgname}.app/tensorflow/nsfw.zip"
    
      29	"${pkgname}-import."{service,timer}
    
      30	"${pkgname}-vision."{service,timer}
    
      31	"${pkgname}."{service,sysusers,tmpfiles,user.service}
    
      32	"defaults.yml"
    
      33	"01-internal-config-config_go.patch")
    
      34backup=("etc/${pkgname}/defaults.yml")
    
      35b2sums=('613ef4ae5f486f2c5797bf1d4dd3c94cb87c34ef316c7144feef40fed1e6dd8fc0c29698e73f8169f08c9c3bcdc558412ef95e7a5918493d2e2d37d0cb8dd837'
    
      36        '2cafc2c00eabba8dee5e63982c4c642c5df00975c568b37d3cff81f0da94c8db746ea3fc31c4a98086527ed2db86b2ff48c36551163d0457001913eddfdbddc4'
    
      37        'ae3fe8162773ca9c84be2ea49dbc33e8a381d25cbbb51660c9f7a0764b89128eb8b40aceb10272e2579f277f76b8622d1f366e38e7c290266280c1db268365c5'
    
      38        '846cc4ce2d8c170c6442cf1f3a235d49744ff704300b619947bd425861ac4312d5465c749fd1179e4c25163d3a3428cd31359b7ea1521fa6edab81dba88074a0'
    
      39        'ca264c8ba2f999490c1335767286ddfe42a92d8606c371f17b5aa3f333bda3ade9c4f2451f7df7489946c9ae503f82351879a9876cd80e036a7991945e1242ec'
    
      40        'f5a06fd26f15afa7b71bd66afba800488fad697567754b6efc0d20f55955c043ba817d280b1d80c901ccbfcf085f11ad289624946bcd4bf2c3f3ee963a431c2d'
    
      41        'e75033ee265dddf39cb4f0d1cfc1e86a540da37c9787e3c13040b6fc039437d6684be3b59d63f001864f98f46afd49847b86b4fc6bedf891be87881a4bb83cf0'
    
      42        '438f6206adaf7b1beccda7b65ea71ecc45c29b4443942b823ad4652dde40d0cdbb8d5b7e3476aaf0643e5ad4369377ae9df0682bf73ca7d2af419c3820b2ef20'
    
      43        '8b54d90d8ee721c555c3650f8c1041a5068a65aa847c0f768ce5d05a917b60e961b332fc8608ee7f3b0b8928e0606e49e85b5f3baa1e3b85d00b7decdf9f29da'
    
      44        '3896b95ddda233270591e673f564bb3c7c537f9140d9ad0451259249d0bd956daf2b2cc70c3ba7fbd2971e97e126e13ecde368388c8e160708fbccad206c5d55'
    
      45        '02a752c8dda9c1611cac8119cf603bb8147dda1aa68fabaa9be61952e1839132d190691a68a01d0443d3750f76319a9e77e7fb9f175d5dbd0f527e5e4529ede8'
    
      46        'f8ad9373b97b6f5bda10caa193ae3f6700f8e15d82f30a2c8ad0fec02c5c25c3ad1f62ae524aa5e28b07312016d31c2918a3a9a3b172e61128fe054b129eecbe'
    
      47        '96d8d89499adfd1e3fba1b729133f3a01dbe16b2cb11deacc7e0e69620530c8f28e19911b16368816d98ce8e4ffa9645e8cb0429c82314179c335e736db87198'
    
      48        'eda69ac2d568534e3f5ca89605f68114dc034bc6c31c9a0edbdec14b79165aa9dd2f1183276cde40f0a69cd6e511b2c1250617103dc3d1ee8e0074469be7e93b'
    
      49        'e91d9a583d6eb7c2f31f0348885e5f8360c2f442ea800d0afbb627612fd84de2a705eebfa8782d9556b2f8af00fc15d16238e2ecc5700fd9373c693e209c8af8')
    
      50
    
      51prepare() {
    
      52	export GOPATH="$srcdir/go"
    
      53	export GOFLAGS="-modcacherw -mod=readonly"
    
      54
    
      55	cd "$pkgname-$_pkgver"
    
      56
    
      57	for p in "$srcdir/"*.patch; do
    
      58		patch -p0 <$p
    
      59	done
    
      60
    
      61	go mod download
    
      62
    
      63	npm --prefix=frontend install --cache "$srcdir/npm-cache"
    
      64}
    
      65
    
      66build() {
    
      67	export CGO_CFLAGS="$CFLAGS -I/usr/include/photoprism"
    
      68	export CGO_CPPFLAGS="$CPPFLAGS"
    
      69	export CGO_CXXFLAGS="$CXXFLAGS"
    
      70	export NODE_ENV=production
    
      71	export GOPATH="$srcdir/go"
    
      72
    
      73	cd "$pkgname-$_pkgver"
    
      74	local buildid="$_pkgver-$(uname -s)-$(uname -m)"
    
      75	local ldflags="
    
      76	-s -w \
    
      77	-linkmode external \
    
      78	-extldflags '$LDFLAGS -L/usr/lib/photoprism -Wl,-rpath=/usr/lib/photoprism' \
    
      79	-X main.version=$buildid
    
      80    "
    
      81	go build \
    
      82		-trimpath \
    
      83		-buildmode=pie \
    
      84		-mod=readonly \
    
      85		-modcacherw \
    
      86		-ldflags "$ldflags" \
    
      87		-o "$pkgname" \
    
      88		"./cmd/$pkgname/$pkgname.go"
    
      89
    
      90	npm --prefix=frontend run build
    
      91}
    
      92
    
      93package() {
    
      94	find {facenet,nasnet,nsfw} -type f -exec install -Dm644 {} "$pkgdir/usr/share/$pkgname/"{} \;
    
      95	install -Dm644 scrfd*.onnx -t "$pkgdir/usr/share/$pkgname/scrfd"
    
      96
    
      97	install -Dm644 "$pkgname-import".* "$pkgname-vision".* "$pkgname.service" -t "$pkgdir/usr/lib/systemd/system"
    
      98	install -Dm644 "$pkgname.sysusers" "$pkgdir/usr/lib/sysusers.d/$pkgname.conf"
    
      99	install -Dm644 "$pkgname.tmpfiles" "$pkgdir/usr/lib/tmpfiles.d/$pkgname.conf"
    
      100	install -Dm644 "$pkgname.user.service" "$pkgdir/usr/lib/systemd/user/$pkgname.service"
    
      101	install -Dm644 "defaults.yml" "$pkgdir/etc/$pkgname/defaults.yml"
    
      102
    
      103	cd "$pkgname-$_pkgver"
    
      104	install -Dm755 "$pkgname" "$pkgdir/usr/bin/$pkgname"
    
      105	install -Dm644 LICENSE -t "$pkgdir/usr/share/licenses/$pkgname"
    
      106
    
      107	cd assets
    
      108	find {locales,profiles,static,templates} -type f -exec install -Dm644 {} "$pkgdir/usr/share/$pkgname/"{} \;
    
      109}
    
      110

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2