photoprism
maintainer shtrophic
· 3 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The package downloads model files (ONNX, zip) from the project's own domain (dl.photoprism.app), which is plausibly official; these are data files, not executables, and the main source is a tagged release from GitHub; checksums are provided, so the risk is low.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads model files (ONNX, zip) from the project's own domain (dl.photoprism.app), which is plausibly official; these are data files, not executables, and the main source is a tagged release from GitHub; checksums are provided, so the risk is low.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:25
"https://dl.${pkgname}.app/onnx/models/scrfd_500m_bnkps_shape640x640.onnx"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: shtrophic <aur@shtrophic.net>
2
# Contributor: Evine Deng <evinedeng@hotmail.com>
3
# Contributor: Thomas Eizinger <thomas@eizinger.io>
4
5
pkgname=photoprism
6
pkgver=260728
7
_commit=bbde8f452
8
_pkgver="${pkgver}-${_commit}"
9
pkgrel=1
10
pkgdesc="AI-Powered Photos App for the Decentralized Web"
11
arch=('x86_64')
12
url="https://github.com/${pkgname}/${pkgname}"
13
license=('AGPL-3.0-or-later')
14
depends=(glibc glib2 libvips photoprism-tensorflow photoprism-onnxruntime)
15
makedepends=(go npm findutils)
16
optdepends=("darktable: for RAW to JPEG conversion"
17
"ffmpeg: for video transcoding and thumbnail extraction"
18
"libva: for video transcoding"
19
"imagemagick: for image conversion"
20
"libheif: for HEIC/HEIF image conversion"
21
"mariadb: for MySQL database driver"
22
"perl-image-exiftool: for extracting metadata"
23
"rawtherapee: for RAW to JPEG conversion")
24
source=("${pkgname}-${_pkgver}.tar.gz::${url}/archive/refs/tags/${_pkgver}.tar.gz"
25
"https://dl.${pkgname}.app/onnx/models/scrfd_500m_bnkps_shape640x640.onnx"
26
"https://dl.${pkgname}.app/tensorflow/facenet.zip"
27
"https://dl.${pkgname}.app/tensorflow/nasnet.zip"
28
"https://dl.${pkgname}.app/tensorflow/nsfw.zip"
29
"${pkgname}-import."{service,timer}
30
"${pkgname}-vision."{service,timer}
31
"${pkgname}."{service,sysusers,tmpfiles,user.service}
32
"defaults.yml"
33
"01-internal-config-config_go.patch")
34
backup=("etc/${pkgname}/defaults.yml")
35
b2sums=('613ef4ae5f486f2c5797bf1d4dd3c94cb87c34ef316c7144feef40fed1e6dd8fc0c29698e73f8169f08c9c3bcdc558412ef95e7a5918493d2e2d37d0cb8dd837'
36
'2cafc2c00eabba8dee5e63982c4c642c5df00975c568b37d3cff81f0da94c8db746ea3fc31c4a98086527ed2db86b2ff48c36551163d0457001913eddfdbddc4'
37
'ae3fe8162773ca9c84be2ea49dbc33e8a381d25cbbb51660c9f7a0764b89128eb8b40aceb10272e2579f277f76b8622d1f366e38e7c290266280c1db268365c5'
38
'846cc4ce2d8c170c6442cf1f3a235d49744ff704300b619947bd425861ac4312d5465c749fd1179e4c25163d3a3428cd31359b7ea1521fa6edab81dba88074a0'
39
'ca264c8ba2f999490c1335767286ddfe42a92d8606c371f17b5aa3f333bda3ade9c4f2451f7df7489946c9ae503f82351879a9876cd80e036a7991945e1242ec'
40
'f5a06fd26f15afa7b71bd66afba800488fad697567754b6efc0d20f55955c043ba817d280b1d80c901ccbfcf085f11ad289624946bcd4bf2c3f3ee963a431c2d'
41
'e75033ee265dddf39cb4f0d1cfc1e86a540da37c9787e3c13040b6fc039437d6684be3b59d63f001864f98f46afd49847b86b4fc6bedf891be87881a4bb83cf0'
42
'438f6206adaf7b1beccda7b65ea71ecc45c29b4443942b823ad4652dde40d0cdbb8d5b7e3476aaf0643e5ad4369377ae9df0682bf73ca7d2af419c3820b2ef20'
43
'8b54d90d8ee721c555c3650f8c1041a5068a65aa847c0f768ce5d05a917b60e961b332fc8608ee7f3b0b8928e0606e49e85b5f3baa1e3b85d00b7decdf9f29da'
44
'3896b95ddda233270591e673f564bb3c7c537f9140d9ad0451259249d0bd956daf2b2cc70c3ba7fbd2971e97e126e13ecde368388c8e160708fbccad206c5d55'
45
'02a752c8dda9c1611cac8119cf603bb8147dda1aa68fabaa9be61952e1839132d190691a68a01d0443d3750f76319a9e77e7fb9f175d5dbd0f527e5e4529ede8'
46
'f8ad9373b97b6f5bda10caa193ae3f6700f8e15d82f30a2c8ad0fec02c5c25c3ad1f62ae524aa5e28b07312016d31c2918a3a9a3b172e61128fe054b129eecbe'
47
'96d8d89499adfd1e3fba1b729133f3a01dbe16b2cb11deacc7e0e69620530c8f28e19911b16368816d98ce8e4ffa9645e8cb0429c82314179c335e736db87198'
48
'eda69ac2d568534e3f5ca89605f68114dc034bc6c31c9a0edbdec14b79165aa9dd2f1183276cde40f0a69cd6e511b2c1250617103dc3d1ee8e0074469be7e93b'
49
'e91d9a583d6eb7c2f31f0348885e5f8360c2f442ea800d0afbb627612fd84de2a705eebfa8782d9556b2f8af00fc15d16238e2ecc5700fd9373c693e209c8af8')
50
51
prepare() {
52
export GOPATH="$srcdir/go"
53
export GOFLAGS="-modcacherw -mod=readonly"
54
55
cd "$pkgname-$_pkgver"
56
57
for p in "$srcdir/"*.patch; do
58
patch -p0 <$p
59
done
60
61
go mod download
62
63
npm --prefix=frontend install --cache "$srcdir/npm-cache"
64
}
65
66
build() {
67
export CGO_CFLAGS="$CFLAGS -I/usr/include/photoprism"
68
export CGO_CPPFLAGS="$CPPFLAGS"
69
export CGO_CXXFLAGS="$CXXFLAGS"
70
export NODE_ENV=production
71
export GOPATH="$srcdir/go"
72
73
cd "$pkgname-$_pkgver"
74
local buildid="$_pkgver-$(uname -s)-$(uname -m)"
75
local ldflags="
76
-s -w \
77
-linkmode external \
78
-extldflags '$LDFLAGS -L/usr/lib/photoprism -Wl,-rpath=/usr/lib/photoprism' \
79
-X main.version=$buildid
80
"
81
go build \
82
-trimpath \
83
-buildmode=pie \
84
-mod=readonly \
85
-modcacherw \
86
-ldflags "$ldflags" \
87
-o "$pkgname" \
88
"./cmd/$pkgname/$pkgname.go"
89
90
npm --prefix=frontend run build
91
}
92
93
package() {
94
find {facenet,nasnet,nsfw} -type f -exec install -Dm644 {} "$pkgdir/usr/share/$pkgname/"{} \;
95
install -Dm644 scrfd*.onnx -t "$pkgdir/usr/share/$pkgname/scrfd"
96
97
install -Dm644 "$pkgname-import".* "$pkgname-vision".* "$pkgname.service" -t "$pkgdir/usr/lib/systemd/system"
98
install -Dm644 "$pkgname.sysusers" "$pkgdir/usr/lib/sysusers.d/$pkgname.conf"
99
install -Dm644 "$pkgname.tmpfiles" "$pkgdir/usr/lib/tmpfiles.d/$pkgname.conf"
100
install -Dm644 "$pkgname.user.service" "$pkgdir/usr/lib/systemd/user/$pkgname.service"
101
install -Dm644 "defaults.yml" "$pkgdir/etc/$pkgname/defaults.yml"
102
103
cd "$pkgname-$_pkgver"
104
install -Dm755 "$pkgname" "$pkgdir/usr/bin/$pkgname"
105
install -Dm644 LICENSE -t "$pkgdir/usr/share/licenses/$pkgname"
106
107
cd assets
108
find {locales,profiles,static,templates} -type f -exec install -Dm644 {} "$pkgdir/usr/share/$pkgname/"{} \;
109
}
110
Changes since previous scan
--- PKGBUILD @ 2026-06-19 19:07+++ PKGBUILD @ 2026-08-03 00:08@@ -3,8 +3,8 @@ # Contributor: Thomas Eizinger <thomas@eizinger.io> pkgname=photoprism-pkgver=260601-_commit=a7d098548+pkgver=260728+_commit=bbde8f452 _pkgver="${pkgver}-${_commit}" pkgrel=1 pkgdesc="AI-Powered Photos App for the Decentralized Web"@@ -32,7 +32,7 @@ "defaults.yml" "01-internal-config-config_go.patch") backup=("etc/${pkgname}/defaults.yml")-b2sums=('382edd25008c0985d2a862ecee8803b01c62e1f02cfc9ab6f4c6edc1a34b9c97a6aeaeec45047bf484f3e40a220a84ab2901863670955536018f645dbc1b44e8'+b2sums=('613ef4ae5f486f2c5797bf1d4dd3c94cb87c34ef316c7144feef40fed1e6dd8fc0c29698e73f8169f08c9c3bcdc558412ef95e7a5918493d2e2d37d0cb8dd837' '2cafc2c00eabba8dee5e63982c4c642c5df00975c568b37d3cff81f0da94c8db746ea3fc31c4a98086527ed2db86b2ff48c36551163d0457001913eddfdbddc4' 'ae3fe8162773ca9c84be2ea49dbc33e8a381d25cbbb51660c9f7a0764b89128eb8b40aceb10272e2579f277f76b8622d1f366e38e7c290266280c1db268365c5' '846cc4ce2d8c170c6442cf1f3a235d49744ff704300b619947bd425861ac4312d5465c749fd1179e4c25163d3a3428cd31359b7ea1521fa6edab81dba88074a0'Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 17:12:22 | MEDIUM | 1 |
| 2026-06-19 19:07:35 | CLEAN | 2 |
| 2026-06-18 18:55:24 | LOW | 2 |
| 2026-06-18 16:11:54 | MEDIUM | 1 |